Edit tour

Windows Analysis Report
https://account.live.com/SecurityNotifications/Update

Overview

General Information

Sample URL:	https://account.live.com/SecurityNotifications/Update
Analysis ID:	1432388
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML title does not match URL

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6408 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1980,i,8652758614314267871,3803113788145796724,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3668 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://249208506065339175713065343682620339232232032338309340364496680261609853560675097851030655341200131817362917853377759200390001605154889513680026748787630195/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1248 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1776,i,15102099204624039598,10397676671138157332,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://account.live.com/SecurityNotifications/Update" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=150&ct=1714169668&rver=7.5.2156.0&wp=SA_20MIN&wreply=https%3A%2F%2Faccount.live.com%2FSecurityNotifications%2FUpdate%3Fuaid%3D7f9195a098cd443fa1796dcb1af1a2e2&lc=1033&id=38936&mkt=en-US&uaid=7f9195a098cd443fa1796dcb1af1a2e2

HTTP Parser: Title: Sign in to your Microsoft account does not match URL

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49747 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49735 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49747 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgSaEMC5GMPOsLEGIjDIbr-lQCvY1TjsXx6a6xmiyNAE310AbNlfyG5SPthhIL36yr0P3Z1fJH8_8PiJjDMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-22; NID=513=ZPlQScGeGCYhf-_i_qHRTcq5TA4yTmlLDOxGvc958Oq5DS-sOu8FCVl5JPRgjKHrWH6MgnVWVrL_mUQ4Q0wjV1cdlmn_QR_5sqH7060DlQbGEiKIBwpoSZjNvrMlwN967L-vskNemgQJnhRaGh__b9kz7AjtFQchuJv6XInhqUA
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgSaEMC5GMPOsLEGIjBZmgCMjTLvo8nSfYg9lv3QO4nP5UlgrFJKaiTximzNi9SZgshngH0cJsihZymOV1syAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-22; NID=513=cYsgYpXMap7Tu7d_wtAITa_Xj8d5ziTIW9gkJdbWPopg9GA01pKG3eYq-HptGoBuL-lzgf15CCKPjAVWfS43emwOCdqmvA4KX_GT0I2MLOrT9QARgsL_CfFOk6xSmGs1Zpq67lNUv9UH1fs6qGT3kvAevYLhk5yogV5YhnZYXbo
Source: global traffic	HTTP traffic detected: GET /shared/5/js/login_en_aRDrgrd2cjfBKtrV-RMGZw2.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_54b1724af1b05e2ba3db_en.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/signin_options_4e48046ce74f4b89d450.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000.30185.3/images/favicon.ico HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/signin_options_4e48046ce74f4b89d450.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000.30185.3/images/favicon.ico HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: account.live.com
Source: global traffic	DNS traffic detected: DNS query: logincdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: acctcdn.msftauth.net

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714169648022&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49735 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@23/27@10/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1980,i,8652758614314267871,3803113788145796724,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://249208506065339175713065343682620339232232032338309340364496680261609853560675097851030655341200131817362917853377759200390001605154889513680026748787630195/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1776,i,15102099204624039598,10397676671138157332,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://account.live.com/SecurityNotifications/Update"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1980,i,8652758614314267871,3803113788145796724,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1776,i,15102099204624039598,10397676671138157332,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://account.live.com/SecurityNotifications/Update	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://logincdn.msftauth.net/shared/5/chunks/oneds-analytics-js_54b1724af1b05e2ba3db_en.js	0%	Avira URL Cloud	safe
https://logincdn.msftauth.net/shared/5/js/login_en_aRDrgrd2cjfBKtrV-RMGZw2.js	0%	Avira URL Cloud	safe
https://logincdn.msftauth.net/shared/5/images/signin_options_4e48046ce74f4b89d450.svg	0%	Avira URL Cloud	safe
https://logincdn.msftauth.net/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg	0%	Avira URL Cloud	safe
https://logincdn.msftauth.net/16.000.30185.3/images/favicon.ico	0%	Avira URL Cloud	safe
https://logincdn.msftauth.net/shared/5/images/2_bc3d32a696895f78c19d.svg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
part-0008.t-0009.t-msedge.net	13.107.246.36	true	false	unknown
sni1gl.wpc.alphacdn.net	152.195.19.97	true	false	unknown
www.google.com	142.250.80.36	true	false	high
cs1227.wpc.alphacdn.net	192.229.211.199	true	false	unknown
part-0012.t-0009.t-msedge.net	13.107.213.40	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
windowsupdatebg.s.llnwi.net	69.164.46.0	true	false	unknown
logincdn.msftauth.net	unknown	unknown	false	unknown
account.live.com	unknown	unknown	false	high
acctcdn.msftauth.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgSaEMC5GMPOsLEGIjBZmgCMjTLvo8nSfYg9lv3QO4nP5UlgrFJKaiTximzNi9SZgshngH0cJsihZymOV1syAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high
https://logincdn.msftauth.net/16.000.30185.3/images/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.google.com/async/newtab_promos	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
https://logincdn.msftauth.net/shared/5/js/login_en_aRDrgrd2cjfBKtrV-RMGZw2.js	false	Avira URL Cloud: safe	unknown
https://logincdn.msftauth.net/shared/5/images/signin_options_4e48046ce74f4b89d450.svg	false	Avira URL Cloud: safe	unknown
https://logincdn.msftauth.net/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg	false	Avira URL Cloud: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgSaEMC5GMPOsLEGIjDIbr-lQCvY1TjsXx6a6xmiyNAE310AbNlfyG5SPthhIL36yr0P3Z1fJH8_8PiJjDMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high
https://logincdn.msftauth.net/shared/5/images/2_bc3d32a696895f78c19d.svg	false	Avira URL Cloud: safe	unknown
https://logincdn.msftauth.net/shared/5/chunks/oneds-analytics-js_54b1724af1b05e2ba3db_en.js	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.36	www.google.com	United States	15169	GOOGLEUS	false
192.229.211.199	cs1227.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.107.213.40	part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432388
Start date and time:	2024-04-27 00:13:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://account.live.com/SecurityNotifications/Update
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@23/27@10/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.40.131, 142.251.40.238, 172.253.63.84, 34.104.35.123, 13.107.42.22, 20.190.152.19, 40.126.24.147, 40.126.24.81, 40.126.24.149, 20.190.152.20, 40.126.24.82, 40.126.24.83, 40.126.24.146, 142.251.40.170, 142.250.81.234, 142.250.65.234, 142.251.40.202, 142.251.32.106, 142.250.72.106, 142.250.64.106, 142.251.40.234, 142.250.65.170, 142.250.80.42, 142.251.40.138, 142.251.41.10, 142.251.40.106, 142.251.35.170, 172.217.165.138, 142.250.65.202, 52.168.117.171, 199.232.214.172, 40.68.123.157, 192.229.211.108, 13.78.111.199, 72.21.81.240, 20.3.187.198, 13.85.23.206, 142.251.40.163
Excluded domains from analysis (whitelisted): logincdn.msauth.net, lgincdnmsftuswe2.azureedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, acctcdn.msauth.net, acctcdn.trafficmanager.net, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, login.live.com, onedscolprdeus16.eastus.cloudapp.azure.com, ocsp.edge.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, acctcdnvzeuno.azureedge.net, acctcdnvzeuno.ec.azureedge.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, acctcdnmsftuswe2.azureedge.net, accounts.google.com, content-autofill.googleapis.com, acctcdnmsftuswe2.afd.azureedge.net, wu.ec.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, lgincdnvzeuno.ec.azureedge.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, account.msa.trafficmanager.net, logi
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://account.live.com/SecurityNotifications/Update

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 21:14:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9843027713475
Encrypted:	false
SSDEEP:	48:8m2dPTnrYHVidAKZdA19ehwiZUklqehOy+3:8tXSBy
MD5:	90F52EC5E68A3118B4B25CB13C3183A3
SHA1:	D60772F83A14ED24AFB411D5BF5F12583AD82929
SHA-256:	8ECB8B934F2DAC62FD5AC3F958F853B45BF55EA709C35F4290643AA4904830BB
SHA-512:	FD71795D87F1F08C6A0C409EDAB51C27C5B3F3B6F3451748B5E48A26254CA4350CAFB45CF6C32FFB9E30D7B984603D35F0DFBBD8F76B723BE9542EC24E682386
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....{.?.'...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 21:14:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9979905728804725
Encrypted:	false
SSDEEP:	48:8n2dPTnrYHVidAKZdA1weh/iZUkAQkqehxy+2:8KXI9Qgy
MD5:	1D7DB4EC3EC028905294BF644C6E8A4A
SHA1:	F9E74E517FCC629E81A2FCEEAC9A2B581D1B29B2
SHA-256:	30A1C5919B1E21E420674EFCFA651022F7B09E950A16E186FFA5E4F073F77C4D
SHA-512:	1848C95FBE3837D3874F027AE214219757934579BA3B8E9394247EA60684272A2977EF9B8A76A4B68518081DF5CAB6A1B0DC1E71B74A5F095CC0FE6FB6691D28
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....8&..'...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.008724637648208
Encrypted:	false
SSDEEP:	48:8x52dPTnrsHVidAKZdA14tseh7sFiZUkmgqeh7sby+BX:8x8XMn1y
MD5:	FD4FD058864F3A5A45ABDA14BE2519D9
SHA1:	9EA6437E6B083F92DEE0DC7E3C3F0B9504F2773E
SHA-256:	4E6D99E8E38C92281FCE75681A77FDF8624F3AF6222A7E74BF4574D627A42057
SHA-512:	1258726D1D9925BE37C316BF9A5ED691AFBC7946BC7BB9535A44FF1E3800B5730052AEFD221A1BFC6C96B0E642AE21D367EC4832ADBDA3C2DCEC3F88B60F3A31
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 21:14:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.998554593648831
Encrypted:	false
SSDEEP:	48:8x2dPTnrYHVidAKZdA1vehDiZUkwqehty+R:8EXTTy
MD5:	6AB3E1B6147AC4BE49BF2A5FDA77D710
SHA1:	6B7060D6F30371984C1AA1A85A9EF196D4AF33E3
SHA-256:	DB038317085B4BA1E21291C08460A354CF0715A301CAF7D126F6DD52B9F99824
SHA-512:	58875A9F1966DD84B1CB1B87924B0D4CD1489228D76247F53F0FF1D76F8CF4D6544A00038C16F015B55FBB84398DA8338DF1BAA155C47B9F10F902678F35E84A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....z...'...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 21:14:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9880992130519024
Encrypted:	false
SSDEEP:	48:842dPTnrYHVidAKZdA1hehBiZUk1W1qehvy+C:8fXD9Py
MD5:	E84B978324CD015C015303CE1EBD5568
SHA1:	0195347B921361A98F3B47BB71F67D5D2A87A9D7
SHA-256:	69C079335D07DB568AA08F4EFCB503ADAE175A0BEC0F934345C0F12B6EA405C5
SHA-512:	7979D5552D839B23B2E57BE78E12DEF8409D1A3BF2FE9B239A1FFB7FF631336797D6BF1E4024A77CDC531F55A0AA359F30ED0B60DD976467E91B898641E442C2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....!..'...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 21:14:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9961024893776953
Encrypted:	false
SSDEEP:	48:8Z2dPTnrYHVidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb1y+yT+:8cXzT/TbxWOvTb1y7T
MD5:	037F9A9472280E7926F6815D6B298983
SHA1:	9F3B5F22045EC66C941129477C4BBA4EF138B1E6
SHA-256:	01BD950FE7432016C976B664D15CB2B203DC3C5284D161C9A56B7FED7DE81351
SHA-512:	2732470312F7D89AF7DD953ABBABD74610E50815E939E2154E682A639976950B63D3FC14091FD34E41CB3886B8E0B290EFBD44BFB9F2956DA5554C72BF8E5FC5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....+7.'...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4239)
Category:	downloaded
Size (bytes):	4244
Entropy (8bit):	5.823705225082206
Encrypted:	false
SSDEEP:	96:wRxliCWQFd66666+6L3lKfh1sMlscY4nNsHhI3yoIy69zsXffffQo:wh1Fd66666+o38frsKscYBHa3yoI99wb
MD5:	D09C39C1B140A4C8AAD135599C644D8D
SHA1:	88E5D449806157811201201A85117D7292496A7B
SHA-256:	21D84922D6C8A73CB0A17AA6EAE0A34F2FF396ECB373AACA4B086232BE8C5835
SHA-512:	8CA1F4C9918A473BD5FDD79D484C9843BA2FBE016C726502525446AF9D0E6DFFBC2DECCBE3ADD5A0DD949C129378FDBF08B0E58F5AB9122F7C072E9F8C2D7B8A
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["deadpool wolverine leaks","las vegas raiders draft picks","helldivers 2 major order","nasa mars spiders","weather storms tornadoes","great gatsby musical","nfl draft trade rumors","columbia university student protests"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMWxjbXhrdmJ2EhhNdXNpY2FsIGJ5IEthaXQgS2VycmlnYW4y/xJkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBREFRRUFBd0FBQUFBQUFBQUFBQUFFQlFZREJ3QUJDUC9FQURZUUFBSUJBZ1VDQXdZRUJRVUFBQUFBQUFFQ0F3UVJBQVVTSVRFR1VSTkJZUlFpY1

