Edit tour

Windows Analysis Report
http://replicon.coverys.co.uk

Overview

General Information

Sample URL:	http://replicon.coverys.co.uk
Analysis ID:	1438421
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

LLM detected suspicious javascript

Form action URLs do not match main URL

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML title does not match URL

No HTML title found

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5500 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2012,i,17688312714450364625,6802732224170712627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://replicon.coverys.co.uk" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

LLM detected suspicious javascript

Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2

LLM: Score: 7 Reasons: The JavaScript code contains several functions that could potentially be used for malicious purposes, such as registering event handlers, manipulating the DOM, and making network requests. The code also contains a function for logging debug information, which could be used to exfiltrate sensitive data. Additionally, the code uses the document's 'load' event to execute some logic, which could be used to perform actions after the page has fully loaded. However, there is no explicit evidence of phishing or other malicious intent in the code.

Source: https://global.replicon.com/!/saml2/Cmal/sp-sso/post

HTTP Parser: Form action: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2 replicon microsoftonline

Source: https://global.replicon.com/!/saml2/Cmal/sp-sso/post	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true	HTTP Parser: Number of links: 0

Source: https://global.replicon.com/!/saml2/Cmal/sp-sso/post

HTTP Parser: Base64 decoded: <samlp:AuthnRequest ID="_e15d7441-016e-4fa4-a66c-edd2e3095933" Version="2.0" IssueInstant="2024-05-08T15:49:46.678Z" Destination="https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2" ForceAuthn="false" IsPassive="false" xmlns:saml...

Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://global.replicon.com/!/saml2/Cmal/sp-sso/post

HTTP Parser: HTML title missing

Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true

HTTP Parser: <input type="password" .../> found

Source: https://global.replicon.com/!/saml2/Cmal/sp-sso/post	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2	HTTP Parser: No favicon

Source: https://global.replicon.com/!/saml2/Cmal/sp-sso/post	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://global.replicon.com/!/saml2/Cmal/sp-sso/post	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49755 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 96.7.158.101:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.158.101:443 -> 192.168.2.5:49719 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 34MB

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49755 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /!/saml2/Cmal/sp-sso/post HTTP/1.1Host: global.replicon.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: global.replicon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://global.replicon.com/!/saml2/Cmal/sp-sso/postAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_IDwaQXicOTFiRVOQGoK9bQ2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_il6fx5t9s506cdxfu3ywpg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/illustration?ts=637215083190613316 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/bannerlogo?ts=637217897975221135 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6ef02721-9d08-4e5a-b493-ca348312dd39/winauth/ssoprobe?client-request-id=c39cabc7-d05b-44f2-80cb-1ea2f657286a&_=1715183396054 HTTP/1.1Host: autologon.microsoftazuread-sso.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/bannerlogo?ts=637217897975221135 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/illustration?ts=637215083190613316 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: replicon.coverys.co.ukConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: replicon.coverys.co.uk
Source: global traffic	DNS traffic detected: DNS query: global.replicon.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauthimages.net
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 08 May 2024 15:49:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closex-frame-options: SAMEORIGINx-ua-compatible: IE=edgestrict-transport-security: max-age=31536000vary: Accept-EncodingCF-Cache-Status: EXPIREDExpires: Wed, 08 May 2024 19:49:48 GMTCache-Control: public, max-age=14400Server: cloudflareCF-RAY: 880a9a115c1576c7-SEA

Source: chromecache_80.2.dr	String found in binary or memory: http://feross.org
Source: chromecache_90.2.dr, chromecache_81.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_90.2.dr, chromecache_81.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_80.2.dr, chromecache_90.2.dr, chromecache_86.2.dr, chromecache_81.2.dr, chromecache_91.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_73.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_73.2.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 96.7.158.101:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.158.101:443 -> 192.168.2.5:49719 version: TLS 1.2

Source: classification engine

Classification label: sus23.phis.win@18/46@24/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2012,i,17688312714450364625,6802732224170712627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://replicon.coverys.co.uk"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2012,i,17688312714450364625,6802732224170712627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://replicon.coverys.co.uk	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	0%	URL Reputation	safe
https://aadcdn.msftauthimages.net/c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/bannerlogo?ts=637217897975221135	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_IDwaQXicOTFiRVOQGoK9bQ2.js	0%	Avira URL Cloud	safe
http://replicon.coverys.co.uk/	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js	0%	Avira URL Cloud	safe
https://aadcdn.msftauthimages.net/c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/illustration?ts=637215083190613316	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_il6fx5t9s506cdxfu3ywpg2.js	0%	Avira URL Cloud	safe
https://autologon.microsoftazuread-sso.com/6ef02721-9d08-4e5a-b493-ca348312dd39/winauth/ssoprobe?client-request-id=c39cabc7-d05b-44f2-80cb-1ea2f657286a&_=1715183396054	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
replicon.coverys.co.uk	15.197.142.173	true	false	unknown
global.replicon.com	104.16.240.248	true	false	high
www.google.com	142.251.215.228	true	false	high
part-0042.t-0009.t-msedge.net	13.107.213.70	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
autologon.microsoftazuread-sso.com	20.190.151.70	true	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	high
aadcdn.msftauthimages.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_il6fx5t9s506cdxfu3ywpg2.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_IDwaQXicOTFiRVOQGoK9bQ2.js	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true	false		high
https://aadcdn.msftauthimages.net/c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/bannerlogo?ts=637217897975221135	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js	false	Avira URL Cloud: safe	unknown
https://global.replicon.com/favicon.ico	false		high
https://global.replicon.com/!/saml2/Cmal/sp-sso/post	false		high
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2	false		high
http://replicon.coverys.co.uk/	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	false	URL Reputation: safe	unknown
https://aadcdn.msftauthimages.net/c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/illustration?ts=637215083190613316	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	false	URL Reputation: safe	unknown
https://autologon.microsoftazuread-sso.com/6ef02721-9d08-4e5a-b493-ca348312dd39/winauth/ssoprobe?client-request-id=c39cabc7-d05b-44f2-80cb-1ea2f657286a&_=1715183396054	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://knockoutjs.com/	chromecache_90.2.dr, chromecache_81.2.dr	false	high
https://github.com/douglascrockford/JSON-js	chromecache_80.2.dr, chromecache_90.2.dr, chromecache_86.2.dr, chromecache_81.2.dr, chromecache_91.2.dr	false	high
https://login.windows-ppe.net	chromecache_73.2.dr	false	high
https://login.microsoftonline.com	chromecache_73.2.dr	false	high
http://www.opensource.org/licenses/mit-license.php)	chromecache_90.2.dr, chromecache_81.2.dr	false	high
http://feross.org	chromecache_80.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
15.197.142.173	replicon.coverys.co.uk	United States	7430	TANDEMUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
13.107.246.70	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.151.70	autologon.microsoftazuread-sso.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.16.240.248	global.replicon.com	United States	13335	CLOUDFLARENETUS	false
142.251.215.228	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.107.213.70	part-0042.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1438421
Start date and time:	2024-05-08 17:48:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://replicon.coverys.co.uk
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus23.phis.win@18/46@24/9

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.217.78, 142.250.107.84, 142.250.217.67, 34.104.35.123, 40.126.62.132, 20.190.190.194, 20.190.190.193, 20.190.190.196, 40.126.62.130, 40.126.62.129, 20.190.190.132, 20.190.190.131, 23.55.168.8, 23.55.168.75, 20.190.190.130, 20.190.190.195, 40.126.62.131, 13.85.23.86, 142.251.215.234, 142.251.211.234, 142.250.217.106, 142.251.33.106, 142.250.69.202, 142.250.217.74, 142.251.33.74, 199.232.210.172, 192.229.211.108, 20.242.39.171, 20.3.187.198, 23.53.122.204, 23.53.122.211, 72.21.81.240
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, ak.privatelink.msidentity.com, a1894.dscb.akamai.net, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, update.googleapis.com, hlb.apr-52dd2-0.edgecastdns.net, login.mso.msidentity.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.tm.ak.prd.aadg.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, aadcdn-msft.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.ak.prd.aadg.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, wu.ec.azureedge.net, aadcdn-msft.afd.azureedge.net, ctldl.windowsupdate.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: http://replicon.coverys.co.uk