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Reputation:	low
URL:	https://logincdn.msftauth.net/shared/5/images/signin_options_4e48046ce74f4b89d450.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	20
Entropy (8bit):	3.8464393446710154
Encrypted:	false
SSDEEP:	3:Sic/Cm:Sic/Cm
MD5:	FFDF36EA8BC44BB187C17DE113EE5C5F
SHA1:	315CCB39356B97B40797BB2AF89A7397B66D7EFE
SHA-256:	B0613ED71834B726DC1241F28B12071A64B0CC19D99B33D834F1C06062BFE280
SHA-512:	12D8B8487AEC51A95D945F8E2819DC7151D019DB09A8C1F76D463C63AA40CE3ABDBA08DA3FC4B0C20A311691C1AA24384C6B06EF5EC267F3240AF2FFB3F780E9
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAlCt3QpV_m2AhIFDdFbUVI=?alt=proto
Preview:	Cg0KCw3RW1FSGgQIZBgC

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65470)
Category:	downloaded
Size (bytes):	896695
Entropy (8bit):	5.417885373061352
Encrypted:	false
SSDEEP:	6144:4TW9p/I5FEF7n1+z41aZEFf6K5bGmuyZvrwry0+f9N1VrHtZe40dvY5HOQ9psEMx:jnQE4K5Buym+FNXf3sH
MD5:	6910EB82B7767237C12ADAD5F9130667
SHA1:	5D29D365CAC51E71246ACFFB008420551236A03C
SHA-256:	999DBCAA1A512FC19C955FFD7F5FDF59E3AA04195987DB632E3189C488010A4E
SHA-512:	55F6488FC870F2B3DD18BAE950D7F8E04A2124F2108AA539BF3B3A6B8C872523095E696ECD9FB1DF66C512D1506B93FB49F891D9F10698E0A4C106211BBCB92B
Malicious:	false
Reputation:	low
URL:	https://logincdn.msftauth.net/shared/5/js/login_en_aRDrgrd2cjfBKtrV-RMGZw2.js
Preview:	/! For license information please see login_en.js.LICENSE.txt /.!function(){var e,t,n,r,o={97206:function(e,t,n){"use strict";var r=n(9384),o={childContextTypes:!0,contextType:!0,contextTypes:!0,defaultProps:!0,displayName:!0,getDefaultProps:!0,getDerivedStateFromError:!0,getDerivedStateFromProps:!0,mixins:!0,propTypes:!0,type:!0},i={name:!0,length:!0,prototype:!0,caller:!0,callee:!0,arguments:!0,arity:!0},a={$$typeof:!0,compare:!0,defaultProps:!0,displayName:!0,propTypes:!0,type:!0},l={};function s(e){return r.isMemo(e)?a:l[e.$$typeof]\|\|o}l[r.ForwardRef]={$$typeof:!0,render:!0,defaultProps:!0,displayName:!0,propTypes:!0},l[r.Memo]=a;var c=Object.defineProperty,u=Object.getOwnPropertyNames,d=Object.getOwnPropertySymbols,f=Object.getOwnPropertyDescriptor,p=Object.getPrototypeOf,g=Object.prototype;e.exports=function e(t,n,r){if("string"!=typeof n){if(g){var o=p(n);o&&o!==g&&e(t,o,r)}var a=u(n);d&&(a=a.concat(d(n)));for(var l=s(t),m=s(n),h=0;h<a.length;++h){var b=a[h];if(!(i[b]\|\|r&&r[b]

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65436)
Category:	downloaded
Size (bytes):	90690
Entropy (8bit):	5.331029016047939
Encrypted:	false
SSDEEP:	768:BVEDx3ySKZOP00d5TjMSYzSRRM1d0YjSRpUKHHacTItx7vtn1yC0JalF1rmq6LlE:b+0Z9yFrGi8SRGfyC0JalFx3gKak
MD5:	D390AA6A6D257834D807D8E7DDC90968
SHA1:	6A6EFD105DBBEB099D25998A38875808D83AF5C8
SHA-256:	D755D7CE744425DEE51A3BD8CBA9B2A789D96C584C9958082B557FEB70F226D9
SHA-512:	9629ED6071CFED4EFF34C163F36482336F0D402FD95951FC792A5F125C1BE1CA3C6918E61A4A79815B15AB5CDD6BCEF30D4FE0090C283C02590B62879D960818
Malicious:	false
Reputation:	low
URL:	https://logincdn.msftauth.net/shared/5/chunks/oneds-analytics-js_54b1724af1b05e2ba3db_en.js
Preview:	/! For license information please see oneds-analytics-js_54b1724af1b05e2ba3db_en.js.LICENSE.txt /."use strict";(self.webpackChunk_msidentity_sisu_msa=self.webpackChunk_msidentity_sisu_msa\|\|[]).push([[251],{41696:function(n,e,t){t.r(e),t.d(e,{AppInsightsCore:function(){return qo},ApplicationInsights:function(){return ja},BE_PROFILE:function(){return Vo},BaseTelemetryPlugin:function(){return di},Cloud:function(){return Vi},CoreUtils:function(){return Hr},Device:function(){return Xi},DiagnosticLogger:function(){return et},EventLatency:function(){return Ga},EventPersistence:function(){return Qa},EventsDiscardedReason:function(){return Ho},InternalAppInsightsCore:function(){return Ko},Loc:function(){return $i},LoggingSeverity:function(){return Wa},MinChannelPriorty:function(){return $a},NRT_PROFILE:function(){return Wo},NotificationManager:function(){return Uo},PostChannel:function(){return qa},PropertiesPlugin:function(){return Po},RT_PROFILE:function(){return jo},Session:function(){retu

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://logincdn.msftauth.net/16.000.30185.3/images/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	low
URL:	https://logincdn.msftauth.net/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
URL:	https://logincdn.msftauth.net/shared/5/images/2_bc3d32a696895f78c19d.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 27, 2024 00:14:18.738841057 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:18.738862991 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:18.848228931 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:27.091893911 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.091928959 CEST	443	49707	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.092052937 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.092684031 CEST	49708	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.092730045 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.092987061 CEST	49708	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.094481945 CEST	49708	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.094497919 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.094959974 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.094974995 CEST	443	49707	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.369832993 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.370170116 CEST	49708	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.370201111 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.370759010 CEST	443	49707	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.370948076 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.370954037 CEST	443	49707	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.371746063 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.371819019 CEST	49708	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.372632027 CEST	443	49707	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.372714043 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.373035908 CEST	49708	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.373115063 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.373666048 CEST	49711	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.373756886 CEST	443	49711	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.373892069 CEST	49711	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.374013901 CEST	49712	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.374053955 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.374114990 CEST	49708	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.374124050 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.374145985 CEST	49712	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.374952078 CEST	49711	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.374985933 CEST	443	49711	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.375097990 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.375195980 CEST	443	49707	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.375235081 CEST	49712	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.375257015 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.375361919 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.375369072 CEST	443	49707	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.417629004 CEST	49708	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.417756081 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.638883114 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.638986111 CEST	443	49711	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.639322042 CEST	49712	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.639385939 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.640089989 CEST	49711	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.640130997 CEST	443	49711	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.640517950 CEST	443	49711	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.640938997 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.640939951 CEST	49711	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.641000986 CEST	49712	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.641017914 CEST	443	49711	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.641077995 CEST	49711	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.641557932 CEST	49712	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.641648054 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.664524078 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.664657116 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.664757967 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.664809942 CEST	49708	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.664841890 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.665255070 CEST	49708	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.673062086 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.673384905 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.673448086 CEST	49708	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.673549891 CEST	49708	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.673577070 CEST	443	49708	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.688117027 CEST	443	49711	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.772036076 CEST	49712	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.772053957 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:27.797032118 CEST	49711	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:27.960453033 CEST	49712	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.043740988 CEST	443	49707	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.043822050 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.043845892 CEST	443	49707	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.043936014 CEST	443	49707	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.044023037 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.044730902 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.044759035 CEST	443	49707	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.044768095 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.044847965 CEST	49707	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.046957016 CEST	49712	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.092128992 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.190107107 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.190165997 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.190229893 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.190305948 CEST	49712	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.190357924 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.190387011 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.190440893 CEST	49712	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.190807104 CEST	49712	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.190836906 CEST	443	49712	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.391066074 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:28.406070948 CEST	443	49711	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.406167030 CEST	49711	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.406219959 CEST	443	49711	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.406244040 CEST	443	49711	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.406305075 CEST	49711	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.406824112 CEST	49711	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.406851053 CEST	443	49711	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.406874895 CEST	49711	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.407032013 CEST	49711	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.409699917 CEST	49716	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.409722090 CEST	443	49716	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.409811020 CEST	49716	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.410013914 CEST	49716	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:28.410022974 CEST	443	49716	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.469456911 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:28.469471931 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:28.676220894 CEST	443	49716	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:28.788274050 CEST	49716	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:29.906296968 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:29.906402111 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:29.980212927 CEST	49716	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:29.980226994 CEST	443	49716	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:29.980722904 CEST	443	49716	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:30.043139935 CEST	49716	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:30.043318033 CEST	443	49716	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:30.044631004 CEST	49716	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:30.088124037 CEST	443	49716	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:30.178491116 CEST	443	49716	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:30.178600073 CEST	443	49716	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:30.178637981 CEST	49716	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:30.178643942 CEST	443	49716	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:30.179069996 CEST	443	49716	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:30.179121017 CEST	49716	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:30.284778118 CEST	49716	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:30.284807920 CEST	443	49716	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:30.556078911 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:30.556180954 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:30.556258917 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:30.557544947 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:30.557583094 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:30.605067015 CEST	49720	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.605165005 CEST	443	49720	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.605231047 CEST	49720	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.607953072 CEST	49721	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.607969999 CEST	443	49721	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.608021975 CEST	49721	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.610079050 CEST	49721	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.610093117 CEST	443	49721	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.627881050 CEST	49720	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.627917051 CEST	443	49720	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.817914963 CEST	49722	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:30.817958117 CEST	443	49722	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:30.818020105 CEST	49722	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:30.818526983 CEST	49722	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:30.818542004 CEST	443	49722	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:30.828749895 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:30.829724073 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:30.829802990 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:30.830858946 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:30.830933094 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:30.832325935 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:30.832398891 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:30.832724094 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:30.832742929 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:30.906940937 CEST	443	49720	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.907689095 CEST	49720	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.907711029 CEST	443	49720	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.908736944 CEST	443	49720	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.908813000 CEST	49720	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.909449100 CEST	443	49721	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.909785032 CEST	49721	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.909805059 CEST	443	49721	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.911505938 CEST	443	49721	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.911577940 CEST	49721	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.916688919 CEST	49720	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.916785002 CEST	443	49720	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.917383909 CEST	49721	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.917491913 CEST	443	49721	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.965219021 CEST	49720	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.965239048 CEST	443	49720	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:30.997615099 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:30.997688055 CEST	49721	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:30.997699022 CEST	443	49721	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:31.008162022 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.017191887 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.017201900 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.017231941 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.017245054 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.017247915 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.017258883 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.017304897 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.017344952 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.017344952 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.017364979 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.017401934 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.031343937 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.031352997 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.031367064 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.031425953 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.031436920 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.031492949 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.031527996 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.092714071 CEST	443	49722	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:31.094019890 CEST	49722	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:31.094069004 CEST	443	49722	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:31.094540119 CEST	443	49722	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:31.095388889 CEST	49722	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:31.095477104 CEST	443	49722	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:31.108062029 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.108079910 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.108145952 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.108182907 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.108196974 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.108230114 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.118743896 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.118753910 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.118768930 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.118804932 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.118818045 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.118848085 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.118860960 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.130732059 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.130779982 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.130810022 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.130814075 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.130851984 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.130875111 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.130903006 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.130903006 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.130903959 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.144303083 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.144321918 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.144361973 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.144373894 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.144412041 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.157773972 CEST	49720	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:31.186556101 CEST	49721	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:31.186588049 CEST	49722	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:31.186604023 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.197494984 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.197504044 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.197556019 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.197607994 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.197617054 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.197638035 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.197669983 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.197736025 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.209568977 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.209587097 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.209651947 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.209670067 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.209722996 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.223273993 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.223289013 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.223375082 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.223397017 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.223424911 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.223468065 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.234061003 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.234076023 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.234139919 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.234155893 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.234208107 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.243624926 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.243642092 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.243729115 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.243743896 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.243794918 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.253844976 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.253864050 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.253972054 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.253988028 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.254035950 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.263340950 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.263356924 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.263439894 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.263456106 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.263506889 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.273423910 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.273441076 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.273499012 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.273514032 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.273541927 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.273561954 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.281939030 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.281955004 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.282037973 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.282059908 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.282089949 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.282113075 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.289660931 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.289676905 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.289741039 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.289761066 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.289788961 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.289928913 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.300118923 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.300132990 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.300184011 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.300198078 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.300230026 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.300261974 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.306534052 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.306549072 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.306606054 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.306621075 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.306651115 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.306670904 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.312561989 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.312577009 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.312634945 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.312649965 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.312679052 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.312943935 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.320005894 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.320020914 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.320069075 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.320081949 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.320132017 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.320405960 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.328288078 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.328335047 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.328366995 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.328381062 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.328413963 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.328438044 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.328449965 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.335285902 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.335310936 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.335361958 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.335377932 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.335408926 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.341499090 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.341517925 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.341576099 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.341598988 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.341630936 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.358346939 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.358416080 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.358460903 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.358477116 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.358508110 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.359524965 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.359600067 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.359602928 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.359647036 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.359671116 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.361151934 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.361202002 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.361234903 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.361249924 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.361282110 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.362173080 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.362214088 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.362243891 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.362258911 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.362287998 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.376458883 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.376507998 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.376544952 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.376588106 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.376621008 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.381364107 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.381462097 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.381479979 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.382077932 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.382153988 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.382167101 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.383219957 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.383280039 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.383306980 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.383328915 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.383349895 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.384073973 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.384140968 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.384155035 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.384218931 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.384284973 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.384296894 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.398912907 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.398966074 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.399013042 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.399049997 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.399080038 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.400465965 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.400506973 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.400540113 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.400556087 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.400585890 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.401524067 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.401576042 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.401603937 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.401619911 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.401648045 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.401952982 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.401997089 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.402019024 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.402034044 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.402064085 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.402287960 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.402333975 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.402357101 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.402370930 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.402400970 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.402825117 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.402842999 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.402889967 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.402908087 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.402934074 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.403084993 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.403130054 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.403160095 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.403173923 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.403209925 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.404170036 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.404211044 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.404243946 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.404258013 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.404284954 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.406891108 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.406939983 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.406966925 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.406981945 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.407012939 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.410268068 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.410306931 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.410339117 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.410355091 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.410384893 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.413168907 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.413217068 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.413268089 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.413289070 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.413314104 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.416354895 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.416394949 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.416429996 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.416444063 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.416474104 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.421859026 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.422394991 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.422410011 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.422624111 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.422703028 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.422717094 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.427874088 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.427917004 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.427954912 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.427968979 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.428000927 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.429276943 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.429326057 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.429368019 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.429382086 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.429414034 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.429588079 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.429627895 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.429682970 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.429697037 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.429725885 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.429800034 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.430636883 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.430680037 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.430716038 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.430731058 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.430758953 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.447088957 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.447143078 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.447170019 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.447185040 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.447215080 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.448841095 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.448867083 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.448942900 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.448957920 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.448993921 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.451606035 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.451639891 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.451720953 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.451741934 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.451767921 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.453639984 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.453659058 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.453737020 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.453754902 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.455936909 