Input	Output
URL: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2	{ "riskscore": 7, "reasons": "The JavaScript code contains several functions that could potentially be used for malicious purposes, such as registering event handlers, manipulating the DOM, and making network requests. The code also contains a function for logging debug information, which could be used to exfiltrate sensitive data. Additionally, the code uses the document's 'load' event to execute some logic, which could be used to perform actions after the page has fully loaded. However, there is no explicit evidence of phishing or other malicious intent in the code." }"
//<![CDATA[ !function(){var e=window,r=e.$Debug=e.$Debug\|\|{},t=e.$Config\|\|{};if(!r.appendLog){var n=[],o=0;r.appendLog=function(e){var r=t.maxDebugLog\|\|25,i=(new Date).toUTCString()+":"+e;n.push(o+":"+i),n.length>r&&n.shift(),o++},r.getLogs=function(){return n}}}(),function(){function e(e,r){function t(i){var a=e[i];if(i<n-1){return void(o.r[a]?t(i+1):o.when(a,function(){t(i+1)}))}r(a)}var n=e.length;t(0)}function r(e,r,i){function a(){var e=!!s.method,o=e?s.method:i[0],a=s.extraArgs\|\|[],u=n.$WebWatson;try{ var c=t(i,!e);if(a&&a.length>0){for(var d=a.length,l=0;l<d;l++){c.push(a[l])}}o.apply(r,c)}catch(e){return void(u&&u.submitFromException&&u.submitFromException(e))}}var s=o.r&&o.r[e];return r=r\|\|this,s&&(s.skipTimeout?a():n.setTimeout(a,0)),s}function t(e,r){return Array.prototype.slice.call(e,r?1:0)}var n=window;n.$Do\|\|(n.$Do={"q":[],"r":[],"removeItems":[],"lock":0,"o":[]});var o=n.$Do;o.when=function(t,n){function i(e){r(e,a,s)\|\|o.q.push({"id":e,"c":a,"a":s})}var a=0,s=[],u=1;"function"==typeof n\|\|(a=n, u=2);for(var c=u;c<arguments.length;c++){s.push(arguments[c])}t instanceof Array?e(t,i):i(t)},o.register=function(e,t,n){if(!o.r[e]){o.o.push(e);var i={};if(t&&(i.method=t),n&&(i.skipTimeout=n),arguments&&arguments.length>3){i.extraArgs=[];for(var a=3;a<arguments.length;a++){i.extraArgs.push(arguments[a])}}o.r[e]=i,o.lock++;try{for(var s=0;s<o.q.length;s++){var u=o.q[s];u.id==e&&r(e,u.c,u.a)&&o.removeItems.push(u)}}catch(e){throw e}finally{if(0===--o.lock){for(var c=0;c<o.removeItems.length;c++){ for(var d=o.removeItems[c],l=0;l<o.q.length;l++){if(o.q[l]===d){o.q.splice(l,1);break}}}o.removeItems=[]}}}},o.unregister=function(e){o.r[e]&&delete o.r[e]}}(),function(e,r){function t(){if(!a){if(!r.body){return void setTimeout(t)}a=!0,e.$Do.register("doc.ready",0,!0)}}function n(){if(!s){if(!r.body){return void setTimeout(n)}t(),s=!0,e.$Do.register("doc.load",0,!0),i()}}function o(e){(r.addEventListener\|\|"load"===e.type\|\|"complete"===r.readyState)&&t()}function i(){ r.addEventListener?(r.removeEventListener("DOMContentLoaded",o,!1),e.removeEventListener("load",n,!1)):r.attachEvent&&(r.detachEvent("onreadystatechange",o),e.detachEvent("onload",n))}var a=!1,s=!1;if("complete"===r.readyState){return void setTimeout(n)}!function(){r.addEventListener?(r.addEventListener("DOMContentLoaded",o,!1),e.addEventListener("load",n,!1)):r.attachEvent&&(r.attachEvent("onreadystatechange",o),e.attachEvent("onload",n))}()}(window,document),function(){function e(){ return f.$Config\|\|f.ServerData\|\|{}}function r(e,r){var t=f.$Debug;t&&t.appendLog&&(r&&(e+=" '"+(r.src\|\|r.href\|\|"")+"'",e+=", id:"+(r.id\|\|""),e+=", async:"+(r.async\|\|""),e+=", defer:"+(r.defer\|\|"")),t.appendLog(e))}function t(){var e=f.$B;if(void 0===d){if(e){d=e.IE}else{var r=f.navigator.userAgent;d=-1!==r.indexOf("MSIE ")\|\|-1!==r.indexOf("Trident/")}}return d}function n(){var e=f.$B;if(void 0===l){if(e){l=e.RE_Edge}else{var r=f.navigator.userAgent;l=-1!==r.indexOf("Edge")}}return l}function o(e){ var r=e.indexOf("?"),t=r>-1?r:e.length,n=e.lastIndexOf(".",t);return e.substring(n,n+h.length).toLowerCase()===h}function i(){var r=e();return(r.loader\|\|{}).slReportFailure\|\|r.slReportFailure\|\|!1}function a(){return(e().loader\|\|{}).redirectToErrorPageOnLoadFailure\|\|!1}function s(){return(e().loader\|\|{}).logByThrowing\|\|!1}function u(e){if(!t()&&!n()){return!1}var r=e.src\|\|e.href\|\|"";if(!r){return!0}if(o(r)){var i,a,s;try{i=e.sheet,a=i&&i.cssRules,s=!1}catch(e){s=!0}if(i&&!a&&s){return!0} if(i&&a&&0===a.length){return!0}}return!1}function c(){function t(e){g.getElementsByTagName("head")[0].appendChild(e)}function n(e,r,t,n){var u=null;return u=o(e)?i(e):"script"===n.toLowerCase()?a(e):s(e,n),r&&(u.id=r),"function"==typeof u.setAttribute&&(u.setAttribute("crossorigin","anonymous"),t&&"string"==typeof t&&u.setAttribute("integrity",t)),u}function i(e){var r=g.createElement("link");return r.rel="stylesheet",r.type="text/css",r.href=e,r}function a(e){ var r=g.createElement("script"),t=g.querySelector("script[nonce]");if(r.type="text/javascript",r.src=e,r.defer=!1,r.async=!1,t){var n=t.nonce\|\|t.getAttribute("nonce");r.setAttribute("nonce",n)}return r}function s(e,r){var t=g.createElement(r);return t.src=e,t}function d(e,r){if(e&&e.length>0&&r){for(var t=0;t<e.length;t++){if(-1!==r.indexOf(e[t])){return!0}}}return!1}function l(r){if(e().fTenantBrandingCdnAddEventHandlers){var t=d($,r)?$:b;if(!(t&&t.length>1)){return r}for(var n=0;n<t.length;n++){ if(-1!==r.indexOf(t[n])){var o=t[n+1<t.length?n+1:0],i=r.substring(t[n].length);return"https://"!==t[n].substring(0,"https://".length)&&(o="https://"+o,i=i.substring("https://".length)),o+i}}return r}if(!(b&&b.length>1)){return r}for(var a=0;a<b.length;a++){if(0===r.indexOf(b[a])){return b[a+1<b.length?a+1:0]+r.substring(b[a].length)}}return r}function f(e,t,n,o){if(r("[$Loader]: "+(w.failMessage\|\|"Failed"),o),E[e].retry<y){return E[e].retry++,v(e,t,n),void c._ReportFailure(E[e].retry,E[e].srcPath)}n&&n()} function h(e,t,n,o){if(u(o)){retu
URL: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true	{ "riskscore": 1, "reasons": "The JavaScript code provided appears to be configuration data for a login page, rather than executable code. It contains various URLs for login, logout, and federated identity providers, as well as data for phone codes for various countries. There does not appear to be any malicious content in this data." }"
//<![CDATA[ $Config={"fShowPersistentCookiesWarning":false,"urlMsaSignUp":"https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAA42Kw0sgoKSkottLXT8_JT0rM0StKLcjJTM7P00vOz9VX1C9OzM0x0nf2dfQpEuISOL56zuHoC59cGk7LLfoWrpE1i5EzPiezLBWkeBWjIbFG6RcX5-sX5BeXHGJUjU81NE0xNzEx1DUwNEvVNUlLNNFNNDNL1k1NSTFKNTawNLU0Nr7AyPiCkfEWE2swyIxZzOwpqWmJpTklm5hVzFLTDIzMjQx1LVMMLHRNUk0TdZNMLI11kxONTSyMDY1SUowtL7DwvGLhMWC24uDgEmCQYFBg-MHCuIgV6KHF13-89dyd4LRdxPh7_B53hlOs-uVBFvqmxQXByY6lkb6ZjgUVvgbZvvpBzkZVXiUWFaaBvtrllmkG4c4ZRpG25laGE9h4T7ExfGBj7GBnmMXOcICTcQMP4wFehh98v9d8bHjxbvY7j1f8OomV5kXFoaaeJv5pyaYpoUnmptoRafoWLkllKbmJnh4m-smGwc5ZLp4eBa62GwQYAA2\u0026estsfed=1\u0026uaid=c39cabc7d05b44f280cb1ea2f657286a\u0026signup=1\u0026lw=1\u0026fl=easi2\u0026fci=https%3a%2f%2fglobal.replicon.com%2f!%2fsaml2%2fCMAL","urlMsaLogout":"https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com","urlOtherIdpForget":"https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com","showCantAccessAccountLink":true,"urlGitHubFed":"https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAA42Kw0sgoKSkottLXT8_JT0rM0StKLcjJTM7P00vOz9VX1C9OzM0x0nf2dfQpEuISOL56zuHoC59cGk7LLfoWrpE1i5EzPiezLBWkeBWjIbFG6RcX5-sX5BeXHGJUjU81NE0xNzEx1DUwNEvVNUlLNNFNNDNL1k1NSTFKNTawNLU0Nr7AyPiCkfEWE2swyIxZzOwpqWmJpTklm5hVzFLTDIzMjQx1LVMMLHRNUk0TdZNMLI11kxONTSyMDY1SUowtL7DwvGLhMWC24uDgEmCQYFBg-MHCuIgV6KHF13-89dyd4LRdxPh7_B53hlOs-uVBFvqmxQXByY6lkb6ZjgUVvgbZvvpBzkZVXiUWFaaBvtrllmkG4c4ZRpG25laGE9h4T7ExfGBj7GBnmMXOcICTcQMP4wFehh98v9d8bHjxbvY7j1f8OomV5kXFoaaeJv5pyaYpoUnmptoRafoWLkllKbmJnh4m-smGwc5ZLp4eBa62GwQYAA2\u0026estsfed=1\u0026uaid=c39cabc7d05b44f280cb1ea2f657286a\u0026fci=https%3a%2f%2fglobal.replicon.com%2f!%2fsaml2%2fCMAL\u0026idp_hint=github.com","arrExternalTrustedRealmFederatedIdps":[],"fShowSignInWithGitHubOnlyOnCredPicker":true,"fEnableShowResendCode":true,"iShowResendCodeDelay":90000,"sSMSCtryPhoneData":"AF~Afghanistan~93!!!AX~land Islands~358!!!AL~Albania~355!!!DZ~Algeria~213!!!AS~American Samoa~1!!!AD~Andorra~376!!!AO~Angola~244!!!AI~Anguilla~1!!!AG~Antigua and Barbuda~1!!!AR~Argentina~54!!!AM~Armenia~374!!!AW~Aruba~297!!!AC~Ascension Island~247!!!AU~Australia~61!!!AT~Austria~43!!!AZ~Azerbaijan~994!!!BS~Bahamas~1!!!BH~Bahrain~973!!!BD~Bangladesh~880!!!BB~Barbados~1!!!BY~Belarus~375!!!BE~Belgium~32!!!BZ~Belize~501!!!BJ~Benin~229!!!BM~Bermuda~1!!!BT~Bhutan~975!!!BO~Bolivia~591!!!BQ~Bonaire~599!!!BA~Bosnia and Herzegovina~387!!!BW~Botswana~267!!!BR~Brazil~55!!!IO~British Indian Ocean Territory~246!!!VG~British Virgin Islands~1!!!BN~Brunei~673!!!BG~Bulgaria~359!!!BF~Burkina Faso~226!!!BI~Burundi~257!!!CV~Cabo Verde~238!!!KH~Cambodia~855!!!CM~Cameroon~237!!!CA~Canada~1!!!KY~Cayman Islands~1!!!CF~Central African Republic~236!!!TD~Chad~235!!!CL~Chile~56!!!CN~China~86!!!CX~Christmas Island~61!!!CC~Cocos (Keeling) Islands~61!!!CO~Colombia~57!!!KM~Comoros~269!!!CG~Congo~242!!!CD~Congo (DRC)~243!!!CK~Cook Islands~682!!!CR~Costa Rica~506!!!CI~Cte d\u0027Ivoire~225!!!HR~Croatia~385!!!CU~Cuba~53!!!CW~Curaao~599!!!CY~Cyprus~357!!!CZ~Czechia~420!!!DK~Denmark~45!!!DJ~Djibouti~253!!!DM~Dominica~1!!!DO~Dominican Republic~1!!!EC~Ecuador~593!!!EG~Egypt~20!!!SV~El Salvador~503!!!GQ~Equatorial Guinea~240!!!ER~Eritrea~291!!!EE~Estonia~372!!!ET~Ethiopia~251!!!FK~Falkland Islands~500!!!FO~Faroe Islands~298!!!FJ~Fiji~679!!!FI~Finland~358!!!FR~France~33!!!GF~French Guiana~594!!!PF~French Polynesia~689!!!GA~Gabon~241!!!GM~Gambia~220!!!GE~Georgia~995!!!DE~Germany~49!!!GH~Ghana~233!!!GI~Gibraltar~350!!!GR~Greece~30!!!GL~Greenland~299!!!GD~Grenada~1!!!GP~Guadeloupe~590!!!GU~Guam~1!!!GT~Guatemala~502!!!GG~Guernsey~44!!!GN~Guinea~224!!!GW~Guinea-Bissau~245!!!GY~Guyana~592!!!HT~Haiti~509!!!HN~Honduras~504!!!HK~Hong Kong SAR~852!!!HU~Hungary~36!!!IS~Iceland~354!!!IN~India~91!!!ID~Indonesia~62!!!IR~Iran~98!!!IQ~Iraq~964!!!IE~Ireland~353!!!IM~Isle of Man~44!!!IL~Israel~972!!!IT~Italy~39!!!JM~Jamaica~1!!!JP~Japan~81!!!JE~Jersey~44!!!JO~Jordan~962!!!KZ~Kazakhstan~7!!!KE~Kenya~254!!!KI~Kiribati~686!!!KR~Korea~82!!!KW~Kuwait~965!!!KG~Kyrgyzstan~996!!!LA~Laos~856!!!LV~Latvia~371!!!LB~Lebanon~961!!!LS~Lesotho~266!!!LR~Liberia~231!!!LY~Libya~218!!!LI~Liechtenstein~423!!!LT~Lithuania~370!!!LU~Luxembourg~352!!!MO~Macao SAR~853!!!MG~Madagascar~261!!!MW~Malawi~265!!!MY~Malaysia~60!!!MV~Maldives~960!!!ML~Mali~223!!!MT~Malta~356!!!MH~Marshall Islands~692!!!MQ~Martinique~596!!!MR~Mauritania~222!!!MU~Mauritius~230!!!YT~Mayotte~262!!!MX~Mexico~52!!!FM~Micronesia~691!!!MD~Moldova~373!!!MC~Mo
URL: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2	```json { "riskscore": 1, "reasons": "The code contains an obfuscated anonymous function which is a common technique used in malicious code to evade detection. However, the function itself is not inherently malicious. It adds event listeners to the head element of the document to listen for 'error' and 'load' events on elements with a 'data-loader' attribute set to 'cdn'. While this could potentially be used for malicious purposes (such as phishing), it is also possible that it is being used for legitimate reasons (such as tracking the loading of resources from a CDN). Therefore, the risk score is set to 1 (low risk)." } ```"
//<![CDATA[ !function(t,e){!function(){var n=e.getElementsByTagName("head")[0];n&&n.addEventListener&&(n.addEventListener("error",function(e){null!==e.target&&"cdn"===e.target.getAttribute("data-loader")&&t.$Loader.OnError(e.target)},!0),n.addEventListener("load",function(e){null!==e.target&&"cdn"===e.target.getAttribute("data-loader")&&t.$Loader.OnSuccess(e.target)},!0))}()}(window,document); //
URL: https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true	```json { "riskscore": 1, "reasons": "The code checks if the page is in a frame and if not, it modifies the page's URL with a session ID and then redirects the top frame to the modified URL. This behavior could be used for phishing attacks, but it's not definitive proof. The risk score is kept low due to the lack of clear malicious intent." } ```"
//<![CDATA[ !function(){var e=window,o=e.document,i=e.$Config\|\|{};if(e.self===e.top){o&&o.body&&(o.body.style.display="block")}else if(!i.allowFrame){var s=e.self.location.href,l=s.indexOf("#"),n=-1!==l,t=s.indexOf("?"),f=n?l:s.length,d=-1===t\|\|n&&t>l?"?":"&";s=s.substr(0,f)+d+"iframe-request-id="+i.sessionId+s.substr(f),e.top.location=s}}(); //
URL: https://global.replicon.com/!/saml2/Cmal/sp-sso/post	Based on the analysis of the provided URL and the image of the web page, here are the findings: 1. URL Analysis: - The URL `https://global.replicon.com/!/saml2/Cmal/sp-sso/post` includes the domain `replicon.com`, which is a legitimate domain associated with Replicon, a company known for providing time tracking and management services. - The presence of `saml2` in the URL suggests it might be related to authentication, specifically SAML (Security Assertion Markup Language) which is commonly used for single sign-on (SSO) services. 2. Image Analysis: - The image shows a login page with fields for username and password, which is typical for a service that requires user authentication. - The design and layout appear professional and consistent with what might be expected from a corporate service like Replicon. - There are no obvious grammatical errors or low-quality elements that are often telltale signs of phishing attempts. 3. Suspicious Elements: - No overtly suspicious elements such as mismatched URLs, poor language, or unprofessional design are observed in the image or the URL. 4. Social Engineering Techniques: - There is no evident use of social engineering techniques such as urgency, fear, or too-good-to-be-true offers in the visible content. 5. Conclusion: - The URL matches the legitimate domain associated with the Replicon brand. - The web page design and elements do not raise any immediate red flags typical of phishing sites. ```json { "phishing_score": 1, "brands": "Replicon", "phishing": false, "suspicious_domain": false, "has_loginform": true, "has_captcha": false, "setechniques": false, "blank": false, "reasons": "The URL matches the legitimate domain for Replicon, and the web page design is professional without any evident phishing indicators." }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 14:49:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.972125341085938
Encrypted:	false
SSDEEP:	48:8YdxT5NaHtidAKZdA19ehwiZUklqehgy+3:8KLA/y
MD5:	1C4EDC6C6DCDEC26E714DDE051627A6A
SHA1:	103D209521DD6E4455D38462E3DF93B6BFC054F1
SHA-256:	CC45B1D5FE6A4C6EA0FC1DB15D56D353F837384A2DBA140B477CB75131B82388
SHA-512:	AC6731E45671FBAD9893A67644F051A75991C333E108975B7E227F2336CF8823218DBB1DEC666C313FA26FBB3863B8D8578E6BA9F6F82D99770549E62A6D5B69
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....4.X_...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X4~....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X4~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X4~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X4~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X7~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........g..H.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 14:49:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.989615974740449
Encrypted:	false
SSDEEP:	48:8mdxT5NaHtidAKZdA1weh/iZUkAQkqehvy+2:8ML69QWy
MD5:	B6FD9D5EA08AE7BC09384A4088A3D520
SHA1:	D4D3AD7C49B6708885269691438D56CA3CED9DEF
SHA-256:	B154DE555E8315D6FD225963A22D887CC706A5FCD702D7AAC78A4E11652E8540
SHA-512:	EC7EF61C249DDE8FFBB7D9E0CD820C079F203507D2FB962E8983573314FE6A44D65305C4F91FA49A8A829D39B942A9D6C8F850C840AE91CA5C26E3D631B4771C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......X_...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X4~....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X4~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X4~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X4~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X7~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........g..H.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0011971237899635
Encrypted:	false
SSDEEP:	48:8xWdxT5NsHtidAKZdA14tseh7sFiZUkmgqeh7sly+BX:8xcLInLy
MD5:	CD6A22F049905CFE169A234C291509B8
SHA1:	C05745FF8FE616D7CB4AC478C3E01731016DBD3C
SHA-256:	1FD9EB8DE179085740C02BC17F7CB9506CB0EB08087D92922F293842A85AA597
SHA-512:	9E96572B9C00ACE8B0BF06E1C01232299FEBC8D6448E80FC8D2919507D24442F3C173D1EF0FE96C8FFD95858A4BDF5AA4C20D8F28BBE23006AF39C389A97F427
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X4~....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X4~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X4~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X4~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........g..H.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 14:49:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.990702497254996
Encrypted:	false
SSDEEP:	48:8EdxT5NaHtidAKZdA1vehDiZUkwqehTy+R:8mLhNy
MD5:	786B26E9EF58BFF3C451EA8207344E0A
SHA1:	4D9043204690F934B49C7D534AF7057D9CE7658C
SHA-256:	71D671B33D7C4C3A7FD0A898D32A2B11B0C9B8F5A25F001B2E5058A85464BB8F
SHA-512:	1BF1C87F82CE84EFD10984483DDC226406C9A86BD1C26DE3D999C86DF490B9C0FE62030DACD97E9CBD36A8FDCCC323C9D6CE349D74706E83867ED8B39B816EE2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......X_...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X4~....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X4~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X4~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X4~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X7~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........g..H.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 14:49:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.977597581765207
Encrypted:	false
SSDEEP:	48:8BdxT5NaHtidAKZdA1hehBiZUk1W1qehBy+C:8FLh9hy
MD5:	494E522B4161C5A4EA51F876DC5A88E2
SHA1:	6CD552F4F7B92F0A47141244A8972525C71BDD1A
SHA-256:	FB1891F24CF7AA7816537F75A5BF09705516B54863527DF9BF046EC89FA8DA1D
SHA-512:	8E97BF8A7660E42FA49A800DDCD4CB6573A4125690F4CD0FA8A78E5394A4B3A2518BE4C94C636A7D5E43CF045ADC478997E5C5E2DAE1104E018F80131412B8E6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....#..X_...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X4~....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X4~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X4~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X4~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X7~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........g..H.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 14:49:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9886944457388247
Encrypted:	false
SSDEEP:	48:8xdxT5NaHtidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8VLdT/TbxWOvTbLy7T
MD5:	A853D0D8BC2529EC20334786802FA04A
SHA1:	F5D0D5C38074EFA7F5D70A216B00C0BE59A8FC19
SHA-256:	5908C650C9C31A7BF54E772A29C5F76E7DCF46ADD8AEE2917CFD24594750C360
SHA-512:	6DAA17A0931AA9F4E7BCF9D3510C2B2096F5546761970FBDF1659F097084BF3B1B4CEED1905A55695F2FC43F6FC56278F28868CA54399C09902010415B9C8B5B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....&{.X_...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X4~....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X4~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X4~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X4~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X7~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........g..H.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 280 x 58, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	4900
Entropy (8bit):	7.93463639098251
Encrypted:	false
SSDEEP:	96:W776USlnwBctNW3rqWSQzZG0ez8Iv22NkF3VxIVp/5XSVa+/q9aCL:W/6Bnwe3SuQeLVN4QFXSVJe
MD5:	6F8ADC71B6FA92C718D2EC4D302D178E
SHA1:	7E3698C0CA2208CCA7A4F7B061FBAE2A1B64ED3F
SHA-256:	F8127A6BC7EFAEE62E168FB812C405162C24FE3C25A607828F6A8AAE396768B1
SHA-512:	9F60E27FE807E25A4A165648DB0CA8531E3240F853EC9C220764FA6C43E589BD2DA80BA8B71B779A6AF25092E251515BD7CF4DEB82E6CAFCBA7C6B061FF86D9C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......:.....\C.7....gAMA......a.....sRGB.........PLTE....}\|.pp.%%.......=<.ZZ...&%....ee.ee.43.11.......44.LL.11....JJ.zz....&%.??.pp.+..II....+.>>..11....CC.%$.%%.NN..........mm.PP....<<.TT.}~.................CC.$$.??.BB.kk.SS........HH..^^.......FF.)).%%.""....##.KK.RS.jk.[[.aa.\\........cc.cc.::..ts..........mm{}..ff.......^^..........$#.II....TT.88.__.DD.qq.st.\\........XX.!!.QQ....^^..LL....{{.%$.......##.oo....('....%%.UU....lm....@@.88..."!..........''.$$....MM.87.......\|}..55.MN....qq.......@@.....WW.mm.mm.--~...LL....77....99.WW.99yy}..........>>.;;.[[.[[.... .......z}.yz~.++....??.%%xx}.=>.......@?....BA......tuy.......%%.>>.11....,,.....QQ.........12.%%.&&.##.''....$$................((.......((.... .......""..........*..........%%tvzwx}}~..........rswy{....hjomos....e......tRNS..U......;............4.n...$......S.S.ZB>.@re. .$2v,F4. .......S......#Jz.I,yQ_..r4.A.m.5&..H....>.cD.a.\;Y..2...jB..o.v.3Ma....,f....J.>.G.c.UI

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1245
Entropy (8bit):	5.462849750105637
Encrypted:	false
SSDEEP:	24:hM0mIAvy4Wvsqs1Ra7JZRGNeHX+AYcvP2wk1RjdEF3qpMk5:lmIAq1UqsziJZ+eHX+AdP2TvpMk5
MD5:	5343C1A8B203C162A3BF3870D9F50FD4
SHA1:	04B5B886C20D88B57EEA6D8FF882624A4AC1E51D
SHA-256:	DC1D54DAB6EC8C00F70137927504E4F222C8395F10760B6BEECFCFA94E08249F
SHA-512:	E0F50ACB6061744E825A4051765CEBF23E8C489B55B190739409D8A79BB08DAC8F919247A4E5F65A015EA9C57D326BBEF7EA045163915129E01F316C4958D949
Malicious:	false
Reputation:	low
URL:	https://global.replicon.com/favicon.ico
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">.. ..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="co

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (43896)
Category:	downloaded
Size (bytes):	223759
Entropy (8bit):	5.257015244909601
Encrypted:	false
SSDEEP:	3072:5Q0ZqoBmLJEoWcjY6B66pO25rksurxIDZVihYZ+V:RmNdTpOFsursZkV
MD5:	764E526CEF65C9F062BB8E83D8EBCE0B
SHA1:	F5166F7B003CBE1B171BE88AA65D2E3FD2331366
SHA-256:	474CE0790CEB18A100CEBAF1AC0915A51389FCAE0830C3B44BFA1E365D40B2B4
SHA-512:	49725A491D8C7494D4074D0A96D978D75700657CA9EDA456C3B3EBA3333DC6733D19A8BBE19BC9DCF381FA1B1CA96251A910056ADE259340A17F85FB6D5EF863
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],{529:function(e,t,r)

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45529)
Category:	downloaded
Size (bytes):	141305
Entropy (8bit):	5.430788281341128
Encrypted:	false
SSDEEP:	1536:5FZ5ELQbTPRUbx3jog/MhTyvRkmYWp0BSYmvIxdL/Bpns0Vgt2CTJm0wTxFojd9K:jEArg/MMNn3vIPzDk80ZjT0qcePgT
MD5:	1A0C9CD8426709A1C5AC8EB19013CB72
SHA1:	21FEB1E3BBEC4F6271D3FC68A71F928B86840810
SHA-256:	D12F35509E7EBCD8AF368FAF23C490FDA08FA0CB21171AB6B60AE2468242E500
SHA-512:	FE9EBA6B17A674CABD0545579264B54F7AAAA9068529681A7F376EDE79083F8615F041B43C41F13E4BE49AD4AF13E1CFBA36E7157EBBD1C11ADE72C9A31A6FC8
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,r,i=n[0],a=n[1],s=0,u=[];s<i.length;s++)

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61177)
Category:	downloaded
Size (bytes):	113084
Entropy (8bit):	5.285180915082997
Encrypted:	false
SSDEEP:	1536:QpHDgBvguhw+EViazA/PWrF7qvEAFiQcpmchSeC2Jzc6VUWG:xkNh06VUT
MD5:	D62B4EDEB512B07ABEF4688E27ECDDE3
SHA1:	981A7825DA5E29938AB6FE0CBFE2DB622F7B8333
SHA-256:	4B01A0A34CE8ED4BC8A8713BE0442D49DA6A756236B7B4424622CA3DEE820F41
SHA-512:	6E91B285BEA8566EBB7829F592744A6706CF6498E6D5DC1C5A0EBDD0A685D767AA215B275A88568B957E6BE824AEE60521ED1D77D92A697A3CE0F446ECDCDDB9
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14735)
Category:	downloaded
Size (bytes):	15708
Entropy (8bit):	5.367272167361047
Encrypted:	false
SSDEEP:	384:DDeX/4OSgcw2Z12CvfeXOh+rF3lsdDZDFzfXdv79dC:2/gFb57PC
MD5:	5316E62A0EED2307FB8BCD111E96CB8F
SHA1:	71240D69183FDCCB39FE26A96045734C431A3F56
SHA-256:	35AFB11DAB6EDCBC989A25FE5CF19F5D8289499232B7EC775F318D8B8A5BBF78
SHA-512:	0AA96D93A32DB7D0F73FFF77C9EDD2B4ACC315532B2472B26601FC669088062AEA15F3AF62CB407165254D1B251BFA94790667D4CDDD5000C624F1138ADD5558
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[17],{515:function(e,n,s

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.503258334775644
Encrypted:	false
SSDEEP:	3:Eq62iczBr9ks:EqdiczBys
MD5:	06B313E93DD76909460FBFC0CD98CB6B
SHA1:	C4F9B2BBD840A4328F85F54873C434336A193888
SHA-256:	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
SHA-512:	EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChgKDQ3RW1FSGgQIVhgCIAEKBw1Xevf9GgA=

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32097)
Category:	downloaded
Size (bytes):	55182
Entropy (8bit):	5.378540857980212
Encrypted:	false
SSDEEP:	1536:ABqF1tlfretkF7IKbVaqDRx3/ym+d/Px2g+0wtIQixnqTPRUbx3VDg/Mv+l:ABrkF7IyJvym+d/Pog+0wtIQiUig/MO
MD5:	225E855F9B7DB39D3A09D5C55376303E
SHA1:	5FF86FC34398717197FBF80BBA4BCDDE91755EDB
SHA-256:	939CD5C21BAF8A4F2E8DEB2E423BD8C8C67BD18B2E54EC7ED2BB157C716BF7A2
SHA-512:	87451C0131140019394512B55E4FC4DF307E569183FDF59E5589DA797B66ADC265C71B2398D8082D15754DA181BF374BF8D617A3D01A9EDB33E6BAC5F6656DA9
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_il6fx5t9s506cdxfu3ywpg2.js
Preview:	!function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.StringsVariantId,s=r.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account",e.CT_STR_CookieBanner_Link_AriaLabel="Learn more about Microsoft's Cookie Policy",e.WF_STR_HeaderDefault_Title=o.iLoginStringsVariantId===a.CombinedSigninSignupV2WelcomeTitle?"Welcome":"Sign in",e.STR_Footer_IcpLicense_Text=".ICP.13015306.-10",o.oAppCobranding&&o.oAppCobranding.friendlyAppName){var i=o.fBreakBrandingSigninString?"to continue to {0}":"Continue to {0}";e.WF_STR_App_Title=t.format(i,o.oAppCobranding.friendlyAppName)}switch(o.oAppCobranding&&o.oAppCobranding.signinDescription&&(e.WF_STR_Default_Desc=o.oAppCobrand

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (5418), with no line terminators
Category:	downloaded
Size (bytes):	5418
Entropy (8bit):	5.872781379505791
Encrypted:	false
SSDEEP:	96:RnV4rsr8hDCMIAoMBWZNT1px9Y6Xycd/S0ODHMRFHWNsKJZPMFp7xjAYsv/9ByLV:Rn6QKISgZNz3YenODH2LKJZPM79F+kwu
MD5:	C3D0D0DA11113BB8F666116240DDFD07
SHA1:	C2977F7E031DE259FED903DD3251DD274A863BEC
SHA-256:	8365C42C197D6D89C5161B44053F380528EF17DB791290F24492BE760EFAB36F
SHA-512:	2032C57D941AC5FCF51CF37D0A14C762147083D30EB7F286233AC92070F6BB5702C5461F6D5270242A92161C8B967A685F4BEC19E07413C40D77E771347E3FBB
Malicious:	false
Reputation:	low
URL:	https://global.replicon.com/!/saml2/Cmal/sp-sso/post
Preview:	<html xmlns="http://www.w3.org/1999/xhtml"><body onload="document.forms.samlform.submit()"><noscript><p><strong>Note:</strong> Since your browser does not support Javascript, you must press the Continue button once to proceed.</p></noscript><form id="samlform" action="https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2" method="post"><div><input type="hidden" name="SAMLRequest" value="PHNhbWxwOkF1dGhuUmVxdWVzdCBJRD0iX2UxNWQ3NDQxLTAxNmUtNGZhNC1hNjZjLWVkZDJlMzA5NTkzMyIgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMjQtMDUtMDhUMTU6NDk6NDYuNjc4WiIgRGVzdGluYXRpb249Imh0dHBzOi8vbG9naW4ubWljcm9zb2Z0b25saW5lLmNvbS82ZWYwMjcyMS05ZDA4LTRlNWEtYjQ5My1jYTM0ODMxMmRkMzkvc2FtbDIiIEZvcmNlQXV0aG49ImZhbHNlIiBJc1Bhc3NpdmU9ImZhbHNlIiB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIj48c2FtbDpJc3N1ZXIgeG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+aHR0cHM6Ly9nbG9iYWwucmVwbGljb24uY29tLyEvc2FtbDIvQ01BTDwvc2FtbDpJc3N1ZXI+PFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64616)
Category:	downloaded
Size (bytes):	444415
Entropy (8bit):	5.450109779488817
Encrypted:	false
SSDEEP:	6144:P15tWmerSpl6PqNfFsQpoc1sOdKmY0O9OXd4NDE0HfNX44d:P1GOFsQp9qOkm74No6
MD5:	203C1A41789C3931624553901A82BD6D
SHA1:	1586BAFBA00C9ECF85C262632B3469CFA2E16A09
SHA-256:	B31E8319AD5221D5962E76FBE57D673EDA3218D83D7BCFEEC4C9A6B5D2A03B82
SHA-512:	20DC5B272591569EBE0E3E434EA68E64B23721A608EAFBA7536063661EB686B2761395CDD11474C0ABDB26C4BB2877A27D79C173F9DC2053373AE4C807A10B28
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_IDwaQXicOTFiRVOQGoK9bQ2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,i,o=n[0],r=n[1],s=0,c=[];s<o.length;s++)

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64612)
Category:	downloaded
Size (bytes):	113657
Entropy (8bit):	5.491055924169325
Encrypted:	false
SSDEEP:	1536:VlqCwY8gIRPY0+r5qnWisnv9ILXtlTJCwggqdq/7XtvUN5bHo:EgDTMnWBaTJggqkDxUbzo
MD5:	B6783C7717E4042517138D9C9A48C867
SHA1:	7A7D6B0F36C2A3B557F1A75461630D433E5F4942
SHA-256:	4BE11C075187615ADAF493D54CB7B05556E76806AED2B3B082D72952D0025BE5
SHA-512:	2A322A8377784CBE543C978F32CB811388658F2E328B0024580D83DDE24AF0E131276AA76FEBED0B3AD1073ABCA8189AB9CD40BC4D36CFD93C0A1ECDAD63B705
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[37],{488:function(e,t,r