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.455960989 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.456021070 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.456037045 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.456068039 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.458462000 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.458481073 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.458539009 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.458559990 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.458585978 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.458853960 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.459738970 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.459790945 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.459831953 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.459842920 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.459875107 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.459899902 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.526525974 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.526595116 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.541498899 CEST	49719	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.541528940 CEST	443	49719	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.616991997 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.617023945 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.617083073 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.617288113 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.617301941 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.892050982 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.892364979 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.892380953 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.892863989 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.893955946 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.894068003 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:31.894402981 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:31.940114021 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.071284056 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.072484970 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.072505951 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.072551966 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.072570086 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.072597027 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.072622061 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.073523045 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.073544025 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.073606014 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.073613882 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.136406898 CEST	49724	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.136440039 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.136492968 CEST	49724	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.136941910 CEST	49724	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.136953115 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.137428045 CEST	49725	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.137468100 CEST	443	49725	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.137578011 CEST	49725	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.138001919 CEST	49725	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.138020039 CEST	443	49725	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.138681889 CEST	49726	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.138701916 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.138962984 CEST	49726	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.142889023 CEST	49726	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.142900944 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.160161972 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.160197020 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.160233974 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.160250902 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.160279036 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.160851955 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.160870075 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.160900116 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.160917044 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.160924911 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.160939932 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.161195040 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.161220074 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.161248922 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.161257029 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.161279917 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.161317110 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.161385059 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.161418915 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.161422968 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.161434889 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.161475897 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.163958073 CEST	49723	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.163968086 CEST	443	49723	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.408685923 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.409302950 CEST	443	49725	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.418584108 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.479327917 CEST	49726	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.479336023 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.479398012 CEST	49725	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.479437113 CEST	443	49725	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.479496002 CEST	49724	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.479510069 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.480509996 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.480520964 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.480571032 CEST	49724	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.480983019 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.480999947 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.481075048 CEST	49726	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.481405020 CEST	443	49725	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.481419086 CEST	443	49725	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:32.481453896 CEST	49725	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:32.600714922 CEST	49726	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.790309906 CEST	49725	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.790504932 CEST	443	49725	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.790788889 CEST	49726	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.790945053 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.791316986 CEST	49724	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.791506052 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.796875000 CEST	49725	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.796896935 CEST	443	49725	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.796982050 CEST	49726	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.796998024 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.797153950 CEST	49724	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.797180891 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.869980097 CEST	49725	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.888425112 CEST	443	49725	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.888484001 CEST	443	49725	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.888547897 CEST	49725	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.888550043 CEST	443	49725	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.888601065 CEST	49725	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.890398979 CEST	49726	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.890409946 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.890443087 CEST	49724	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.890485048 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.890583038 CEST	49726	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.890589952 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.890603065 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.890664101 CEST	49726	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.894171953 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.894260883 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.894304037 CEST	49724	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:34.894316912 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.894328117 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:34.894398928 CEST	49724	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:35.785279036 CEST	443	49721	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:35.785346031 CEST	443	49721	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:35.785414934 CEST	49721	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:35.807120085 CEST	443	49720	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:35.807198048 CEST	443	49720	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:35.807274103 CEST	49720	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:36.541825056 CEST	49726	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:36.541837931 CEST	443	49726	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:36.622431040 CEST	49724	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:36.622451067 CEST	443	49724	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:36.635085106 CEST	49725	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:36.635134935 CEST	443	49725	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:36.667670012 CEST	49721	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:36.667695045 CEST	443	49721	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:36.667859077 CEST	49720	443	192.168.2.5	13.107.213.40
Apr 27, 2024 00:14:36.667917967 CEST	443	49720	13.107.213.40	192.168.2.5
Apr 27, 2024 00:14:36.669110060 CEST	49729	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:36.669163942 CEST	443	49729	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:36.669244051 CEST	49729	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:36.671974897 CEST	49729	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:36.672003031 CEST	443	49729	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:36.944782019 CEST	443	49729	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:36.976229906 CEST	49729	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:36.976254940 CEST	443	49729	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:36.976587057 CEST	443	49729	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:36.983405113 CEST	49729	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:36.983475924 CEST	443	49729	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:36.983674049 CEST	49729	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.024159908 CEST	443	49729	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.128815889 CEST	443	49729	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.130027056 CEST	443	49729	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.130043030 CEST	443	49729	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.130186081 CEST	49729	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.130237103 CEST	443	49729	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.130301952 CEST	49729	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.130667925 CEST	49729	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.130696058 CEST	443	49729	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.144550085 CEST	49730	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.144572973 CEST	443	49730	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.144639969 CEST	49730	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.146284103 CEST	49730	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.146298885 CEST	443	49730	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.331254005 CEST	443	49730	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.331383944 CEST	49730	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.333992958 CEST	49730	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.334003925 CEST	443	49730	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.334234953 CEST	443	49730	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.394977093 CEST	49730	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.448991060 CEST	49730	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.496126890 CEST	443	49730	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.541368008 CEST	443	49730	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.541431904 CEST	443	49730	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.541496038 CEST	49730	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.560002089 CEST	49730	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.560013056 CEST	443	49730	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.606484890 CEST	49731	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.606538057 CEST	443	49731	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.606811047 CEST	49731	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.607042074 CEST	49732	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.607127905 CEST	443	49732	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.607201099 CEST	49732	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.607639074 CEST	49733	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.607673883 CEST	443	49733	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.607767105 CEST	49733	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.608208895 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.608278036 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.608443022 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.609265089 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.609297991 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.609958887 CEST	49733	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.609973907 CEST	443	49733	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.610455990 CEST	49732	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.610490084 CEST	443	49732	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.610805035 CEST	49731	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.610826969 CEST	443	49731	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.675565004 CEST	49735	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.675589085 CEST	443	49735	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.675748110 CEST	49735	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.677392006 CEST	49735	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.677405119 CEST	443	49735	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.863480091 CEST	443	49735	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.863565922 CEST	49735	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.865540981 CEST	49735	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.865550041 CEST	443	49735	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.865873098 CEST	443	49735	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.868793011 CEST	49735	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:37.885762930 CEST	443	49732	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.888426065 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.888442039 CEST	443	49731	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.888694048 CEST	443	49733	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.900630951 CEST	49732	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.900667906 CEST	443	49732	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.900950909 CEST	49733	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.900970936 CEST	443	49733	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.901761055 CEST	443	49732	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.901830912 CEST	49732	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.902084112 CEST	443	49733	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.902157068 CEST	49733	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.902314901 CEST	49731	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.902348995 CEST	443	49731	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.903140068 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.903179884 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.903454065 CEST	443	49731	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.903516054 CEST	49731	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.904237986 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.904320955 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.912122965 CEST	443	49735	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:37.936749935 CEST	49732	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.936932087 CEST	443	49732	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.939358950 CEST	49733	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.939505100 CEST	443	49733	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.944979906 CEST	49731	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.945178032 CEST	443	49731	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.946341991 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.946476936 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.947597980 CEST	49732	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.947632074 CEST	443	49732	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.947735071 CEST	49733	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.947761059 CEST	443	49733	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.947818041 CEST	49731	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.947841883 CEST	443	49731	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.948038101 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.948070049 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:37.996680975 CEST	49732	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.996747017 CEST	49731	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:37.996757030 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.042884111 CEST	443	49735	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:38.042965889 CEST	443	49735	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:38.043077946 CEST	49735	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:38.059185982 CEST	49733	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.062161922 CEST	49735	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:14:38.062181950 CEST	443	49735	23.51.58.94	192.168.2.5
Apr 27, 2024 00:14:38.068399906 CEST	443	49732	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.068460941 CEST	443	49732	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.068505049 CEST	443	49732	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.068542004 CEST	49732	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.068778992 CEST	49732	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.068820953 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.069540024 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.069549084 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.069581032 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.069595098 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.069603920 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.069617987 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.069673061 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.069693089 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.069708109 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.069741964 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.069778919 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.070132017 CEST	443	49733	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.070169926 CEST	443	49733	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.070338964 CEST	49733	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.070355892 CEST	443	49733	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.070369959 CEST	443	49733	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.070410013 CEST	49733	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.070964098 CEST	443	49731	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.071007967 CEST	443	49731	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.071063042 CEST	443	49731	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.071091890 CEST	49731	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.071157932 CEST	49731	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.084918022 CEST	49732	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.084947109 CEST	443	49732	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.093380928 CEST	49733	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.093401909 CEST	443	49733	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.120053053 CEST	49734	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.120085001 CEST	443	49734	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:38.120572090 CEST	49731	443	192.168.2.5	192.229.211.199
Apr 27, 2024 00:14:38.120608091 CEST	443	49731	192.229.211.199	192.168.2.5
Apr 27, 2024 00:14:41.077055931 CEST	443	49722	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:41.077132940 CEST	443	49722	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:41.077198029 CEST	49722	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:41.224333048 CEST	49722	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:14:41.224353075 CEST	443	49722	142.250.80.36	192.168.2.5
Apr 27, 2024 00:14:41.983259916 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:41.983334064 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:41.986488104 CEST	49747	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:41.986565113 CEST	443	49747	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:41.986629963 CEST	49747	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:41.986960888 CEST	49747	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:41.986994982 CEST	443	49747	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:42.138242006 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:42.138263941 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:42.319534063 CEST	443	49747	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:42.319622993 CEST	49747	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:42.335911989 CEST	49747	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:42.335958004 CEST	443	49747	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:42.337017059 CEST	443	49747	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:42.337091923 CEST	49747	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:42.337501049 CEST	49747	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:42.337574005 CEST	443	49747	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:42.337763071 CEST	49747	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:42.337778091 CEST	443	49747	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:42.672406912 CEST	443	49747	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:42.672477007 CEST	49747	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:42.672523022 CEST	443	49747	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:42.672553062 CEST	443	49747	23.1.237.91	192.168.2.5
Apr 27, 2024 00:14:42.672589064 CEST	49747	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:14:42.672621965 CEST	49747	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:15:30.867227077 CEST	49753	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:15:30.867266893 CEST	443	49753	142.250.80.36	192.168.2.5
Apr 27, 2024 00:15:30.867419958 CEST	49753	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:15:30.868043900 CEST	49753	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:15:30.868057966 CEST	443	49753	142.250.80.36	192.168.2.5
Apr 27, 2024 00:15:31.128789902 CEST	443	49753	142.250.80.36	192.168.2.5
Apr 27, 2024 00:15:31.129172087 CEST	49753	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:15:31.129189014 CEST	443	49753	142.250.80.36	192.168.2.5
Apr 27, 2024 00:15:31.129507065 CEST	443	49753	142.250.80.36	192.168.2.5
Apr 27, 2024 00:15:31.130357981 CEST	49753	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:15:31.130419016 CEST	443	49753	142.250.80.36	192.168.2.5
Apr 27, 2024 00:15:31.169792891 CEST	49753	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:15:41.137002945 CEST	443	49753	142.250.80.36	192.168.2.5
Apr 27, 2024 00:15:41.137078047 CEST	443	49753	142.250.80.36	192.168.2.5
Apr 27, 2024 00:15:41.137129068 CEST	49753	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:15:41.490814924 CEST	49753	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:15:41.490849018 CEST	443	49753	142.250.80.36	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 27, 2024 00:14:26.643748045 CEST	53	60341	1.1.1.1	192.168.2.5
Apr 27, 2024 00:14:26.692898035 CEST	53	54516	1.1.1.1	192.168.2.5
Apr 27, 2024 00:14:27.000715017 CEST	64510	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:14:27.001132011 CEST	49174	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:14:27.090866089 CEST	53	64510	1.1.1.1	192.168.2.5
Apr 27, 2024 00:14:27.091142893 CEST	53	49174	1.1.1.1	192.168.2.5
Apr 27, 2024 00:14:27.435467958 CEST	53	53629	1.1.1.1	192.168.2.5
Apr 27, 2024 00:14:27.703535080 CEST	50257	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:14:27.703726053 CEST	63211	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:14:30.465339899 CEST	52185	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:14:30.465759993 CEST	53619	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:14:30.501669884 CEST	50900	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:14:30.502012014 CEST	63579	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:14:30.554759026 CEST	53	53619	1.1.1.1	192.168.2.5
Apr 27, 2024 00:14:30.555608988 CEST	53	52185	1.1.1.1	192.168.2.5
Apr 27, 2024 00:14:32.235373974 CEST	53	60550	1.1.1.1	192.168.2.5
Apr 27, 2024 00:14:37.512335062 CEST	51539	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:14:37.512702942 CEST	49201	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:14:37.602550983 CEST	53	51539	1.1.1.1	192.168.2.5
Apr 27, 2024 00:14:37.604235888 CEST	53	49201	1.1.1.1	192.168.2.5
Apr 27, 2024 00:14:44.899825096 CEST	53	55194	1.1.1.1	192.168.2.5
Apr 27, 2024 00:15:04.017626047 CEST	53	63845	1.1.1.1	192.168.2.5
Apr 27, 2024 00:15:26.154120922 CEST	53	54924	1.1.1.1	192.168.2.5
Apr 27, 2024 00:15:26.541919947 CEST	53	57866	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 27, 2024 00:14:27.000715017 CEST	192.168.2.5	1.1.1.1	0x2edf	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:27.001132011 CEST	192.168.2.5	1.1.1.1	0xc3e5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 27, 2024 00:14:27.703535080 CEST	192.168.2.5	1.1.1.1	0x2157	Standard query (0)	account.live.com	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:27.703726053 CEST	192.168.2.5	1.1.1.1	0xc697	Standard query (0)	account.live.com	65	IN (0x0001)	false
Apr 27, 2024 00:14:30.465339899 CEST	192.168.2.5	1.1.1.1	0x70c0	Standard query (0)	logincdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.465759993 CEST	192.168.2.5	1.1.1.1	0x9662	Standard query (0)	logincdn.msftauth.net	65	IN (0x0001)	false
Apr 27, 2024 00:14:30.501669884 CEST	192.168.2.5	1.1.1.1	0xe663	Standard query (0)	acctcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.502012014 CEST	192.168.2.5	1.1.1.1	0x42d0	Standard query (0)	acctcdn.msftauth.net	65	IN (0x0001)	false
Apr 27, 2024 00:14:37.512335062 CEST	192.168.2.5	1.1.1.1	0xe273	Standard query (0)	logincdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:37.512702942 CEST	192.168.2.5	1.1.1.1	0x6d51	Standard query (0)	logincdn.msftauth.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 27, 2024 00:14:27.090866089 CEST	1.1.1.1	192.168.2.5	0x2edf	No error (0)	www.google.com		142.250.80.36	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:27.091142893 CEST	1.1.1.1	192.168.2.5	0xc3e5	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 27, 2024 00:14:27.796130896 CEST	1.1.1.1	192.168.2.5	0x2157	No error (0)	account.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:27.804362059 CEST	1.1.1.1	192.168.2.5	0xc697	No error (0)	account.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.554759026 CEST	1.1.1.1	192.168.2.5	0x9662	No error (0)	logincdn.msftauth.net	cs1227.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.555608988 CEST	1.1.1.1	192.168.2.5	0x70c0	No error (0)	logincdn.msftauth.net	cs1227.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.555608988 CEST	1.1.1.1	192.168.2.5	0x70c0	No error (0)	cs1227.wpc.alphacdn.net		192.229.211.199	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.589186907 CEST	1.1.1.1	192.168.2.5	0x4c61	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.589186907 CEST	1.1.1.1	192.168.2.5	0x4c61	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.589186907 CEST	1.1.1.1	192.168.2.5	0x4c61	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.591805935 CEST	1.1.1.1	192.168.2.5	0x42d0	No error (0)	acctcdn.msftauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.591805935 CEST	1.1.1.1	192.168.2.5	0x42d0	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.592865944 CEST	1.1.1.1	192.168.2.5	0xe663	No error (0)	acctcdn.msftauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.592865944 CEST	1.1.1.1	192.168.2.5	0xe663	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.592865944 CEST	1.1.1.1	192.168.2.5	0xe663	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.592865944 CEST	1.1.1.1	192.168.2.5	0xe663	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.647952080 CEST	1.1.1.1	192.168.2.5	0x668	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.647952080 CEST	1.1.1.1	192.168.2.5	0x668	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.647952080 CEST	1.1.1.1	192.168.2.5	0x668	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.695489883 CEST	1.1.1.1	192.168.2.5	0xe4ab	No error (0)	cs1227.wpc.alphacdn.net		192.229.211.199	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.698434114 CEST	1.1.1.1	192.168.2.5	0x9b03	No error (0)	shed.dual-low.part-0008.t-0009.t-msedge.net	part-0008.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.698434114 CEST	1.1.1.1	192.168.2.5	0x9b03	No error (0)	part-0008.t-0009.t-msedge.net		13.107.246.36	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.698434114 CEST	1.1.1.1	192.168.2.5	0x9b03	No error (0)	part-0008.t-0009.t-msedge.net		13.107.213.36	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.740725994 CEST	1.1.1.1	192.168.2.5	0x471d	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.740725994 CEST	1.1.1.1	192.168.2.5	0x471d	No error (0)	sni1gl.wpc.alphacdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.752748013 CEST	1.1.1.1	192.168.2.5	0x3419	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.793477058 CEST	1.1.1.1	192.168.2.5	0x887c	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:30.793477058 CEST	1.1.1.1	192.168.2.5	0x887c	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:30.793477058 CEST	1.1.1.1	192.168.2.5	0x887c	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:37.602550983 CEST	1.1.1.1	192.168.2.5	0xe273	No error (0)	logincdn.msftauth.net	cs1227.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:37.602550983 CEST	1.1.1.1	192.168.2.5	0xe273	No error (0)	cs1227.wpc.alphacdn.net		192.229.211.199	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:37.604235888 CEST	1.1.1.1	192.168.2.5	0x6d51	No error (0)	logincdn.msftauth.net	cs1227.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:41.757369041 CEST	1.1.1.1	192.168.2.5	0x7fca	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 27, 2024 00:14:41.757369041 CEST	1.1.1.1	192.168.2.5	0x7fca	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:55.231008053 CEST	1.1.1.1	192.168.2.5	0x3e33	No error (0)	windowsupdatebg.s.llnwi.net		69.164.46.0	A (IP address)	IN (0x0001)	false
Apr 27, 2024 00:14:55.231008053 CEST	1.1.1.1	192.168.2.5	0x3e33	No error (0)	windowsupdatebg.s.llnwi.net		69.164.46.128	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