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1080, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1920], baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	241446
Entropy (8bit):	7.895719410012928
Encrypted:	false
SSDEEP:	6144:hppZqzipvUUgmV/g3sRC7LhWbuoKS66VZ62UFGm+yA:hppZYKUVe/g3sRnyyZ63+p
MD5:	1F4DFF7F0FA91E4F87FAE7EE76061D05
SHA1:	25F90A66712710C586013E2F7FA24A8323B79370
SHA-256:	DCF833D7F7602E7EBCE8B4B2581DFE4BBF94570F9C84940957B816E400EEEE1C
SHA-512:	6291B18187E0E4949BFD90258F9D13D3025600CFFADE780D83E714398AFCFD7033AAFC73B76C752FF9544668EBE01DE13CE999B0351D6817EF2314B72E9051C6
Malicious:	false
Reputation:	low
Preview:	.....<Exif..MM.*...........................8...........................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop 21.0 (Windows).2020:04:03 11:58:23............0231...................................8...............................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...0.t..._.m.2.kGqPe.....y......2...#..,...em.N.q+...^... ..._.Z..?......w

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1080, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1920], baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	241446
Entropy (8bit):	7.895719410012928
Encrypted:	false
SSDEEP:	6144:hppZqzipvUUgmV/g3sRC7LhWbuoKS66VZ62UFGm+yA:hppZYKUVe/g3sRnyyZ63+p
MD5:	1F4DFF7F0FA91E4F87FAE7EE76061D05
SHA1:	25F90A66712710C586013E2F7FA24A8323B79370
SHA-256:	DCF833D7F7602E7EBCE8B4B2581DFE4BBF94570F9C84940957B816E400EEEE1C
SHA-512:	6291B18187E0E4949BFD90258F9D13D3025600CFFADE780D83E714398AFCFD7033AAFC73B76C752FF9544668EBE01DE13CE999B0351D6817EF2314B72E9051C6
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauthimages.net/c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/illustration?ts=637215083190613316
Preview:	.....<Exif..MM.*...........................8...........................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop 21.0 (Windows).2020:04:03 11:58:23............0231...................................8...............................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...0.t..._.m.2.kGqPe.....y......2...#..,...em.N.q+...^... ..._.Z..?......w

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 280 x 58, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	4900
Entropy (8bit):	7.93463639098251
Encrypted:	false
SSDEEP:	96:W776USlnwBctNW3rqWSQzZG0ez8Iv22NkF3VxIVp/5XSVa+/q9aCL:W/6Bnwe3SuQeLVN4QFXSVJe
MD5:	6F8ADC71B6FA92C718D2EC4D302D178E
SHA1:	7E3698C0CA2208CCA7A4F7B061FBAE2A1B64ED3F
SHA-256:	F8127A6BC7EFAEE62E168FB812C405162C24FE3C25A607828F6A8AAE396768B1
SHA-512:	9F60E27FE807E25A4A165648DB0CA8531E3240F853EC9C220764FA6C43E589BD2DA80BA8B71B779A6AF25092E251515BD7CF4DEB82E6CAFCBA7C6B061FF86D9C
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauthimages.net/c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/bannerlogo?ts=637217897975221135
Preview:	.PNG........IHDR.......:.....\C.7....gAMA......a.....sRGB.........PLTE....}\|.pp.%%.......=<.ZZ...&%....ee.ee.43.11.......44.LL.11....JJ.zz....&%.??.pp.+..II....+.>>..11....CC.%$.%%.NN..........mm.PP....<<.TT.}~.................CC.$$.??.BB.kk.SS........HH..^^.......FF.)).%%.""....##.KK.RS.jk.[[.aa.\\........cc.cc.::..ts..........mm{}..ff.......^^..........$#.II....TT.88.__.DD.qq.st.\\........XX.!!.QQ....^^..LL....{{.%$.......##.oo....('....%%.UU....lm....@@.88..."!..........''.$$....MM.87.......\|}..55.MN....qq.......@@.....WW.mm.mm.--~...LL....77....99.WW.99yy}..........>>.;;.[[.[[.... .......z}.yz~.++....??.%%xx}.=>.......@?....BA......tuy.......%%.>>.11....,,.....QQ.........12.%%.&&.##.''....$$................((.......((.... .......""..........*..........%%tvzwx}}~..........rswy{....hjomos....e......tRNS..U......;............4.n...$......S.S.ZB>.@re. .$2v,F4. .......S......#Jz.I,yQ_..r4.A.m.5&..H....>.cD.a.\;Y..2...jB..o.v.3Ma....,f....J.>.G.c.UI

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 8, 2024 17:49:38.334511995 CEST	49675	443	192.168.2.5	23.1.237.91
May 8, 2024 17:49:38.334511995 CEST	49674	443	192.168.2.5	23.1.237.91
May 8, 2024 17:49:38.443876982 CEST	49673	443	192.168.2.5	23.1.237.91
May 8, 2024 17:49:45.211750031 CEST	49709	80	192.168.2.5	15.197.142.173
May 8, 2024 17:49:45.212415934 CEST	49710	80	192.168.2.5	15.197.142.173
May 8, 2024 17:49:45.375235081 CEST	80	49709	15.197.142.173	192.168.2.5
May 8, 2024 17:49:45.375329018 CEST	49709	80	192.168.2.5	15.197.142.173
May 8, 2024 17:49:45.375552893 CEST	49709	80	192.168.2.5	15.197.142.173
May 8, 2024 17:49:45.376254082 CEST	80	49710	15.197.142.173	192.168.2.5
May 8, 2024 17:49:45.376322985 CEST	49710	80	192.168.2.5	15.197.142.173
May 8, 2024 17:49:45.537698030 CEST	80	49709	15.197.142.173	192.168.2.5
May 8, 2024 17:49:45.716085911 CEST	80	49709	15.197.142.173	192.168.2.5
May 8, 2024 17:49:45.767674923 CEST	49709	80	192.168.2.5	15.197.142.173
May 8, 2024 17:49:45.894522905 CEST	49713	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:45.894558907 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:45.894613981 CEST	49713	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:45.895286083 CEST	49713	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:45.895302057 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:45.923207045 CEST	80	49709	15.197.142.173	192.168.2.5
May 8, 2024 17:49:45.923254967 CEST	49709	80	192.168.2.5	15.197.142.173
May 8, 2024 17:49:46.233402014 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:46.233949900 CEST	49713	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:46.233966112 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:46.234982014 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:46.235054970 CEST	49713	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:46.238856077 CEST	49713	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:46.238933086 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:46.239840984 CEST	49713	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:46.239850998 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:46.283929110 CEST	49713	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:46.894496918 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:46.894531965 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:46.894561052 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:46.894586086 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:46.894608021 CEST	49713	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:46.894625902 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:46.894654989 CEST	49713	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:46.894675970 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:46.894856930 CEST	49713	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:46.899055004 CEST	49713	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:46.899077892 CEST	443	49713	104.16.240.248	192.168.2.5
May 8, 2024 17:49:47.748058081 CEST	49714	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:47.748106956 CEST	443	49714	104.16.240.248	192.168.2.5
May 8, 2024 17:49:47.748172998 CEST	49714	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:47.748840094 CEST	49714	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:47.748859882 CEST	443	49714	104.16.240.248	192.168.2.5
May 8, 2024 17:49:47.808437109 CEST	49715	443	192.168.2.5	142.251.215.228
May 8, 2024 17:49:47.808471918 CEST	443	49715	142.251.215.228	192.168.2.5
May 8, 2024 17:49:47.808618069 CEST	49715	443	192.168.2.5	142.251.215.228
May 8, 2024 17:49:47.809082985 CEST	49715	443	192.168.2.5	142.251.215.228
May 8, 2024 17:49:47.809112072 CEST	443	49715	142.251.215.228	192.168.2.5
May 8, 2024 17:49:47.938560963 CEST	49675	443	192.168.2.5	23.1.237.91
May 8, 2024 17:49:47.938839912 CEST	49674	443	192.168.2.5	23.1.237.91
May 8, 2024 17:49:48.049510002 CEST	49673	443	192.168.2.5	23.1.237.91
May 8, 2024 17:49:48.080359936 CEST	443	49714	104.16.240.248	192.168.2.5
May 8, 2024 17:49:48.089128017 CEST	49714	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:48.089154005 CEST	443	49714	104.16.240.248	192.168.2.5
May 8, 2024 17:49:48.089451075 CEST	443	49714	104.16.240.248	192.168.2.5
May 8, 2024 17:49:48.112400055 CEST	49714	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:48.112471104 CEST	443	49714	104.16.240.248	192.168.2.5
May 8, 2024 17:49:48.113075972 CEST	49714	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:48.148211002 CEST	443	49715	142.251.215.228	192.168.2.5
May 8, 2024 17:49:48.160113096 CEST	443	49714	104.16.240.248	192.168.2.5
May 8, 2024 17:49:48.175712109 CEST	49715	443	192.168.2.5	142.251.215.228
May 8, 2024 17:49:48.175725937 CEST	443	49715	142.251.215.228	192.168.2.5
May 8, 2024 17:49:48.176603079 CEST	443	49715	142.251.215.228	192.168.2.5
May 8, 2024 17:49:48.176672935 CEST	49715	443	192.168.2.5	142.251.215.228
May 8, 2024 17:49:48.208276987 CEST	49715	443	192.168.2.5	142.251.215.228
May 8, 2024 17:49:48.208348036 CEST	443	49715	142.251.215.228	192.168.2.5
May 8, 2024 17:49:48.251497984 CEST	49715	443	192.168.2.5	142.251.215.228
May 8, 2024 17:49:48.251508951 CEST	443	49715	142.251.215.228	192.168.2.5
May 8, 2024 17:49:48.298748016 CEST	49715	443	192.168.2.5	142.251.215.228
May 8, 2024 17:49:48.487210989 CEST	443	49714	104.16.240.248	192.168.2.5
May 8, 2024 17:49:48.487288952 CEST	443	49714	104.16.240.248	192.168.2.5
May 8, 2024 17:49:48.487417936 CEST	49714	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:48.494980097 CEST	49714	443	192.168.2.5	104.16.240.248
May 8, 2024 17:49:48.495012045 CEST	443	49714	104.16.240.248	192.168.2.5
May 8, 2024 17:49:48.614324093 CEST	49718	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:48.614372015 CEST	443	49718	96.7.158.101	192.168.2.5
May 8, 2024 17:49:48.614434004 CEST	49718	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:48.617108107 CEST	49718	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:48.617124081 CEST	443	49718	96.7.158.101	192.168.2.5
May 8, 2024 17:49:48.949389935 CEST	443	49718	96.7.158.101	192.168.2.5
May 8, 2024 17:49:48.949470997 CEST	49718	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:48.953984976 CEST	49718	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:48.953993082 CEST	443	49718	96.7.158.101	192.168.2.5
May 8, 2024 17:49:48.954202890 CEST	443	49718	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.006483078 CEST	49718	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.011292934 CEST	49718	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.056126118 CEST	443	49718	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.280828953 CEST	443	49718	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.280889034 CEST	443	49718	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.280956984 CEST	49718	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.281088114 CEST	49718	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.281102896 CEST	443	49718	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.281119108 CEST	49718	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.281125069 CEST	443	49718	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.309448004 CEST	49719	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.309485912 CEST	443	49719	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.309714079 CEST	49719	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.310066938 CEST	49719	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.310081005 CEST	443	49719	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.486504078 CEST	443	49703	23.1.237.91	192.168.2.5
May 8, 2024 17:49:49.486613035 CEST	49703	443	192.168.2.5	23.1.237.91
May 8, 2024 17:49:49.603338003 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:49.603362083 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:49.603430986 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:49.604468107 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:49.604479074 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:49.637995005 CEST	443	49719	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.638078928 CEST	49719	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.641211987 CEST	49719	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.641222954 CEST	443	49719	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.641428947 CEST	443	49719	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.646641016 CEST	49719	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.688127995 CEST	443	49719	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.983021975 CEST	443	49719	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.983102083 CEST	443	49719	96.7.158.101	192.168.2.5
May 8, 2024 17:49:49.983160973 CEST	49719	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.988782883 CEST	49719	443	192.168.2.5	96.7.158.101
May 8, 2024 17:49:49.988810062 CEST	443	49719	96.7.158.101	192.168.2.5
May 8, 2024 17:49:50.154320955 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.154690981 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.154706955 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.155543089 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.155622005 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.165066957 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.165122032 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.165498018 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.165510893 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.206568003 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.515805006 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.516271114 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.516278982 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.516293049 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.516315937 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.516330004 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.516345978 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.516354084 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.516385078 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.516396046 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.516428947 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.516460896 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.696513891 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.696528912 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.696626902 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.696640015 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.696676016 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.696682930 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.696696043 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.696748972 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.696754932 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.696808100 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.697043896 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.697058916 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.697101116 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.697105885 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.697129965 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.697148085 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.733407974 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.733427048 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.733516932 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.733530998 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.733594894 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.733620882 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.877145052 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.877167940 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.877229929 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.877243996 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.877278090 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.877296925 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.877448082 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.877463102 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.877526999 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.877557039 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.877578974 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.877593994 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.877597094 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.877608061 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:50.877631903 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.877664089 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.878113031 CEST	49720	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:50.878130913 CEST	443	49720	152.199.4.44	192.168.2.5
May 8, 2024 17:49:51.382149935 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:51.382160902 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:51.382224083 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:51.386244059 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:51.386254072 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:51.931766987 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:51.934384108 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:51.934403896 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:51.935375929 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:51.935451031 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:52.201802015 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:52.201885939 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:52.252751112 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:52.252760887 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:52.295433998 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.004429102 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.004467964 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.004528999 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.004827023 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.004842043 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.349760056 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.349783897 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.350018024 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.350421906 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.350440025 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.350617886 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.351052999 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.351070881 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.356720924 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.356734991 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.550873995 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.552516937 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.552539110 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.552831888 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.553319931 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.553375959 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.553725004 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.596116066 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.900163889 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.906620026 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.914992094 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.915220976 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.915234089 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.915326118 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.915349960 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.915378094 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.915396929 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.915402889 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.915410042 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:53.915422916 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.915448904 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.945308924 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:53.961287975 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.096009016 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.096024036 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.096112967 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.096121073 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.096133947 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.096152067 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.096198082 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.096210957 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.096223116 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.096250057 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.096366882 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.096381903 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.096429110 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.096436977 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.096472979 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.141448975 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.141462088 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.141572952 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.141593933 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.141633034 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.278810978 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.278853893 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.278882027 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.278915882 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.278990984 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.583863974 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.584278107 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.584304094 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.584589005 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.584610939 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.584970951 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.585486889 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.585496902 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.585537910 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.588459969 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.588519096 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.589082956 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.589158058 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.590326071 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.590446949 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.590454102 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.622797966 CEST	49725	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.622816086 CEST	443	49725	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.632128000 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.642708063 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.776571035 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.776961088 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.777215958 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.777229071 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.777247906 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.777276993 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.777296066 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.777327061 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.777342081 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.777343035 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.777375937 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.777375937 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.777390003 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.777404070 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.777441025 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.817277908 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.957148075 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.957170010 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.957199097 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.957214117 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.957222939 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.957261086 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.957284927 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.957299948 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.957947969 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.957956076 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.957966089 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.957998991 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.958004951 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.958009958 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.958034039 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.958034992 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.958055019 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.958081961 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.958105087 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.958127975 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.958169937 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.958332062 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.958345890 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.958395004 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.958401918 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.958441019 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.958513975 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.958529949 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.958616018 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:54.958622932 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:54.958655119 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.137901068 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.137927055 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.137979031 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.137991905 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.138097048 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.138106108 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.138180971 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.138186932 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.138199091 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.138247013 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.138247013 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.138715029 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.138741016 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.138777018 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.138803959 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.138818026 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.138864040 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.139305115 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.139324903 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.139360905 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.139368057 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.139398098 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.139416933 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.139431000 CEST	49728	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.139446974 CEST	443	49728	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.139720917 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.139736891 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.139770985 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.139780045 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.139805079 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.139826059 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.139971972 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.139986992 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140045881 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140053034 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140085936 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140161991 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140177011 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140217066 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140223980 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140249968 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140263081 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140295029 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140309095 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140341997 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140348911 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140372992 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140387058 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140594006 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140609980 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140646935 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140654087 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140676975 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140696049 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140738964 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140754938 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140791893 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140799046 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.140825033 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.140850067 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.142458916 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.319634914 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.319654942 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.319713116 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.319742918 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.319781065 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.319865942 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.319880009 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.319921017 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.319927931 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.319962978 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.320110083 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.320127010 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.320192099 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.320199966 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.320293903 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.320312977 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.320328951 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.320364952 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.320373058 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.320406914 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.320550919 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.320565939 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.320709944 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.320718050 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.320744991 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.320775986 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.320790052 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.320831060 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.320837975 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.320868969 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.321017027 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321031094 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321073055 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.321079969 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321111917 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.321306944 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321321011 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321357965 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.321363926 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321387053 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321397066 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.321405888 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321415901 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321424961 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.321459055 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.321618080 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321631908 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321662903 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.321669102 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321712971 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.321712971 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.321778059 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321794987 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321820974 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.321827888 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.321850061 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.321866989 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.322027922 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.322042942 