https:

logincdn.msftauth.net

www.bing.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.80.36	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:27 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:27 UTC	1703	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 22:14:27 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-iHSvMjtCYbvxfyOG4_oOdw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 22:14:27 UTC	1703	IN	Data Raw: 31 30 39 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 65 61 64 70 6f 6f 6c 20 77 6f 6c 76 65 72 69 6e 65 20 6c 65 61 6b 73 22 2c 22 6c 61 73 20 76 65 67 61 73 20 72 61 69 64 65 72 73 20 64 72 61 66 74 20 70 69 63 6b 73 22 2c 22 68 65 6c 6c 64 69 76 65 72 73 20 32 20 6d 61 6a 6f 72 20 6f 72 64 65 72 22 2c 22 6e 61 73 61 20 6d 61 72 73 20 73 70 69 64 65 72 73 22 2c 22 77 65 61 74 68 65 72 20 73 74 6f 72 6d 73 20 74 6f 72 6e 61 64 6f 65 73 22 2c 22 67 72 65 61 74 20 67 61 74 73 62 79 20 6d 75 73 69 63 61 6c 22 2c 22 6e 66 6c 20 64 72 61 66 74 20 74 72 61 64 65 20 72 75 6d 6f 72 73 22 2c 22 63 6f 6c 75 6d 62 69 61 20 75 6e 69 76 65 72 73 69 74 79 20 73 74 75 64 65 6e 74 20 70 72 6f 74 65 73 74 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 Data Ascii: 1094)]}'["",["deadpool wolverine leaks","las vegas raiders draft picks","helldivers 2 major order","nasa mars spiders","weather storms tornadoes","great gatsby musical","nfl draft trade rumors","columbia university student protests"],["","","","","",""
2024-04-26 22:14:27 UTC	1703	IN	Data Raw: 6f 62 48 4a 46 65 6b 74 4f 59 54 64 34 4e 55 64 77 55 55 59 79 53 32 68 71 63 46 6c 4f 5a 6c 6c 72 51 55 63 35 64 6c 42 48 52 6c 4a 75 56 44 56 75 55 6a 46 6c 56 32 52 55 56 57 59 76 54 7a 42 76 53 47 64 57 53 44 56 58 59 32 68 6e 51 33 4a 58 53 54 4e 30 59 7a 6c 71 4e 6b 68 75 56 45 70 71 53 6c 4d 78 59 6a 55 35 55 57 4e 50 55 57 45 32 57 6d 52 76 64 54 59 32 5a 55 74 59 63 56 52 4d 52 56 49 30 4d 6d 46 44 62 57 6c 71 51 33 46 30 62 56 5a 52 65 45 73 7a 54 69 39 56 4c 31 51 78 52 30 70 4c 52 54 4a 76 62 43 74 4e 5a 6a 6b 7a 64 32 5a 75 61 58 6c 45 55 44 68 31 63 6d 4a 35 54 57 78 58 52 6a 42 74 56 56 68 61 52 31 4a 70 61 6e 42 78 52 6e 49 32 55 33 55 78 5a 30 78 6f 61 47 5a 6c 4e 55 74 34 56 43 39 7a 55 69 38 77 4c 33 55 72 51 56 52 48 59 31 6c 44 64 48 Data Ascii: obHJFektOYTd4NUdwUUYyS2hqcFlOZllrQUc5dlBHRlJuVDVuUjFlV2RUVWYvTzBvSGdWSDVXY2hnQ3JXSTN0YzlqNkhuVEpqSlMxYjU5UWNPUWE2WmRvdTY2ZUtYcVRMRVI0MmFDbWlqQ3F0bVZReEszTi9VL1QxR0pLRTJvbCtNZjkzd2ZuaXlEUDh1cmJ5TWxXRjBtVVhaR1JpanBxRnI2U3UxZ0xoaGZlNUt4VC9zUi8wL3UrQVRHY1lDdH
2024-04-26 22:14:27 UTC	846	IN	Data Raw: 6b 78 52 46 4a 77 59 54 64 7a 64 54 5a 6e 57 44 49 79 59 54 4d 7a 64 30 52 32 61 6c 56 47 52 30 46 4f 55 56 55 78 4e 30 56 69 57 46 42 76 54 33 42 76 62 55 5a 51 54 46 55 77 4c 32 6c 76 65 6b 6c 59 57 56 4e 7a 55 30 35 59 59 7a 63 79 53 47 4a 30 61 46 5a 53 4f 56 41 78 61 7a 46 4e 57 6b 74 70 5a 55 46 59 57 57 74 4c 64 46 46 6b 4c 31 4a 6f 4e 57 35 68 4d 69 39 48 52 6c 5a 4f 4b 30 6c 32 4b 32 39 4e 64 33 42 6a 61 32 39 4e 63 47 31 71 61 6d 59 7a 4e 6d 6f 79 62 48 68 6b 61 30 4a 42 63 30 46 4d 5a 7a 68 72 62 6d 5a 35 64 30 49 78 52 55 70 68 51 31 64 71 62 56 6f 31 61 54 6c 54 56 7a 46 50 57 6c 4e 76 56 33 64 7a 51 32 56 69 4e 30 46 6d 56 54 51 31 54 31 5a 73 54 6c 64 4a 4c 32 6b 78 63 55 39 61 56 46 42 55 65 54 56 6b 62 56 56 45 56 56 4e 34 4b 30 4a 76 4d Data Ascii: kxRFJwYTdzdTZnWDIyYTMzd0R2alVGR0FOUVUxN0ViWFBvT3BvbUZQTFUwL2lveklYWVNzU05YYzcySGJ0aFZSOVAxazFNWktpZUFYWWtLdFFkL1JoNW5hMi9HRlZOK0l2K29Nd3Bja29NcG1qamYzNmoybHhka0JBc0FMZzhrbmZ5d0IxRUphQ1dqbVo1aTlTVzFPWlNvV3dzQ2ViN0FmVTQ1T1ZsTldJL2kxcU9aVFBUeTVkbVVEVVN4K0JvM
2024-04-26 22:14:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	142.250.80.36	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:27 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:28 UTC	1843	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgSaEMC5GMPOsLEGIjDIbr-lQCvY1TjsXx6a6xmiyNAE310AbNlfyG5SPthhIL36yr0P3Z1fJH8_8PiJjDMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIw86wsQYQnM_h1QMSBJoQwLk Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 22:14:27 GMT Server: gws Content-Length: 458 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-22; expires=Sun, 26-May-2024 22:14:27 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=ZPlQScGeGCYhf-_i_qHRTcq5TA4yTmlLDOxGvc958Oq5DS-sOu8FCVl5JPRgjKHrWH6MgnVWVrL_mUQ4Q0wjV1cdlmn_QR_5sqH7060DlQbGEiKIBwpoSZjNvrMlwN967L-vskNemgQJnhRaGh__b9kz7AjtFQchuJv6XInhqUA; expires=Sat, 26-Oct-2024 22:14:27 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 22:14:28 UTC	458	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	142.250.80.36	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:27 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:28 UTC	1761	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgSaEMC5GMPOsLEGIjBZmgCMjTLvo8nSfYg9lv3QO4nP5UlgrFJKaiTximzNi9SZgshngH0cJsihZymOV1syAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIxM6wsQYQ9rOLpQESBJoQwLk Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 22:14:28 GMT Server: gws Content-Length: 417 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-22; expires=Sun, 26-May-2024 22:14:28 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=cYsgYpXMap7Tu7d_wtAITa_Xj8d5ziTIW9gkJdbWPopg9GA01pKG3eYq-HptGoBuL-lzgf15CCKPjAVWfS43emwOCdqmvA4KX_GT0I2MLOrT9QARgsL_CfFOk6xSmGs1Zpq67lNUv9UH1fs6qGT3kvAevYLhk5yogV5YhnZYXbo; expires=Sat, 26-Oct-2024 22:14:27 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 22:14:28 UTC	417	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 26 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49712	142.250.80.36	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:28 UTC	928	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgSaEMC5GMPOsLEGIjDIbr-lQCvY1TjsXx6a6xmiyNAE310AbNlfyG5SPthhIL36yr0P3Z1fJH8_8PiJjDMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-22; NID=513=ZPlQScGeGCYhf-_i_qHRTcq5TA4yTmlLDOxGvc958Oq5DS-sOu8FCVl5JPRgjKHrWH6MgnVWVrL_mUQ4Q0wjV1cdlmn_QR_5sqH7060DlQbGEiKIBwpoSZjNvrMlwN967L-vskNemgQJnhRaGh__b9kz7AjtFQchuJv6XInhqUA
2024-04-26 22:14:28 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 22:14:28 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3185 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 22:14:28 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 3f 68 6c 3d 65 6e 2d 55 53 26 61 6d 70 3b 61 73 79 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_ogb?hl=en-US&asy
2024-04-26 22:14:28 UTC	1255	IN	Data Raw: 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 4a 5a 37 6e 42 52 30 44 4d Data Ascii: <script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="JZ7nBR0DM
2024-04-26 22:14:28 UTC	1031	IN	Data Raw: 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 Data Ascii: ; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly aft