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.322078943 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.322084904 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.322094917 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.322112083 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.322114944 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.322122097 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.322161913 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.322189093 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.322220087 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.322233915 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.322258949 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.322263956 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.322271109 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.322293043 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.322314978 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.322319984 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.322360039 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.323864937 CEST	49727	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.323884964 CEST	443	49727	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.369628906 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.414489031 CEST	49730	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.414520025 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.414578915 CEST	49730	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.414911985 CEST	49730	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.414926052 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.416106939 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.551979065 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552402973 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552411079 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552445889 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552452087 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552458048 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552469969 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.552484035 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552491903 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552498102 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552505016 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552514076 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552516937 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.552530050 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552542925 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552545071 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.552556992 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.552563906 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.552587032 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.595113993 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.732876062 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.732883930 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.732929945 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.732964993 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.732978106 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.733021975 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.733035088 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.733124018 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.733139992 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.733186960 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.733191967 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.733213902 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.733243942 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.733416080 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.733429909 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.733500957 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.733505964 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.733546019 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.776825905 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.776854038 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.776917934 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.776932001 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.776979923 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.913672924 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.913687944 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.913773060 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.913780928 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.913815975 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.913989067 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914005041 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914081097 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.914082050 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914092064 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914132118 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914135933 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.914155960 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914196968 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.914282084 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914297104 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914334059 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.914338112 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914352894 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.914378881 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.914571047 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914586067 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914639950 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.914644957 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914674044 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.914695978 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.914845943 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914860010 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.914910078 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.914921999 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.915041924 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.915059090 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.915103912 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.915108919 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.915147066 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.915152073 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.915242910 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.915249109 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.915277004 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.915301085 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.915309906 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.915349007 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.920789003 CEST	49722	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.920798063 CEST	443	49722	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.960634947 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.966027975 CEST	49730	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.966041088 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.966327906 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.966684103 CEST	49730	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.966739893 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.966862917 CEST	49730	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.968317032 CEST	49731	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.968363047 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.968604088 CEST	49731	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.968924999 CEST	49732	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.968945980 CEST	443	49732	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.971247911 CEST	49732	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.982090950 CEST	49733	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.982115984 CEST	443	49733	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.982300043 CEST	49733	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.982455015 CEST	49731	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.982472897 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.984350920 CEST	49733	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.984376907 CEST	443	49733	152.199.4.44	192.168.2.5
May 8, 2024 17:49:55.984669924 CEST	49732	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:55.984684944 CEST	443	49732	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.012111902 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.322925091 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.323194027 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.323210955 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.323261023 CEST	49730	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.323275089 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.323297024 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.323299885 CEST	49730	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.323322058 CEST	49730	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.323358059 CEST	49730	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.323929071 CEST	49730	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.323951006 CEST	443	49730	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.494884014 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.494904041 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.495011091 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.495223999 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.495234966 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.528033018 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.528332949 CEST	49731	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.528361082 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.528640985 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.528980970 CEST	49731	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.529050112 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.529118061 CEST	49731	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.530530930 CEST	443	49733	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.530718088 CEST	49733	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.530731916 CEST	443	49733	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.530829906 CEST	443	49732	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.530983925 CEST	49732	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.530997992 CEST	443	49732	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.531007051 CEST	443	49733	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.531269073 CEST	49733	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.531322956 CEST	443	49733	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.531372070 CEST	49733	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.531886101 CEST	443	49732	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.531960011 CEST	49732	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.533797979 CEST	49732	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.533853054 CEST	443	49732	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.534178972 CEST	49732	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.572120905 CEST	443	49733	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.576117992 CEST	443	49732	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.576122046 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.579633951 CEST	49731	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.579658985 CEST	49732	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.579659939 CEST	49733	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.579672098 CEST	443	49732	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.627332926 CEST	49732	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.891850948 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.891932964 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.891941071 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.891957998 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.891963959 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.891973972 CEST	49731	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.891995907 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.892004967 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.892034054 CEST	49731	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.892060995 CEST	49731	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.892303944 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.892347097 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.892404079 CEST	49731	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.893261909 CEST	443	49732	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.893481016 CEST	443	49732	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.893532038 CEST	443	49732	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.893532991 CEST	49732	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.893568993 CEST	49732	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.894186020 CEST	49731	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.894200087 CEST	443	49731	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.899090052 CEST	49732	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.899104118 CEST	443	49732	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.901396036 CEST	443	49733	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.901432037 CEST	443	49733	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.901477098 CEST	443	49733	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.901525974 CEST	49733	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.915576935 CEST	49733	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.915585995 CEST	443	49733	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.936769962 CEST	49735	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.936809063 CEST	443	49735	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.936939001 CEST	49735	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.937235117 CEST	49735	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.937249899 CEST	443	49735	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.939424992 CEST	49736	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.939450979 CEST	443	49736	152.199.4.44	192.168.2.5
May 8, 2024 17:49:56.939588070 CEST	49736	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.939925909 CEST	49736	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:56.939941883 CEST	443	49736	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.040713072 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.041034937 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.041054964 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.041899920 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.041961908 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.042340994 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.042393923 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.042570114 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.042582035 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.083942890 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.098841906 CEST	49737	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.098865986 CEST	443	49737	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.099015951 CEST	49737	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.099365950 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.099395037 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.099570990 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.100029945 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.100043058 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.100461006 CEST	49737	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.100472927 CEST	443	49737	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.161582947 CEST	49739	443	192.168.2.5	20.190.151.70
May 8, 2024 17:49:57.161614895 CEST	443	49739	20.190.151.70	192.168.2.5
May 8, 2024 17:49:57.161782026 CEST	49739	443	192.168.2.5	20.190.151.70
May 8, 2024 17:49:57.162033081 CEST	49739	443	192.168.2.5	20.190.151.70
May 8, 2024 17:49:57.162043095 CEST	443	49739	20.190.151.70	192.168.2.5
May 8, 2024 17:49:57.404258966 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.404540062 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.404546976 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.404557943 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.404582024 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.404620886 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.404638052 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.404649019 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.404655933 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.404700994 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.404721975 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.405668020 CEST	49734	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.405678034 CEST	443	49734	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.482932091 CEST	443	49735	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.483252048 CEST	49735	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.483278990 CEST	443	49735	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.484210968 CEST	443	49735	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.484271049 CEST	49735	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.484633923 CEST	49735	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.484690905 CEST	443	49735	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.484801054 CEST	49735	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.484808922 CEST	443	49735	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.485946894 CEST	443	49736	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.486171961 CEST	49736	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.486185074 CEST	443	49736	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.487060070 CEST	443	49736	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.487159967 CEST	49736	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.487797976 CEST	49736	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.487853050 CEST	443	49736	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.488054991 CEST	49736	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.488063097 CEST	443	49736	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.532792091 CEST	49736	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.532932997 CEST	49735	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.617563963 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.617846012 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.617863894 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.618881941 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.618947029 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.620114088 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.620194912 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.620403051 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.620410919 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.621143103 CEST	443	49737	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.621325016 CEST	49737	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.621335983 CEST	443	49737	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.622210026 CEST	443	49737	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.622272015 CEST	49737	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.622605085 CEST	49737	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.622658014 CEST	443	49737	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.622729063 CEST	49737	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.622735023 CEST	443	49737	13.107.213.70	192.168.2.5
May 8, 2024 17:49:57.674340963 CEST	49737	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.674344063 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:57.845619917 CEST	443	49735	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.845685005 CEST	443	49735	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.845729113 CEST	443	49735	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.845738888 CEST	49735	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.845845938 CEST	49735	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.847786903 CEST	49735	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.847805023 CEST	443	49735	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.848613977 CEST	443	49736	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.848659992 CEST	443	49736	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.848706007 CEST	443	49736	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.848773003 CEST	49736	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.849972010 CEST	49736	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:57.849984884 CEST	443	49736	152.199.4.44	192.168.2.5
May 8, 2024 17:49:57.859833956 CEST	443	49739	20.190.151.70	192.168.2.5
May 8, 2024 17:49:57.860781908 CEST	49739	443	192.168.2.5	20.190.151.70
May 8, 2024 17:49:57.860795021 CEST	443	49739	20.190.151.70	192.168.2.5
May 8, 2024 17:49:57.861814976 CEST	443	49739	20.190.151.70	192.168.2.5
May 8, 2024 17:49:57.861887932 CEST	49739	443	192.168.2.5	20.190.151.70
May 8, 2024 17:49:57.862960100 CEST	49739	443	192.168.2.5	20.190.151.70
May 8, 2024 17:49:57.863008022 CEST	443	49739	20.190.151.70	192.168.2.5
May 8, 2024 17:49:57.863148928 CEST	49739	443	192.168.2.5	20.190.151.70
May 8, 2024 17:49:57.863154888 CEST	443	49739	20.190.151.70	192.168.2.5
May 8, 2024 17:49:57.907943964 CEST	49739	443	192.168.2.5	20.190.151.70
May 8, 2024 17:49:58.141066074 CEST	443	49715	142.251.215.228	192.168.2.5
May 8, 2024 17:49:58.141112089 CEST	443	49715	142.251.215.228	192.168.2.5
May 8, 2024 17:49:58.141315937 CEST	49715	443	192.168.2.5	142.251.215.228
May 8, 2024 17:49:58.645674944 CEST	443	49739	20.190.151.70	192.168.2.5
May 8, 2024 17:49:58.645764112 CEST	443	49739	20.190.151.70	192.168.2.5
May 8, 2024 17:49:58.645829916 CEST	49739	443	192.168.2.5	20.190.151.70
May 8, 2024 17:49:58.677598000 CEST	443	49737	13.107.213.70	192.168.2.5
May 8, 2024 17:49:58.677618980 CEST	443	49737	13.107.213.70	192.168.2.5
May 8, 2024 17:49:58.677633047 CEST	443	49737	13.107.213.70	192.168.2.5
May 8, 2024 17:49:58.677699089 CEST	443	49737	13.107.213.70	192.168.2.5
May 8, 2024 17:49:58.677704096 CEST	49737	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:58.677752018 CEST	49737	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:58.687298059 CEST	49739	443	192.168.2.5	20.190.151.70
May 8, 2024 17:49:58.687318087 CEST	443	49739	20.190.151.70	192.168.2.5
May 8, 2024 17:49:58.691658974 CEST	49737	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:58.691673994 CEST	443	49737	13.107.213.70	192.168.2.5
May 8, 2024 17:49:58.693533897 CEST	49715	443	192.168.2.5	142.251.215.228
May 8, 2024 17:49:58.693547010 CEST	443	49715	142.251.215.228	192.168.2.5
May 8, 2024 17:49:58.869786024 CEST	49743	443	192.168.2.5	13.107.246.70
May 8, 2024 17:49:58.869821072 CEST	443	49743	13.107.246.70	192.168.2.5
May 8, 2024 17:49:58.869898081 CEST	49743	443	192.168.2.5	13.107.246.70
May 8, 2024 17:49:58.870162964 CEST	49743	443	192.168.2.5	13.107.246.70
May 8, 2024 17:49:58.870177031 CEST	443	49743	13.107.246.70	192.168.2.5
May 8, 2024 17:49:59.155196905 CEST	49744	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:59.155221939 CEST	443	49744	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.155368090 CEST	49744	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:59.156014919 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:59.156039953 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.156090975 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:59.156323910 CEST	49744	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:59.156332016 CEST	443	49744	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.156502962 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:59.156514883 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.376406908 CEST	443	49743	13.107.246.70	192.168.2.5
May 8, 2024 17:49:59.379256964 CEST	49743	443	192.168.2.5	13.107.246.70
May 8, 2024 17:49:59.379276037 CEST	443	49743	13.107.246.70	192.168.2.5
May 8, 2024 17:49:59.380621910 CEST	443	49743	13.107.246.70	192.168.2.5
May 8, 2024 17:49:59.380686998 CEST	49743	443	192.168.2.5	13.107.246.70
May 8, 2024 17:49:59.387989998 CEST	49743	443	192.168.2.5	13.107.246.70
May 8, 2024 17:49:59.388072968 CEST	443	49743	13.107.246.70	192.168.2.5
May 8, 2024 17:49:59.388231039 CEST	49743	443	192.168.2.5	13.107.246.70
May 8, 2024 17:49:59.388238907 CEST	443	49743	13.107.246.70	192.168.2.5
May 8, 2024 17:49:59.438824892 CEST	49743	443	192.168.2.5	13.107.246.70
May 8, 2024 17:49:59.493582964 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.493607998 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.493614912 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.493654013 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.493665934 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.493669033 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.493679047 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.493696928 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.493716002 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.493737936 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.494868994 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.494887114 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.494940996 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.494949102 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.494986057 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.665993929 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.666018009 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.666153908 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.666177988 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.667053938 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.667073965 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.667139053 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.667156935 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.667171955 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.667201042 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.668323040 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.668339968 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.668420076 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.668428898 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.671658993 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.705302000 CEST	443	49744	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.705486059 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.705907106 CEST	49744	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:59.705919981 CEST	443	49744	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.706105947 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:59.706125975 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.706223965 CEST	443	49744	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.706439018 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.707027912 CEST	49744	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:59.707075119 CEST	443	49744	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.707547903 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:59.707602978 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.707746029 CEST	49744	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:59.707824945 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:49:59.715962887 CEST	443	49743	13.107.246.70	192.168.2.5
May 8, 2024 17:49:59.715981960 CEST	443	49743	13.107.246.70	192.168.2.5
May 8, 2024 17:49:59.715989113 CEST	443	49743	13.107.246.70	192.168.2.5
May 8, 2024 17:49:59.716063023 CEST	49743	443	192.168.2.5	13.107.246.70
May 8, 2024 17:49:59.716074944 CEST	443	49743	13.107.246.70	192.168.2.5
May 8, 2024 17:49:59.716450930 CEST	49743	443	192.168.2.5	13.107.246.70
May 8, 2024 17:49:59.720182896 CEST	49743	443	192.168.2.5	13.107.246.70
May 8, 2024 17:49:59.720199108 CEST	443	49743	13.107.246.70	192.168.2.5
May 8, 2024 17:49:59.752118111 CEST	443	49744	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.752124071 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:49:59.828164101 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.828188896 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.828255892 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.828268051 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.828310966 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.832135916 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.832154036 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.832238913 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.832247972 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.832289934 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.833209038 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.833225012 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.833286047 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.833292961 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.833326101 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.833842039 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.833858013 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.833899975 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.833905935 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.833925962 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.833950996 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.835187912 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.835203886 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.835258961 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.835266113 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.835321903 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.836682081 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.836699963 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.836750031 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.836757898 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.836776972 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.836802006 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.994016886 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.994043112 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.994123936 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.994137049 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.994175911 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.997345924 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.997363091 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.997428894 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.997436047 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.997658968 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.998961926 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.998979092 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.999053955 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.999061108 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:49:59.999201059 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:49:59.999974966 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:50:00.000039101 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:50:00.000050068 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:50:00.000056028 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:50:00.000071049 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:50:00.000082970 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:50:00.000094891 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:50:00.000127077 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:50:00.000458956 CEST	49738	443	192.168.2.5	13.107.213.70
May 8, 2024 17:50:00.000468016 CEST	443	49738	13.107.213.70	192.168.2.5
May 8, 2024 17:50:00.009200096 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:00.009219885 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:00.009290934 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:00.009572029 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:00.009581089 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:00.067605972 CEST	443	49744	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.067645073 CEST	443	49744	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.067729950 CEST	443	49744	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.067775965 CEST	49744	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.068490982 CEST	49744	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.068499088 CEST	443	49744	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.068866014 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.069072962 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.069087982 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.069132090 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.069143057 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.069170952 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.069195032 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.069200039 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.069235086 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.069384098 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.069411993 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.069566965 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.069572926 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.069605112 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.069627047 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.081356049 CEST	49753	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.081381083 CEST	443	49753	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.081489086 CEST	49753	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.081692934 CEST	49753	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.081701994 CEST	443	49753	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.249630928 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.249648094 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.249774933 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.249783993 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.249829054 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.249902010 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.249917030 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.249969959 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.249974966 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.250014067 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.250186920 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.250201941 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.250257015 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.250262976 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.250308037 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.294853926 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.294869900 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.294965029 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.294972897 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.295017004 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.431813002 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.431855917 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.431874037 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.431886911 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.431943893 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.433415890 CEST	49745	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.433425903 CEST	443	49745	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.472290039 CEST	49703	443	192.168.2.5	23.1.237.91
May 8, 2024 17:50:00.472453117 CEST	49703	443	192.168.2.5	23.1.237.91
May 8, 2024 17:50:00.479581118 CEST	49755	443	192.168.2.5	23.1.237.91
May 8, 2024 17:50:00.479604006 CEST	443	49755	23.1.237.91	192.168.2.5
May 8, 2024 17:50:00.479715109 CEST	49755	443	192.168.2.5	23.1.237.91
May 8, 2024 17:50:00.482925892 CEST	49755	443	192.168.2.5	23.1.237.91
May 8, 2024 17:50:00.482942104 CEST	443	49755	23.1.237.91	192.168.2.5
May 8, 2024 17:50:00.630661964 CEST	443	49753	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.630925894 CEST	49753	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.630938053 CEST	443	49753	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.631251097 CEST	443	49753	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.631652117 CEST	49753	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.631707907 CEST	443	49753	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.631860018 CEST	49753	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.654778004 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:00.655137062 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:00.655157089 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:00.655481100 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:00.655956030 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:00.656012058 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:00.656116009 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:00.664570093 CEST	443	49703	23.1.237.91	192.168.2.5
May 8, 2024 17:50:00.664582968 CEST	443	49703	23.1.237.91	192.168.2.5
May 8, 2024 17:50:00.672120094 CEST	443	49753	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.700113058 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:00.703773975 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:00.872786045 CEST	443	49755	23.1.237.91	192.168.2.5
May 8, 2024 17:50:00.872857094 CEST	49755	443	192.168.2.5	23.1.237.91
May 8, 2024 17:50:00.996257067 CEST	443	49753	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.996288061 CEST	443	49753	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.996332884 CEST	443	49753	152.199.4.44	192.168.2.5
May 8, 2024 17:50:00.996336937 CEST	49753	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.996383905 CEST	49753	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.997735023 CEST	49753	443	192.168.2.5	152.199.4.44
May 8, 2024 17:50:00.997744083 CEST	443	49753	152.199.4.44	192.168.2.5
May 8, 2024 17:50:01.181644917 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.181663990 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.181673050 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.181699991 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.181727886 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.181740046 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.181746006 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.181766987 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.181792021 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.182286978 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.182317972 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.182359934 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.182364941 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.182384968 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.182404995 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.348819971 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.348838091 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.348911047 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.348921061 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.348953009 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.349240065 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.349256992 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.349298954 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.349303961 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.349320889 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.349348068 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.357213020 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.357228994 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.357290030 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.357295036 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.357338905 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.517210960 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.517234087 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.517287016 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.517304897 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.517318010 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.518155098 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.518174887 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.518208027 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.518213034 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.518239021 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.518271923 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.519855976 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.519870996 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.519922972 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.519927979 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.519964933 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.520858049 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.520874023 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.520912886 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.520916939 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.520941973 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.520967960 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.522268057 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.522284031 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.522346020 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.522351027 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.522388935 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.554560900 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.554575920 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.554645061 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.554662943 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.554703951 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.555859089 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.555874109 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.555912018 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.555917025 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.555944920 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.555964947 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.558440924 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.683257103 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.683271885 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.683339119 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.683353901 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.683394909 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.684590101 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.684612989 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.684688091 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.684694052 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.684721947 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.685794115 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.685827017 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.685847044 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.685851097 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:01.685902119 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.689531088 CEST	49749	443	192.168.2.5	13.107.246.70
May 8, 2024 17:50:01.689542055 CEST	443	49749	13.107.246.70	192.168.2.5
May 8, 2024 17:50:20.059119940 CEST	443	49755	23.1.237.91	192.168.2.5
May 8, 2024 17:50:20.059211969 CEST	49755	443	192.168.2.5	23.1.237.91
May 8, 2024 17:50:30.390821934 CEST	49710	80	192.168.2.5	15.197.142.173
May 8, 2024 17:50:30.552954912 CEST	80	49710	15.197.142.173	192.168.2.5
May 8, 2024 17:50:30.719218969 CEST	49709	80	192.168.2.5	15.197.142.173
May 8, 2024 17:50:30.881436110 CEST	80	49709	15.197.142.173	192.168.2.5
May 8, 2024 17:50:45.554075956 CEST	80	49710	15.197.142.173	192.168.2.5
May 8, 2024 17:50:45.554151058 CEST	49710	80	192.168.2.5	15.197.142.173
May 8, 2024 17:50:45.664756060 CEST	49710	80	192.168.2.5	15.197.142.173
May 8, 2024 17:50:45.720139027 CEST	80	49709	15.197.142.173	192.168.2.5
May 8, 2024 17:50:45.720213890 CEST	49709	80	192.168.2.5	15.197.142.173
May 8, 2024 17:50:45.826884985 CEST	80	49710	15.197.142.173	192.168.2.5
May 8, 2024 17:50:47.034018040 CEST	49709	80	192.168.2.5	15.197.142.173
May 8, 2024 17:50:47.034564972 CEST	49760	443	192.168.2.5	142.251.215.228
May 8, 2024 17:50:47.034589052 CEST	443	49760	142.251.215.228	192.168.2.5
May 8, 2024 17:50:47.034738064 CEST	49760	443	192.168.2.5	142.251.215.228
May 8, 2024 17:50:47.035074949 CEST	49760	443	192.168.2.5	142.251.215.228
May 8, 2024 17:50:47.035088062 CEST	443	49760	142.251.215.228	192.168.2.5
May 8, 2024 17:50:47.196141958 CEST	80	49709	15.197.142.173	192.168.2.5
May 8, 2024 17:50:47.369878054 CEST	443	49760	142.251.215.228	192.168.2.5
May 8, 2024 17:50:47.373752117 CEST	49760	443	192.168.2.5	142.251.215.228
May 8, 2024 17:50:47.373765945 CEST	443	49760	142.251.215.228	192.168.2.5
May 8, 2024 17:50:47.374082088 CEST	443	49760	142.251.215.228	192.168.2.5
May 8, 2024 17:50:47.374545097 CEST	49760	443	192.168.2.5	142.251.215.228
May 8, 2024 17:50:47.374600887 CEST	443	49760	142.251.215.228	192.168.2.5
May 8, 2024 17:50:47.438204050 CEST	49760	443	192.168.2.5	142.251.215.228
May 8, 2024 17:50:57.379746914 CEST	443	49760	142.251.215.228	192.168.2.5
May 8, 2024 17:50:57.379815102 CEST	443	49760	142.251.215.228	192.168.2.5
May 8, 2024 17:50:57.379961967 CEST	49760	443	192.168.2.5	142.251.215.228
May 8, 2024 17:50:57.565370083 CEST	49760	443	192.168.2.5	142.251.215.228
May 8, 2024 17:50:57.565401077 CEST	443	49760	142.251.215.228	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 8, 2024 17:49:43.348479986 CEST	53	59333	1.1.1.1	192.168.2.5
May 8, 2024 17:49:43.349474907 CEST	53	58293	1.1.1.1	192.168.2.5
May 8, 2024 17:49:44.268258095 CEST	53	64191	1.1.1.1	192.168.2.5
May 8, 2024 17:49:44.924949884 CEST	61892	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:44.925107002 CEST	60865	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:45.129364967 CEST	53	61892	1.1.1.1	192.168.2.5
May 8, 2024 17:49:45.235110998 CEST	53	60865	1.1.1.1	192.168.2.5
May 8, 2024 17:49:45.722263098 CEST	59133	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:45.722562075 CEST	61086	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:45.888253927 CEST	53	61086	1.1.1.1	192.168.2.5
May 8, 2024 17:49:45.888426065 CEST	53	59133	1.1.1.1	192.168.2.5
May 8, 2024 17:49:47.637181044 CEST	63340	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:47.637387991 CEST	57405	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:47.650223970 CEST	60840	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:47.650677919 CEST	61333	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:47.800398111 CEST	53	57405	1.1.1.1	192.168.2.5
May 8, 2024 17:49:47.800983906 CEST	53	63340	1.1.1.1	192.168.2.5
May 8, 2024 17:49:49.374408007 CEST	64313	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:49.374881029 CEST	54124	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:49.537173986 CEST	53	64313	1.1.1.1	192.168.2.5
May 8, 2024 17:49:49.538587093 CEST	53	54124	1.1.1.1	192.168.2.5
May 8, 2024 17:49:52.466541052 CEST	51623	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:52.467032909 CEST	58534	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:56.330178022 CEST	60689	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:56.330471039 CEST	53050	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:56.493427038 CEST	53	60689	1.1.1.1	192.168.2.5
May 8, 2024 17:49:56.494389057 CEST	53	53050	1.1.1.1	192.168.2.5
May 8, 2024 17:49:56.932020903 CEST	57780	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:56.932425022 CEST	64258	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:56.995069981 CEST	49944	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:56.995228052 CEST	61625	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:57.159147978 CEST	53	49944	1.1.1.1	192.168.2.5
May 8, 2024 17:49:57.161062956 CEST	53	61625	1.1.1.1	192.168.2.5
May 8, 2024 17:49:58.697715044 CEST	50166	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:58.697933912 CEST	63912	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:59.322108984 CEST	53	51632	1.1.1.1	192.168.2.5
May 8, 2024 17:49:59.887098074 CEST	55572	53	192.168.2.5	1.1.1.1
May 8, 2024 17:49:59.887321949 CEST	49987	53	192.168.2.5	1.1.1.1
May 8, 2024 17:50:01.245934963 CEST	53	55489	1.1.1.1	192.168.2.5
May 8, 2024 17:50:20.011288881 CEST	53	58475	1.1.1.1	192.168.2.5
May 8, 2024 17:50:42.565320015 CEST	53	60291	1.1.1.1	192.168.2.5
May 8, 2024 17:50:43.028460026 CEST	53	61426	1.1.1.1	192.168.2.5
May 8, 2024 17:50:53.215981007 CEST	52176	53	192.168.2.5	1.1.1.1
May 8, 2024 17:50:53.216312885 CEST	51098	53	192.168.2.5	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 8, 2024 17:49:45.235208035 CEST	192.168.2.5	1.1.1.1	c234	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 8, 2024 17:49:44.924949884 CEST	192.168.2.5	1.1.1.1	0xd195	Standard query (0)	replicon.coverys.co.uk	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:44.925107002 CEST	192.168.2.5	1.1.1.1	0x17a8	Standard query (0)	replicon.coverys.co.uk	65	IN (0x0001)	false
May 8, 2024 17:49:45.722263098 CEST	192.168.2.5	1.1.1.1	0x40b7	Standard query (0)	global.replicon.com	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:45.722562075 CEST	192.168.2.5	1.1.1.1	0xf6ce	Standard query (0)	global.replicon.com	65	IN (0x0001)	false
May 8, 2024 17:49:47.637181044 CEST	192.168.2.5	1.1.1.1	0x1b62	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:47.637387991 CEST	192.168.2.5	1.1.1.1	0x2038	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 8, 2024 17:49:47.650223970 CEST	192.168.2.5	1.1.1.1	0x2aed	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:47.650677919 CEST	192.168.2.5	1.1.1.1	0x15d4	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
May 8, 2024 17:49:49.374408007 CEST	192.168.2.5	1.1.1.1	0xf215	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:49.374881029 CEST	192.168.2.5	1.1.1.1	0x9d57	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
May 8, 2024 17:49:52.466541052 CEST	192.168.2.5	1.1.1.1	0x9e1f	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:52.467032909 CEST	192.168.2.5	1.1.1.1	0x6929	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
May 8, 2024 17:49:56.330178022 CEST	192.168.2.5	1.1.1.1	0xe98d	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:56.330471039 CEST	192.168.2.5	1.1.1.1	0x2cdf	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
May 8, 2024 17:49:56.932020903 CEST	192.168.2.5	1.1.1.1	0xf5e	Standard query (0)	aadcdn.msftauthimages.net	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:56.932425022 CEST	192.168.2.5	1.1.1.1	0x44e7	Standard query (0)	aadcdn.msftauthimages.net	65	IN (0x0001)	false
May 8, 2024 17:49:56.995069981 CEST	192.168.2.5	1.1.1.1	0x8616	Standard query (0)	autologon.microsoftazuread-sso.com	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:56.995228052 CEST	192.168.2.5	1.1.1.1	0x7638	Standard query (0)	autologon.microsoftazuread-sso.com	65	IN (0x0001)	false
May 8, 2024 17:49:58.697715044 CEST	192.168.2.5	1.1.1.1	0xaf51	Standard query (0)	aadcdn.msftauthimages.net	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:58.697933912 CEST	192.168.2.5	1.1.1.1	0x7eef	Standard query (0)	aadcdn.msftauthimages.net	65	IN (0x0001)	false
May 8, 2024 17:49:59.887098074 CEST	192.168.2.5	1.1.1.1	0xac	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:59.887321949 CEST	192.168.2.5	1.1.1.1	0x2f6a	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
May 8, 2024 17:50:53.215981007 CEST	192.168.2.5	1.1.1.1	0x3309	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
May 8, 2024 17:50:53.216312885 CEST	192.168.2.5	1.1.1.1	0x6aa8	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 8, 2024 17:49:45.129364967 CEST	1.1.1.1	192.168.2.5	0xd195	No error (0)	replicon.coverys.co.uk		15.197.142.173	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:45.129364967 CEST	1.1.1.1	192.168.2.5	0xd195	No error (0)	replicon.coverys.co.uk		3.33.152.147	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:45.888253927 CEST	1.1.1.1	192.168.2.5	0xf6ce	No error (0)	global.replicon.com			65	IN (0x0001)	false
May 8, 2024 17:49:45.888426065 CEST	1.1.1.1	192.168.2.5	0x40b7	No error (0)	global.replicon.com		104.16.240.248	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:45.888426065 CEST	1.1.1.1	192.168.2.5	0x40b7	No error (0)	global.replicon.com		104.16.241.248	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:47.800398111 CEST	1.1.1.1	192.168.2.5	0x2038	No error (0)	www.google.com			65	IN (0x0001)	false
May 8, 2024 17:49:47.800983906 CEST	1.1.1.1	192.168.2.5	0x1b62	No error (0)	www.google.com		142.251.215.228	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:47.813621998 CEST	1.1.1.1	192.168.2.5	0x2aed	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:47.813808918 CEST	1.1.1.1	192.168.2.5	0x15d4	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:49.537173986 CEST	1.1.1.1	192.168.2.5	0xf215	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:49.537173986 CEST	1.1.1.1	192.168.2.5	0xf215	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:49.538587093 CEST	1.1.1.1	192.168.2.5	0x9d57	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:52.630865097 CEST	1.1.1.1	192.168.2.5	0x6929	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:52.630924940 CEST	1.1.1.1	192.168.2.5	0x9e1f	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:53.163254976 CEST	1.1.1.1	192.168.2.5	0x9908	No error (0)	shed.dual-low.part-0042.t-0009.t-msedge.net	part-0042.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:53.163254976 CEST	1.1.1.1	192.168.2.5	0x9908	No error (0)	part-0042.t-0009.t-msedge.net		13.107.213.70	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:53.163254976 CEST	1.1.1.1	192.168.2.5	0x9908	No error (0)	part-0042.t-0009.t-msedge.net		13.107.246.70	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:56.493427038 CEST	1.1.1.1	192.168.2.5	0xe98d	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:56.493427038 CEST	1.1.1.1	192.168.2.5	0xe98d	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:56.494389057 CEST	1.1.1.1	192.168.2.5	0x2cdf	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:57.096076965 CEST	1.1.1.1	192.168.2.5	0xf5e	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:57.096076965 CEST	1.1.1.1	192.168.2.5	0xf5e	No error (0)	shed.dual-low.part-0042.t-0009.t-msedge.net	part-0042.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:57.096076965 CEST	1.1.1.1	192.168.2.5	0xf5e	No error (0)	part-0042.t-0009.t-msedge.net		13.107.213.70	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:57.096076965 CEST	1.1.1.1	192.168.2.5	0xf5e	No error (0)	part-0042.t-0009.t-msedge.net		13.107.246.70	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:57.098228931 CEST	1.1.1.1	192.168.2.5	0x44e7	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:57.159147978 CEST	1.1.1.1	192.168.2.5	0x8616	No error (0)	autologon.microsoftazuread-sso.com		20.190.151.70	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:57.159147978 CEST	1.1.1.1	192.168.2.5	0x8616	No error (0)	autologon.microsoftazuread-sso.com		20.190.151.68	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:57.159147978 CEST	1.1.1.1	192.168.2.5	0x8616	No error (0)	autologon.microsoftazuread-sso.com		20.190.151.67	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:57.159147978 CEST	1.1.1.1	192.168.2.5	0x8616	No error (0)	autologon.microsoftazuread-sso.com		20.190.151.6	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:57.159147978 CEST	1.1.1.1	192.168.2.5	0x8616	No error (0)	autologon.microsoftazuread-sso.com		20.190.151.7	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:57.159147978 CEST	1.1.1.1	192.168.2.5	0x8616	No error (0)	autologon.microsoftazuread-sso.com		20.190.151.69	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:57.159147978 CEST	1.1.1.1	192.168.2.5	0x8616	No error (0)	autologon.microsoftazuread-sso.com		20.190.151.133	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:57.159147978 CEST	1.1.1.1	192.168.2.5	0x8616	No error (0)	autologon.microsoftazuread-sso.com		20.190.151.134	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:58.862953901 CEST	1.1.1.1	192.168.2.5	0x7eef	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:58.869083881 CEST	1.1.1.1	192.168.2.5	0xaf51	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:58.869083881 CEST	1.1.1.1	192.168.2.5	0xaf51	No error (0)	shed.dual-low.part-0042.t-0009.t-msedge.net	part-0042.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:49:58.869083881 CEST	1.1.1.1	192.168.2.5	0xaf51	No error (0)	part-0042.t-0009.t-msedge.net		13.107.246.70	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:58.869083881 CEST	1.1.1.1	192.168.2.5	0xaf51	No error (0)	part-0042.t-0009.t-msedge.net		13.107.213.70	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:59.459673882 CEST	1.1.1.1	192.168.2.5	0xfa44	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
May 8, 2024 17:49:59.459673882 CEST	1.1.1.1	192.168.2.5	0xfa44	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
May 8, 2024 17:50:00.050257921 CEST	1.1.1.1	192.168.2.5	0x2f6a	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:50:00.050805092 CEST	1.1.1.1	192.168.2.5	0xac	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:50:00.069387913 CEST	1.1.1.1	192.168.2.5	0xebf1	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:50:00.069387913 CEST	1.1.1.1	192.168.2.5	0xebf1	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
May 8, 2024 17:50:13.259795904 CEST	1.1.1.1	192.168.2.5	0xabca	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:50:13.259795904 CEST	1.1.1.1	192.168.2.5	0xabca	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
May 8, 2024 17:50:35.090342999 CEST	1.1.1.1	192.168.2.5	0x5a50	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:50:35.090342999 CEST	1.1.1.1	192.168.2.5	0x5a50	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
May 8, 2024 17:50:53.379545927 CEST	1.1.1.1	192.168.2.5	0x6aa8	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:50:53.379626989 CEST	1.1.1.1	192.168.2.5	0x3309	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:50:56.539367914 CEST	1.1.1.1	192.168.2.5	0x33	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 17:50:56.539367914 CEST	1.1.1.1	192.168.2.5	0x33	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