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	142.250.80.36	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:30 UTC	738	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgSaEMC5GMPOsLEGIjBZmgCMjTLvo8nSfYg9lv3QO4nP5UlgrFJKaiTximzNi9SZgshngH0cJsihZymOV1syAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-22; NID=513=cYsgYpXMap7Tu7d_wtAITa_Xj8d5ziTIW9gkJdbWPopg9GA01pKG3eYq-HptGoBuL-lzgf15CCKPjAVWfS43emwOCdqmvA4KX_GT0I2MLOrT9QARgsL_CfFOk6xSmGs1Zpq67lNUv9UH1fs6qGT3kvAevYLhk5yogV5YhnZYXbo
2024-04-26 22:14:30 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 22:14:30 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3113 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 22:14:30 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_promos</title></head
2024-04-26 22:14:30 UTC	1255	IN	Data Raw: 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 54 67 34 74 72 56 66 6c 49 6c 73 4e 63 44 54 77 31 38 32 5a 73 6d 71 56 57 63 43 30 36 44 4c 42 34 Data Ascii: ack = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="Tg4trVflIlsNcDTw182ZsmqVWcC06DLB4
2024-04-26 22:14:30 UTC	959	IN	Data Raw: 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e Data Ascii: ogle automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solvin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49719	192.229.211.199	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:30 UTC	595	OUT	GET /shared/5/js/login_en_aRDrgrd2cjfBKtrV-RMGZw2.js HTTP/1.1 Host: logincdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:31 UTC	770	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 1256185 Cache-Control: public, max-age=31536000 Content-MD5: o7qJmGyZfwiMF5mBEkZyfg== Content-Type: application/x-javascript Date: Fri, 26 Apr 2024 22:14:30 GMT Etag: 0x8DC59BD64B9FFDC Last-Modified: Thu, 11 Apr 2024 00:21:55 GMT Server: ECAcc (nya/79A4) Vary: Accept-Encoding X-Cache: HIT X-EC-BBR-Enable: 1 x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 2cb00775-401e-004f-3aba-8c0028000000 x-ms-version: 2009-09-19 Content-Length: 896695 Connection: close
2024-04-26 22:14:31 UTC	16383	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6c 6f 67 69 6e 5f 65 6e 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 6e 2c 72 2c 6f 3d 7b 39 37 32 30 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 39 33 38 34 29 2c 6f 3d 7b 63 68 69 6c 64 43 6f 6e 74 65 78 74 54 79 70 65 73 3a 21 30 2c 63 6f 6e 74 65 78 74 54 79 70 65 3a 21 30 2c 63 6f 6e 74 65 78 74 54 79 70 65 73 3a 21 30 2c 64 65 66 61 75 6c 74 50 72 6f 70 73 3a 21 30 2c 64 69 73 70 6c 61 79 4e 61 6d 65 3a 21 30 2c 67 65 74 44 65 66 61 75 6c 74 50 72 6f 70 73 3a 21 30 2c 67 65 74 44 65 72 69 76 Data Ascii: /! For license information please see login_en.js.LICENSE.txt /!function(){var e,t,n,r,o={97206:function(e,t,n){"use strict";var r=n(9384),o={childContextTypes:!0,contextType:!0,contextTypes:!0,defaultProps:!0,displayName:!0,getDefaultProps:!0,getDeriv
2024-04-26 22:14:31 UTC	1	IN	Data Raw: 73 Data Ascii: s
2024-04-26 22:14:31 UTC	16383	IN	Data Raw: 65 6c 65 63 74 65 64 3d 21 30 2c 76 6f 69 64 28 72 26 26 28 65 5b 6f 5d 2e 64 65 66 61 75 6c 74 53 65 6c 65 63 74 65 64 3d 21 30 29 29 3b 6e 75 6c 6c 21 3d 3d 74 7c 7c 65 5b 6f 5d 2e 64 69 73 61 62 6c 65 64 7c 7c 28 74 3d 65 5b 6f 5d 29 7d 6e 75 6c 6c 21 3d 3d 74 26 26 28 74 2e 73 65 6c 65 63 74 65 64 3d 21 30 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 74 29 7b 69 66 28 6e 75 6c 6c 21 3d 74 2e 64 61 6e 67 65 72 6f 75 73 6c 79 53 65 74 49 6e 6e 65 72 48 54 4d 4c 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6c 28 39 31 29 29 3b 72 65 74 75 72 6e 20 69 28 7b 7d 2c 74 2c 7b 76 61 6c 75 65 3a 76 6f 69 64 20 30 2c 64 65 66 61 75 6c 74 56 61 6c 75 65 3a 76 6f 69 64 20 30 2c 63 68 69 6c 64 72 65 6e 3a 22 22 2b 65 2e 5f 77 72 61 70 70 65 72 53 74 61 74 65 2e 69 Data Ascii: elected=!0,void(r&&(e[o].defaultSelected=!0));null!==t\|\|e[o].disabled\|\|(t=e[o])}null!==t&&(t.selected=!0)}}function Ie(e,t){if(null!=t.dangerouslySetInnerHTML)throw Error(l(91));return i({},t,{value:void 0,defaultValue:void 0,children:""+e._wrapperState.i
2024-04-26 22:14:31 UTC	16383	IN	Data Raw: 68 72 6f 77 20 45 72 72 6f 72 28 6c 28 33 33 29 29 7d 66 75 6e 63 74 69 6f 6e 20 52 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 5b 6a 6e 5d 7c 7c 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 42 6e 28 65 29 7b 64 6f 7b 65 3d 65 2e 72 65 74 75 72 6e 7d 77 68 69 6c 65 28 65 26 26 35 21 3d 3d 65 2e 74 61 67 29 3b 72 65 74 75 72 6e 20 65 7c 7c 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 55 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 65 2e 73 74 61 74 65 4e 6f 64 65 3b 69 66 28 21 6e 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 6f 3d 6d 28 6e 29 3b 69 66 28 21 6f 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 6e 3d 6f 5b 74 5d 3b 65 3a 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 22 6f 6e 43 6c 69 63 6b 22 3a 63 61 73 65 22 6f 6e 43 6c 69 63 6b 43 61 70 74 75 72 65 22 3a 63 61 73 Data Ascii: hrow Error(l(33))}function Rn(e){return e[jn]\|\|null}function Bn(e){do{e=e.return}while(e&&5!==e.tag);return e\|\|null}function Un(e,t){var n=e.stateNode;if(!n)return null;var o=m(n);if(!o)return null;n=o[t];e:switch(t){case"onClick":case"onClickCapture":cas
2024-04-26 22:14:31 UTC	16383	IN	Data Raw: 6e 73 74 61 62 6c 65 5f 73 63 68 65 64 75 6c 65 43 61 6c 6c 62 61 63 6b 2c 45 6f 3d 61 2e 75 6e 73 74 61 62 6c 65 5f 63 61 6e 63 65 6c 43 61 6c 6c 62 61 63 6b 2c 6a 6f 3d 61 2e 75 6e 73 74 61 62 6c 65 5f 72 65 71 75 65 73 74 50 61 69 6e 74 2c 49 6f 3d 61 2e 75 6e 73 74 61 62 6c 65 5f 6e 6f 77 2c 4c 6f 3d 61 2e 75 6e 73 74 61 62 6c 65 5f 67 65 74 43 75 72 72 65 6e 74 50 72 69 6f 72 69 74 79 4c 65 76 65 6c 2c 44 6f 3d 61 2e 75 6e 73 74 61 62 6c 65 5f 49 6d 6d 65 64 69 61 74 65 50 72 69 6f 72 69 74 79 2c 4e 6f 3d 61 2e 75 6e 73 74 61 62 6c 65 5f 55 73 65 72 42 6c 6f 63 6b 69 6e 67 50 72 69 6f 72 69 74 79 2c 52 6f 3d 61 2e 75 6e 73 74 61 62 6c 65 5f 4e 6f 72 6d 61 6c 50 72 69 6f 72 69 74 79 2c 42 6f 3d 61 2e 75 6e 73 74 61 62 6c 65 5f 4c 6f 77 50 72 69 6f 72 Data Ascii: nstable_scheduleCallback,Eo=a.unstable_cancelCallback,jo=a.unstable_requestPaint,Io=a.unstable_now,Lo=a.unstable_getCurrentPriorityLevel,Do=a.unstable_ImmediatePriority,No=a.unstable_UserBlockingPriority,Ro=a.unstable_NormalPriority,Bo=a.unstable_LowPrior
2024-04-26 22:14:31 UTC	16383	IN	Data Raw: 72 20 6f 3d 6e 61 28 29 3b 72 3d 76 6f 69 64 20 30 3d 3d 3d 72 3f 6e 75 6c 6c 3a 72 3b 76 61 72 20 69 3d 76 6f 69 64 20 30 3b 69 66 28 6e 75 6c 6c 21 3d 3d 4b 69 29 7b 76 61 72 20 61 3d 4b 69 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 3b 69 66 28 69 3d 61 2e 64 65 73 74 72 6f 79 2c 6e 75 6c 6c 21 3d 3d 72 26 26 4a 69 28 72 2c 61 2e 64 65 70 73 29 29 72 65 74 75 72 6e 20 76 6f 69 64 20 6c 61 28 74 2c 6e 2c 69 2c 72 29 7d 71 69 2e 65 66 66 65 63 74 54 61 67 7c 3d 65 2c 6f 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 3d 6c 61 28 31 7c 74 2c 6e 2c 69 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 64 61 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 63 61 28 35 31 36 2c 34 2c 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 66 61 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 75 61 28 35 31 36 Data Ascii: r o=na();r=void 0===r?null:r;var i=void 0;if(null!==Ki){var a=Ki.memoizedState;if(i=a.destroy,null!==r&&Ji(r,a.deps))return void la(t,n,i,r)}qi.effectTag\|=e,o.memoizedState=la(1\|t,n,i,r)}function da(e,t){return ca(516,4,e,t)}function fa(e,t){return ua(516
2024-04-26 22:14:31 UTC	4	IN	Data Raw: 3d 3d 74 79 Data Ascii: ==ty
2024-04-26 22:14:31 UTC	16383	IN	Data Raw: 70 65 6f 66 20 63 2e 6f 6e 43 6c 69 63 6b 26 26 28 65 2e 6f 6e 63 6c 69 63 6b 3d 66 6e 29 7d 78 6e 28 6f 2c 72 29 26 26 28 74 2e 65 66 66 65 63 74 54 61 67 7c 3d 34 29 7d 6e 75 6c 6c 21 3d 3d 74 2e 72 65 66 26 26 28 74 2e 65 66 66 65 63 74 54 61 67 7c 3d 31 32 38 29 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 63 61 73 65 20 36 3a 69 66 28 65 26 26 6e 75 6c 6c 21 3d 74 2e 73 74 61 74 65 4e 6f 64 65 29 71 61 28 30 2c 74 2c 65 2e 6d 65 6d 6f 69 7a 65 64 50 72 6f 70 73 2c 72 29 3b 65 6c 73 65 7b 69 66 28 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 72 26 26 6e 75 6c 6c 3d 3d 3d 74 2e 73 74 61 74 65 4e 6f 64 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6c 28 31 36 36 29 29 3b 6e 3d 42 69 28 52 69 2e 63 75 72 72 65 6e 74 29 2c 42 69 28 44 69 2e 63 75 72 72 65 6e Data Ascii: peof c.onClick&&(e.onclick=fn)}xn(o,r)&&(t.effectTag\|=4)}null!==t.ref&&(t.effectTag\|=128)}return null;case 6:if(e&&null!=t.stateNode)qa(0,t,e.memoizedProps,r);else{if("string"!=typeof r&&null===t.stateNode)throw Error(l(166));n=Bi(Ri.current),Bi(Di.curren
2024-04-26 22:14:31 UTC	16383	IN	Data Raw: 74 68 72 6f 77 20 45 72 72 6f 72 28 6c 28 33 32 37 29 29 3b 69 66 28 4f 73 28 29 2c 65 3d 3d 3d 44 6c 26 26 74 3d 3d 3d 52 6c 7c 7c 66 73 28 65 2c 74 29 2c 6e 75 6c 6c 21 3d 3d 4e 6c 29 7b 76 61 72 20 6e 3d 4c 6c 3b 4c 6c 7c 3d 41 6c 3b 66 6f 72 28 76 61 72 20 72 3d 67 73 28 29 3b 3b 29 74 72 79 7b 62 73 28 29 3b 62 72 65 61 6b 7d 63 61 74 63 68 28 6f 29 7b 70 73 28 65 2c 6f 29 7d 69 66 28 61 69 28 29 2c 4c 6c 3d 6e 2c 43 6c 2e 63 75 72 72 65 6e 74 3d 72 2c 31 3d 3d 3d 42 6c 29 74 68 72 6f 77 20 6e 3d 55 6c 2c 66 73 28 65 2c 74 29 2c 56 73 28 65 2c 74 29 2c 6c 73 28 65 29 2c 6e 3b 69 66 28 6e 75 6c 6c 21 3d 3d 4e 6c 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6c 28 32 36 31 29 29 3b 65 2e 66 69 6e 69 73 68 65 64 57 6f 72 6b 3d 65 2e 63 75 72 72 65 6e 74 2e 61 Data Ascii: throw Error(l(327));if(Os(),e===Dl&&t===Rl\|\|fs(e,t),null!==Nl){var n=Ll;Ll\|=Al;for(var r=gs();;)try{bs();break}catch(o){ps(e,o)}if(ai(),Ll=n,Cl.current=r,1===Bl)throw n=Ul,fs(e,t),Vs(e,t),ls(e),n;if(null!==Nl)throw Error(l(261));e.finishedWork=e.current.a
2024-04-26 22:14:31 UTC	16383	IN	Data Raw: 6c 64 72 65 6e 3a 6e 75 6c 6c 2c 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 3a 65 2e 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 7d 2c 74 7d 66 75 6e 63 74 69 6f 6e 20 7a 73 28 65 2c 74 2c 6e 29 7b 74 68 69 73 2e 74 61 67 3d 74 2c 74 68 69 73 2e 63 75 72 72 65 6e 74 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6e 74 61 69 6e 65 72 49 6e 66 6f 3d 65 2c 74 68 69 73 2e 70 69 6e 67 43 61 63 68 65 3d 74 68 69 73 2e 70 65 6e 64 69 6e 67 43 68 69 6c 64 72 65 6e 3d 6e 75 6c 6c 2c 74 68 69 73 2e 66 69 6e 69 73 68 65 64 45 78 70 69 72 61 74 69 6f 6e 54 69 6d 65 3d 30 2c 74 68 69 73 2e 66 69 6e 69 73 68 65 64 57 6f 72 6b 3d 6e 75 6c 6c 2c 74 68 69 73 2e 74 69 6d 65 6f 75 74 48 61 6e 64 6c 65 3d 2d 31 2c 74 68 69 73 2e 70 65 6e 64 69 6e 67 43 6f 6e 74 65 78 74 3d 74 68 69 73 Data Ascii: ldren:null,implementation:e.implementation},t}function zs(e,t,n){this.tag=t,this.current=null,this.containerInfo=e,this.pingCache=this.pendingChildren=null,this.finishedExpirationTime=0,this.finishedWork=null,this.timeoutHandle=-1,this.pendingContext=this

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49723	192.229.211.199	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:31 UTC	609	OUT	GET /shared/5/chunks/oneds-analytics-js_54b1724af1b05e2ba3db_en.js HTTP/1.1 Host: logincdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:32 UTC	749	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2088431 Cache-Control: public, max-age=31536000 Content-MD5: Hlt2WzLF9llz2DXp7j6/IA== Content-Type: application/x-javascript Date: Fri, 26 Apr 2024 22:14:32 GMT Etag: 0x8DC5057934D08E4 Last-Modified: Sat, 30 Mar 2024 01:20:24 GMT Server: ECAcc (nya/7933) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: dec2246a-601e-00b1-4328-850760000000 x-ms-version: 2009-09-19 Content-Length: 90690 Connection: close
2024-04-26 22:14:32 UTC	16383	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6f 6e 65 64 73 2d 61 6e 61 6c 79 74 69 63 73 2d 6a 73 5f 35 34 62 31 37 32 34 61 66 31 62 30 35 65 32 62 61 33 64 62 5f 65 6e 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 69 64 65 6e 74 69 74 79 5f 73 69 73 75 5f 6d 73 61 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 69 64 65 6e 74 69 74 79 5f 73 69 73 75 5f 6d 73 61 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 35 31 5d 2c 7b 34 31 36 39 36 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 74 2e 72 28 65 29 2c 74 2e 64 28 65 2c 7b 41 70 70 49 6e 73 69 67 68 74 73 Data Ascii: /! For license information please see oneds-analytics-js_54b1724af1b05e2ba3db_en.js.LICENSE.txt /"use strict";(self.webpackChunk_msidentity_sisu_msa=self.webpackChunk_msidentity_sisu_msa\|\|[]).push([[251],{41696:function(n,e,t){t.r(e),t.d(e,{AppInsights
2024-04-26 22:14:32 UTC	16383	IN	Data Raw: 4d 54 53 74 72 69 6e 67 22 2c 61 74 3d 22 74 6f 55 54 43 53 74 72 69 6e 67 22 2c 75 74 3d 22 65 78 70 69 72 65 73 22 2c 63 74 3d 6e 75 6c 6c 2c 73 74 3d 6e 75 6c 6c 2c 6c 74 3d 6e 75 6c 6c 2c 66 74 3d 44 65 28 29 2c 64 74 3d 7b 7d 2c 76 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 70 74 28 6e 2c 65 29 7b 76 61 72 20 74 3d 6d 74 2e 5f 63 6b 4d 67 72 7c 7c 76 74 2e 5f 63 6b 4d 67 72 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 6d 74 2e 5f 63 6b 4d 67 72 3d 6d 74 28 6e 2c 65 29 2c 76 74 2e 5f 63 6b 4d 67 72 3d 74 29 2c 74 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 6e 29 7b 72 65 74 75 72 6e 21 6e 7c 7c 6e 2e 69 73 45 6e 61 62 6c 65 64 28 29 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 6e 2c 65 29 7b 72 65 74 75 72 6e 21 21 28 65 26 26 6e 26 26 42 6e 28 6e 2e 69 67 6e 6f 72 Data Ascii: MTString",at="toUTCString",ut="expires",ct=null,st=null,lt=null,ft=De(),dt={},vt={};function pt(n,e){var t=mt._ckMgr\|\|vt._ckMgr;return t\|\|(t=mt._ckMgr=mt(n,e),vt._ckMgr=t),t}function gt(n){return!n\|\|n.isEnabled()}function yt(n,e){return!!(e&&n&&Bn(n.ignor
2024-04-26 22:14:32 UTC	16383	IN	Data Raw: 74 75 72 6e 20 74 65 28 75 29 7d 28 6e 2c 65 2c 74 29 3b 69 7c 7c 28 69 3d 75 29 2c 61 26 26 61 2e 5f 73 65 74 4e 65 78 74 28 75 29 2c 61 3d 75 7d 7d 29 29 7d 72 65 74 75 72 6e 20 72 26 26 21 69 3f 6c 69 28 5b 72 5d 2c 65 2c 74 29 3a 69 7d 66 75 6e 63 74 69 6f 6e 20 66 69 28 29 7b 76 61 72 20 6e 3d 5b 5d 3b 72 65 74 75 72 6e 7b 61 64 64 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 6e 2e 70 75 73 68 28 65 29 7d 2c 72 75 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 57 6e 28 6e 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 72 79 7b 6e 28 65 2c 74 29 7d 63 61 74 63 68 28 72 29 7b 72 74 28 65 2e 64 69 61 67 4c 6f 67 28 29 2c 32 2c 37 33 2c 22 55 6e 65 78 70 65 63 74 65 64 20 65 72 72 6f 72 20 63 61 6c 6c 69 6e 67 20 75 6e 6c 6f 61 64 20 68 61 6e 64 6c 65 Data Ascii: turn te(u)}(n,e,t);i\|\|(i=u),a&&a._setNext(u),a=u}}))}return r&&!i?li([r],e,t):i}function fi(){var n=[];return{add:function(e){e&&n.push(e)},run:function(e,t){Wn(n,(function(n){try{n(e,t)}catch(r){rt(e.diagLog(),2,73,"Unexpected error calling unload handle
2024-04-26 22:14:32 UTC	3	IN	Data Raw: 74 5b 32 Data Ascii: t[2
2024-04-26 22:14:32 UTC	16383	IN	Data Raw: 5d 3d 72 2e 72 6f 6c 65 56 65 72 2c 74 29 2c 64 29 7d 2c 6e 2e 61 70 70 6c 79 41 49 54 72 61 63 65 43 6f 6e 74 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 3b 69 66 28 74 2e 65 6e 61 62 6c 65 41 70 70 6c 69 63 61 74 69 6f 6e 49 6e 73 69 67 68 74 73 54 72 61 63 65 29 7b 76 61 72 20 72 3d 70 28 29 3b 72 26 26 54 6f 28 32 2c 6e 2c 44 69 2c 28 28 65 3d 7b 7d 29 5b 30 5d 3d 72 2e 67 65 74 54 72 61 63 65 49 64 28 29 2c 65 5b 31 5d 3d 72 2e 67 65 74 4e 61 6d 65 28 29 2c 65 5b 32 5d 3d 72 2e 67 65 74 53 70 61 6e 49 64 28 29 2c 65 29 2c 21 31 29 7d 7d 2c 6e 2e 61 70 70 6c 79 44 69 73 74 72 69 62 75 74 65 64 54 72 61 63 65 43 6f 6e 74 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 2c 74 3d 70 28 29 3b 69 66 28 74 29 7b 76 61 72 20 Data Ascii: ]=r.roleVer,t),d)},n.applyAITraceContext=function(n){var e;if(t.enableApplicationInsightsTrace){var r=p();r&&To(2,n,Di,((e={})[0]=r.getTraceId(),e[1]=r.getName(),e[2]=r.getSpanId(),e),!1)}},n.applyDistributedTraceContext=function(n){var e,t=p();if(t){var
2024-04-26 22:14:32 UTC	16383	IN	Data Raw: 7a 65 45 78 63 65 65 64 3a 5b 5d 2c 66 61 69 6c 65 64 45 76 74 73 3a 5b 5d 2c 62 61 74 63 68 65 73 3a 5b 5d 2c 6e 75 6d 45 76 65 6e 74 73 3a 30 2c 72 65 74 72 79 43 6e 74 3a 6e 2c 69 73 54 65 61 72 64 6f 77 6e 3a 65 2c 69 73 53 79 6e 63 3a 74 2c 69 73 42 65 61 63 6f 6e 3a 72 2c 73 65 6e 64 54 79 70 65 3a 6f 2c 73 65 6e 64 52 65 61 73 6f 6e 3a 69 7d 7d 2c 6e 2e 61 70 70 65 6e 64 50 61 79 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 69 29 7b 76 61 72 20 6f 3d 74 26 26 72 26 26 21 74 2e 6f 76 65 72 66 6c 6f 77 3b 72 65 74 75 72 6e 20 6f 26 26 47 72 28 65 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 53 65 72 69 61 6c 69 7a 65 72 3a 61 70 70 65 6e 64 50 61 79 6c 6f 61 64 22 7d 29 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 Data Ascii: zeExceed:[],failedEvts:[],batches:[],numEvents:0,retryCnt:n,isTeardown:e,isSync:t,isBeacon:r,sendType:o,sendReason:i}},n.appendPayload=function(t,r,i){var o=t&&r&&!t.overflow;return o&&Gr(e,(function(){return"Serializer:appendPayload"}),(function(){for(va
2024-04-26 22:14:32 UTC	8772	IN	Data Raw: 58 28 29 7b 28 62 3d 7b 7d 29 5b 6a 6f 5d 3d 5b 32 2c 31 2c 30 5d 2c 62 5b 57 6f 5d 3d 5b 36 2c 33 2c 30 5d 2c 62 5b 56 6f 5d 3d 5b 31 38 2c 39 2c 30 5d 7d 66 75 6e 63 74 69 6f 6e 20 47 28 65 2c 74 29 7b 76 61 72 20 72 3d 5b 5d 2c 69 3d 6b 3b 50 26 26 28 69 3d 4e 29 2c 57 6e 28 65 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 2e 63 6f 75 6e 74 28 29 3e 30 26 26 57 6e 28 65 2e 65 76 65 6e 74 73 28 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 28 65 2e 73 79 6e 63 26 26 28 65 2e 6c 61 74 65 6e 63 79 3d 34 2c 65 2e 73 79 6e 63 3d 21 31 29 2c 65 2e 73 65 6e 64 41 74 74 65 6d 70 74 3c 69 3f 28 7a 72 28 65 2c 6e 2e 69 64 65 6e 74 69 66 69 65 72 29 2c 41 28 65 2c 21 31 29 29 3a 72 2e 70 75 73 68 28 65 29 29 7d 29 29 7d 29 29 2c 72 2e 6c 65 6e 67 Data Ascii: X(){(b={})[jo]=[2,1,0],b[Wo]=[6,3,0],b[Vo]=[18,9,0]}function G(e,t){var r=[],i=k;P&&(i=N),Wn(e,(function(e){e&&e.count()>0&&Wn(e.events(),(function(e){e&&(e.sync&&(e.latency=4,e.sync=!1),e.sendAttempt<i?(zr(e,n.identifier),A(e,!1)):r.push(e))}))})),r.leng

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49725	192.229.211.199	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:34 UTC	634	OUT	GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1 Host: logincdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:34 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2818609 Cache-Control: public, max-age=31536000 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Fri, 26 Apr 2024 22:14:34 GMT Etag: 0x8DB77257FFE6B4E Last-Modified: Tue, 27 Jun 2023 15:45:14 GMT Server: ECAcc (nya/7898) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e3708e4e-b01e-0030-3184-7e7b37000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2024-04-26 22:14:34 UTC	3651	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49726	192.229.211.199	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:34 UTC	621	OUT	GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1 Host: logincdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:34 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2818605 Cache-Control: public, max-age=31536000 Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Content-Type: image/svg+xml Date: Fri, 26 Apr 2024 22:14:34 GMT Etag: 0x8DB77257C91B168 Last-Modified: Tue, 27 Jun 2023 15:45:09 GMT Server: ECAcc (nya/788A) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 68ec2e36-e01e-0011-7584-7ec106000000 x-ms-version: 2009-09-19 Content-Length: 1864 Connection: close
2024-04-26 22:14:34 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49724	192.229.211.199	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:34 UTC	634	OUT	GET /shared/5/images/signin_options_4e48046ce74f4b89d450.svg HTTP/1.1 Host: logincdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:34 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2818601 Cache-Control: public, max-age=31536000 Content-MD5: R2FAVxfpONfnQAuxVxXbHg== Content-Type: image/svg+xml Date: Fri, 26 Apr 2024 22:14:34 GMT Etag: 0x8DB772582D4527C Last-Modified: Tue, 27 Jun 2023 15:45:19 GMT Server: ECAcc (nya/78AF) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 60b0bb6b-e01e-0055-6b84-7ebe1f000000 x-ms-version: 2009-09-19 Content-Length: 1592 Connection: close
2024-04-26 22:14:34 UTC	1592	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49729	192.229.211.199	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:36 UTC	612	OUT	GET /16.000.30185.3/images/favicon.ico HTTP/1.1 Host: logincdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:37 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 532167 Cache-Control: public, max-age=604800 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Fri, 26 Apr 2024 22:14:37 GMT Etag: 0x8DC60E6AA390389 Last-Modified: Sat, 20 Apr 2024 03:04:59 GMT Server: ECAcc (nya/78F0) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 9c36d01b-e01e-00ed-3f50-93904a000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-04-26 22:14:37 UTC	16383	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 22:14:37 UTC	791	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49730	23.51.58.94	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:37 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 22:14:37 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0712) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=31743 Date: Fri, 26 Apr 2024 22:14:37 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49735	23.51.58.94	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:37 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 22:14:38 UTC	455	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 Cache-Control: public, max-age=31747 Date: Fri, 26 Apr 2024 22:14:37 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 22:14:38 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49732	192.229.211.199	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:37 UTC	387	OUT	GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1 Host: logincdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:38 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2818609 Cache-Control: public, max-age=31536000 Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Content-Type: image/svg+xml Date: Fri, 26 Apr 2024 22:14:38 GMT Etag: 0x8DB77257C91B168 Last-Modified: Tue, 27 Jun 2023 15:45:09 GMT Server: ECAcc (nya/788A) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 68ec2e36-e01e-0011-7584-7ec106000000 x-ms-version: 2009-09-19 Content-Length: 1864 Connection: close
2024-04-26 22:14:38 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49733	192.229.211.199	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:37 UTC	400	OUT	GET /shared/5/images/signin_options_4e48046ce74f4b89d450.svg HTTP/1.1 Host: logincdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:38 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2818605 Cache-Control: public, max-age=31536000 Content-MD5: R2FAVxfpONfnQAuxVxXbHg== Content-Type: image/svg+xml Date: Fri, 26 Apr 2024 22:14:38 GMT Etag: 0x8DB772582D4527C Last-Modified: Tue, 27 Jun 2023 15:45:19 GMT Server: ECAcc (nya/78AF) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 60b0bb6b-e01e-0055-6b84-7ebe1f000000 x-ms-version: 2009-09-19 Content-Length: 1592 Connection: close
2024-04-26 22:14:38 UTC	1592	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49731	192.229.211.199	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:37 UTC	400	OUT	GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1 Host: logincdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:38 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2818613 Cache-Control: public, max-age=31536000 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Fri, 26 Apr 2024 22:14:38 GMT Etag: 0x8DB77257FFE6B4E Last-Modified: Tue, 27 Jun 2023 15:45:14 GMT Server: ECAcc (nya/7898) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e3708e4e-b01e-0030-3184-7e7b37000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2024-04-26 22:14:38 UTC	3651	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49734	192.229.211.199	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:37 UTC	378	OUT	GET /16.000.30185.3/images/favicon.ico HTTP/1.1 Host: logincdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 22:14:38 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 532168 Cache-Control: public, max-age=604800 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Fri, 26 Apr 2024 22:14:38 GMT Etag: 0x8DC60E6AA390389 Last-Modified: Sat, 20 Apr 2024 03:04:59 GMT Server: ECAcc (nya/78F0) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 9c36d01b-e01e-00ed-3f50-93904a000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-04-26 22:14:38 UTC	15686	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 22:14:38 UTC	1488	IN	Data Raw: 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 Data Ascii: {L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""333333

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49747	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:14:42 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714169648022&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-26 22:14:42 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-26 22:14:42 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-26 22:14:42 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 842E7D4D69C74C5483B0D3DD3246F47C Ref B: LAX311000110017 Ref C: 2024-04-26T22:14:42Z Date: Fri, 26 Apr 2024 22:14:42 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1714169682.13cfa3df

Target ID:	0
Start time:	00:14:17
Start date:	27/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	00:14:24
Start date:	27/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1980,i,8652758614314267871,3803113788145796724,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	00:14:25
Start date:	27/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://249208506065339175713065343682620339232232032338309340364496680261609853560675097851030655341200131817362917853377759200390001605154889513680026748787630195/
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:14:25
Start date:	27/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1776,i,15102099204624039598,10397676671138157332,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:14:26
Start date:	27/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://account.live.com/SecurityNotifications/Update"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://account.live.com/SecurityNotifications/Update

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

Windows Analysis Report
https://account.live.com/SecurityNotifications/Update