global.replicon.com

https:

aadcdn.msftauth.net

aadcdn.msftauthimages.net

autologon.microsoftazuread-sso.com

fs.microsoft.com

replicon.coverys.co.uk

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	15.197.142.173	80	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 17:49:45.375552893 CEST	437	OUT	GET / HTTP/1.1 Host: replicon.coverys.co.uk Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 8, 2024 17:49:45.716085911 CEST	433	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 08 May 2024 15:49:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 87 Connection: keep-alive Location: https://global.replicon.com/!/saml2/Cmal/sp-sso/post Server: ip-10-124-4-191.us-west-2.compute.internal Vary: Accept-Encoding X-Request-Id: abc49874-9543-426f-8828-9d2373221beb Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6c 6f 62 61 6c 2e 72 65 70 6c 69 63 6f 6e 2e 63 6f 6d 2f 21 2f 73 61 6d 6c 32 2f 43 6d 61 6c 2f 73 70 2d 73 73 6f 2f 70 6f 73 74 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://global.replicon.com/!/saml2/Cmal/sp-sso/post">Moved Permanently</a>.
May 8, 2024 17:49:45.923207045 CEST	433	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 08 May 2024 15:49:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 87 Connection: keep-alive Location: https://global.replicon.com/!/saml2/Cmal/sp-sso/post Server: ip-10-124-4-191.us-west-2.compute.internal Vary: Accept-Encoding X-Request-Id: abc49874-9543-426f-8828-9d2373221beb Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6c 6f 62 61 6c 2e 72 65 70 6c 69 63 6f 6e 2e 63 6f 6d 2f 21 2f 73 61 6d 6c 32 2f 43 6d 61 6c 2f 73 70 2d 73 73 6f 2f 70 6f 73 74 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://global.replicon.com/!/saml2/Cmal/sp-sso/post">Moved Permanently</a>.
May 8, 2024 17:50:30.719218969 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	15.197.142.173	80	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 17:50:30.390821934 CEST	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	104.16.240.248	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:46 UTC	686	OUT	GET /!/saml2/Cmal/sp-sso/post HTTP/1.1 Host: global.replicon.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:46 UTC	569	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 15:49:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cache-control: private cf-cache-status: DYNAMIC content-security-policy: frame-ancestors 'self' https://psa-eu1.replicon.com https://ti.replicon.com https://zt.replicon.com; vary: Accept-Encoding x-execution-correlation-id: 437734e6b3b64ce5b29dcf5528737255 x-frame-options: SAMEORIGIN x-frame-options: SAMEORIGIN x-ua-compatible: IE=edge strict-transport-security: max-age=31536000 Server: cloudflare CF-RAY: 880a9a05beb56838-SEA
2024-05-08 15:49:46 UTC	800	IN	Data Raw: 31 35 32 61 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 3c 62 6f 64 79 20 6f 6e 6c 6f 61 64 3d 22 64 6f 63 75 6d 65 6e 74 2e 66 6f 72 6d 73 2e 73 61 6d 6c 66 6f 72 6d 2e 73 75 62 6d 69 74 28 29 22 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 70 3e 3c 73 74 72 6f 6e 67 3e 4e 6f 74 65 3a 3c 2f 73 74 72 6f 6e 67 3e 20 53 69 6e 63 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 4a 61 76 61 73 63 72 69 70 74 2c 20 79 6f 75 20 6d 75 73 74 20 70 72 65 73 73 20 74 68 65 20 43 6f 6e 74 69 6e 75 65 20 62 75 74 74 6f 6e 20 6f 6e 63 65 20 74 6f 20 70 72 6f 63 65 65 64 2e 3c 2f 70 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 66 6f 72 6d 20 69 64 Data Ascii: 152a<html xmlns="http://www.w3.org/1999/xhtml"><body onload="document.forms.samlform.submit()"><noscript><p><strong>Note:</strong> Since your browser does not support Javascript, you must press the Continue button once to proceed.</p></noscript><form id
2024-05-08 15:49:46 UTC	1369	IN	Data Raw: 6e 42 79 62 33 52 76 59 32 39 73 49 6a 34 38 63 32 46 74 62 44 70 4a 63 33 4e 31 5a 58 49 67 65 47 31 73 62 6e 4d 36 63 32 46 74 62 44 30 69 64 58 4a 75 4f 6d 39 68 63 32 6c 7a 4f 6d 35 68 62 57 56 7a 4f 6e 52 6a 4f 6c 4e 42 54 55 77 36 4d 69 34 77 4f 6d 46 7a 63 32 56 79 64 47 6c 76 62 69 49 2b 61 48 52 30 63 48 4d 36 4c 79 39 6e 62 47 39 69 59 57 77 75 63 6d 56 77 62 47 6c 6a 62 32 34 75 59 32 39 74 4c 79 45 76 63 32 46 74 62 44 49 76 51 30 31 42 54 44 77 76 63 32 46 74 62 44 70 4a 63 33 4e 31 5a 58 49 2b 50 46 4e 70 5a 32 35 68 64 48 56 79 5a 53 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 38 77 4f 53 39 34 62 57 78 6b 63 32 6c 6e 49 79 49 2b 50 46 4e 70 5a 32 35 6c 5a 45 6c 75 Data Ascii: nByb3RvY29sIj48c2FtbDpJc3N1ZXIgeG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+aHR0cHM6Ly9nbG9iYWwucmVwbGljb24uY29tLyEvc2FtbDIvQ01BTDwvc2FtbDpJc3N1ZXI+PFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+PFNpZ25lZElu
2024-05-08 15:49:46 UTC	1369	IN	Data Raw: 31 78 5a 46 64 45 4d 45 31 58 55 6b 64 79 4f 57 39 7a 4e 6e 6c 35 4f 55 64 57 53 55 74 49 4d 46 67 35 54 47 70 71 4d 45 39 55 59 58 68 6d 62 55 68 6a 5a 6c 46 4b 54 33 41 78 56 6c 5a 49 55 6a 46 48 57 6e 42 76 51 33 42 46 51 54 56 78 4c 30 77 76 56 6c 67 78 65 6d 70 4c 4d 30 63 34 55 55 78 46 4b 30 52 71 57 55 59 72 59 54 6c 4e 64 33 64 68 4e 58 6f 79 62 30 46 71 59 30 68 49 53 57 78 34 52 54 46 70 4d 57 49 30 64 6e 4e 4a 62 57 74 6a 61 57 68 70 4d 55 68 74 64 54 56 6f 56 54 42 6a 56 45 74 79 4e 44 6c 78 4e 6e 6c 4b 4d 57 68 6e 4e 44 6b 79 53 32 56 68 4e 6e 52 57 56 32 56 73 57 58 70 34 62 6d 46 30 53 44 64 47 5a 32 78 42 56 31 42 59 64 58 52 54 4f 47 52 30 4e 54 6c 61 54 33 52 73 4f 56 6c 56 4e 32 39 6c 62 6e 52 6e 64 47 55 34 52 6b 38 31 64 6d 78 32 56 Data Ascii: 1xZFdEME1XUkdyOW9zNnl5OUdWSUtIMFg5TGpqME9UYXhmbUhjZlFKT3AxVlZIUjFHWnBvQ3BFQTVxL0wvVlgxempLM0c4UUxFK0RqWUYrYTlNd3dhNXoyb0FqY0hISWx4RTFpMWI0dnNJbWtjaWhpMUhtdTVoVTBjVEtyNDlxNnlKMWhnNDkyS2VhNnRWV2VsWXp4bmF0SDdGZ2xBV1BYdXRTOGR0NTlaT3RsOVlVN29lbnRndGU4Rk81dmx2V
2024-05-08 15:49:46 UTC	1369	IN	Data Raw: 34 4d 47 31 47 54 7a 63 72 56 30 4a 61 59 54 46 54 53 55 68 78 62 57 31 6a 55 56 56 48 5a 45 74 6c 62 6c 46 33 63 57 70 70 4d 56 64 78 56 57 46 34 52 6e 68 55 59 6c 5a 31 56 33 6c 35 56 6b 74 52 56 33 68 77 55 58 6c 44 52 32 4e 6c 53 46 64 42 57 55 68 70 5a 30 4a 79 65 58 5a 46 61 45 4e 48 5a 48 6c 6f 59 53 74 33 54 30 5a 49 4d 6a 42 4c 4f 53 39 58 4e 33 42 46 56 55 56 57 63 57 6c 6a 56 6e 68 33 4e 58 67 32 4e 47 4e 46 52 57 73 31 4d 6e 4e 35 4e 6b 30 79 61 6c 4d 76 4e 56 56 71 52 32 4a 69 4f 45 46 35 56 58 5a 6b 64 55 35 49 5a 7a 4a 72 55 7a 4a 76 57 56 41 34 62 55 56 56 61 57 56 30 55 48 42 4d 4e 56 4e 69 53 58 5a 70 5a 57 31 78 4c 30 35 4c 51 57 4a 4e 59 55 31 6e 51 6d 46 36 59 31 68 47 53 32 52 6a 51 6d 67 30 51 58 64 5a 4d 6e 68 6d 51 7a 46 6c 59 6a Data Ascii: 4MG1GTzcrV0JaYTFTSUhxbW1jUVVHZEtlblF3cWppMVdxVWF4RnhUYlZ1V3l5VktRV3hwUXlDR2NlSFdBWUhpZ0JyeXZFaENHZHloYSt3T0ZIMjBLOS9XN3BFVUVWcWljVnh3NXg2NGNFRWs1MnN5Nk0yalMvNVVqR2JiOEF5VXZkdU5IZzJrUzJvWVA4bUVVaWV0UHBMNVNiSXZpZW1xL05LQWJNYU1nQmF6Y1hGS2RjQmg0QXdZMnhmQzFlYj
2024-05-08 15:49:46 UTC	519	IN	Data Raw: 59 6c 46 4a 63 55 70 79 61 32 52 47 61 6e 42 55 4f 48 6c 31 4e 7a 64 76 56 6e 49 78 4d 57 34 31 62 56 6c 68 63 44 4e 6f 62 31 42 32 5a 48 42 46 65 54 63 76 4b 30 68 45 53 47 68 46 64 32 64 59 55 6d 4e 42 4e 6d 74 42 56 54 68 74 56 6e 56 4d 61 45 39 75 52 6e 46 42 57 56 52 57 4e 30 35 4b 56 57 78 4c 57 55 52 34 55 45 6c 33 53 6a 42 55 52 53 73 30 52 32 4a 6f 55 46 6f 79 63 47 4a 6f 55 45 31 57 64 30 56 7a 62 6d 64 78 52 32 39 42 4e 31 5a 55 64 58 4e 51 57 55 77 79 5a 6e 42 4a 4d 31 56 78 4e 6d 46 6e 4f 56 59 30 64 44 56 51 56 30 70 61 53 46 55 34 59 58 52 48 53 6b 6c 58 4e 58 5a 50 51 7a 64 49 55 56 68 6e 50 54 30 38 4c 31 67 31 4d 44 6c 44 5a 58 4a 30 61 57 5a 70 59 32 46 30 5a 54 34 38 4c 31 67 31 4d 44 6c 45 59 58 52 68 50 6a 77 76 53 32 56 35 53 57 35 Data Ascii: YlFJcUpya2RGanBUOHl1NzdvVnIxMW41bVlhcDNob1B2ZHBFeTcvK0hESGhFd2dYUmNBNmtBVThtVnVMaE9uRnFBWVRWN05KVWxLWUR4UEl3SjBURSs0R2JoUFoycGJoUE1Wd0VzbmdxR29BN1ZUdXNQWUwyZnBJM1VxNmFnOVY0dDVQV0paSFU4YXRHSklXNXZPQzdIUVhnPT08L1g1MDlDZXJ0aWZpY2F0ZT48L1g1MDlEYXRhPjwvS2V5SW5
2024-05-08 15:49:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	104.16.240.248	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:48 UTC	618	OUT	GET /favicon.ico HTTP/1.1 Host: global.replicon.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://global.replicon.com/!/saml2/Cmal/sp-sso/post Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:48 UTC	412	IN	HTTP/1.1 404 Not Found Date: Wed, 08 May 2024 15:49:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-frame-options: SAMEORIGIN x-ua-compatible: IE=edge strict-transport-security: max-age=31536000 vary: Accept-Encoding CF-Cache-Status: EXPIRED Expires: Wed, 08 May 2024 19:49:48 GMT Cache-Control: public, max-age=14400 Server: cloudflare CF-RAY: 880a9a115c1576c7-SEA
2024-05-08 15:49:48 UTC	957	IN	Data Raw: 34 64 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 Data Ascii: 4db<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404
2024-05-08 15:49:48 UTC	293	IN	Data Raw: 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 68 33 3e 0d 0a 20 3c 2f 66 69 65 6c 64 Data Ascii: </h1></div><div id="content"> <div class="content-container"><fieldset> <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </field
2024-05-08 15:49:48 UTC	7	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a Data Ascii: 2
2024-05-08 15:49:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49718	96.7.158.101	443

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:49 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-08 15:49:49 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/2518) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=54833 Date: Wed, 08 May 2024 15:49:49 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49719	96.7.158.101	443

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:49 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-08 15:49:49 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0gZGqYgAAAAALDuImPJT0QKVHnlugaXU1UERYMzFFREdFMDIxMgBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=38296 Date: Wed, 08 May 2024 15:49:49 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-08 15:49:49 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49720	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:50 UTC	635	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:50 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3060130 Cache-Control: public, max-age=31536000 Content-MD5: OdlDOzXlgXZa124Z7O0jlA== Content-Type: application/x-javascript Date: Wed, 08 May 2024 15:49:50 GMT Etag: 0x8DC52767B578035 Last-Modified: Mon, 01 Apr 2024 18:06:40 GMT Server: ECAcc (sac/2578) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 067a8eed-801e-006f-5f8a-85911b000000 x-ms-version: 2009-09-19 Content-Length: 141305 Connection: close
2024-05-08 15:49:50 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-05-08 15:49:50 UTC	16383	IN	Data Raw: 75 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3a 65 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 3f 65 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 3a 7b 7d 7d 2c 68 69 73 74 6f 72 79 3a 7b 70 75 73 68 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 5f 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 64 2e 68 69 73 74 6f 72 79 2e 70 75 73 68 53 74 61 74 65 28 65 2c 6e 29 7d 2c 72 65 70 6c 61 63 65 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 5f 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 64 2e 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 65 2c 6e 29 7d 7d 2c 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 29 7b 65 2e 61 64 Data Ascii: utedStyle(e,null):e.currentStyle?e.currentStyle:{}},history:{pushState:function(e,n){_.isHistorySupported()&&d.history.pushState(e,n)},replaceState:function(e,n){_.isHistorySupported()&&d.history.replaceState(e,n)}},addEventListener:function(e,n,t,r){e.ad
2024-05-08 15:49:50 UTC	16383	IN	Data Raw: 5f 53 4d 53 3a 22 38 30 30 34 33 34 45 31 22 2c 50 50 5f 45 5f 49 4e 4c 49 4e 45 4c 4f 47 49 4e 5f 49 4e 56 41 4c 49 44 5f 41 4c 54 3a 22 38 30 30 34 33 34 45 32 22 2c 50 50 5f 45 5f 50 52 45 56 49 4f 55 53 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 31 30 31 33 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 57 52 4f 4e 47 3a 22 38 30 30 34 35 35 30 35 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 46 41 54 41 4c 3a 22 38 30 30 34 35 35 33 37 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 55 4e 41 55 54 48 45 4e 54 49 43 41 54 45 44 3a 22 38 30 30 34 35 35 33 38 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 4f 54 48 45 52 3a Data Ascii: _SMS:"800434E1",PP_E_INLINELOGIN_INVALID_ALT:"800434E2",PP_E_PREVIOUS_PASSWORD:"80041013",PP_E_HIP_VALIDATION_WRONG:"80045505",PP_E_HIP_VALIDATION_ERROR_FATAL:"80045537",PP_E_HIP_VALIDATION_ERROR_UNAUTHENTICATED:"80045538",PP_E_HIP_VALIDATION_ERROR_OTHER:
2024-05-08 15:49:50 UTC	16383	IN	Data Raw: 69 3b 6f 2b 2b 29 72 2e 70 75 73 68 28 6e 2e 63 61 6c 6c 28 74 2c 65 5b 6f 5d 2c 6f 29 29 3b 72 65 74 75 72 6e 20 72 7d 2c 6a 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 5b 5d 3b 69 66 28 65 29 66 6f 72 28 76 61 72 20 6f 3d 30 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 6f 3c 69 3b 6f 2b 2b 29 6e 2e 63 61 6c 6c 28 74 2c 65 5b 6f 5d 2c 6f 29 26 26 72 2e 70 75 73 68 28 65 5b 6f 5d 29 3b 72 65 74 75 72 6e 20 72 7d 2c 4e 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 65 2e 70 75 73 68 2e 61 70 70 6c 79 28 65 2c 6e 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 74 3d 30 2c 72 3d 6e 2e 6c 65 6e 67 74 68 3b 74 3c 72 3b 74 2b 2b 29 65 2e 70 75 73 68 28 6e 5b 74 5d 29 3b 72 65 74 Data Ascii: i;o++)r.push(n.call(t,e[o],o));return r},jb:function(e,n,t){var r=[];if(e)for(var o=0,i=e.length;o<i;o++)n.call(t,e[o],o)&&r.push(e[o]);return r},Nb:function(e,n){if(n instanceof Array)e.push.apply(e,n);else for(var t=0,r=n.length;t<r;t++)e.push(n[t]);ret
2024-05-08 15:49:50 UTC	16383	IN	Data Raw: 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 28 65 5b 54 5d 3d 3d 3d 50 5b 54 5d 7c 7c 65 5b 54 5d 3d 3d 3d 53 2e 6f 2e 66 6e 5b 54 5d 26 26 65 2e 4e 63 29 7d 2c 53 2e 62 28 22 6f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 74 61 29 2c 53 2e 62 28 22 69 73 4f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 4f 29 2c 53 2e 62 28 22 69 73 57 72 69 74 65 61 62 6c 65 4f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 5a 61 29 2c 53 2e 62 28 22 69 73 57 72 69 74 61 62 6c 65 4f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 5a 61 29 2c 53 2e 62 28 22 6f 62 73 65 72 76 61 62 6c 65 2e 66 6e 22 2c 50 29 2c 53 2e 4c 28 50 2c 22 70 65 65 6b 22 2c 50 2e 76 29 2c 53 2e 4c 28 50 2c 22 76 61 6c 75 65 48 61 73 4d 75 74 61 74 65 64 22 2c 50 2e 78 61 29 2c 53 2e 4c 28 50 2c 22 76 Data Ascii: n"function"==typeof e&&(e[T]===P[T]\|\|e[T]===S.o.fn[T]&&e.Nc)},S.b("observable",S.ta),S.b("isObservable",S.O),S.b("isWriteableObservable",S.Za),S.b("isWritableObservable",S.Za),S.b("observable.fn",P),S.L(P,"peek",P.v),S.L(P,"valueHasMutated",P.xa),S.L(P,"v
2024-05-08 15:49:50 UTC	16383	IN	Data Raw: 74 73 29 2c 74 26 26 21 62 5b 53 2e 61 2e 52 28 6e 29 5d 26 26 64 28 74 2c 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 6e 2c 74 29 7b 76 61 72 20 6f 2c 69 3d 53 2e 61 2e 67 2e 55 62 28 65 2c 45 2c 7b 7d 29 2c 73 3d 69 2e 68 64 3b 69 66 28 21 6e 29 7b 69 66 28 73 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 59 6f 75 20 63 61 6e 6e 6f 74 20 61 70 70 6c 79 20 62 69 6e 64 69 6e 67 73 20 6d 75 6c 74 69 70 6c 65 20 74 69 6d 65 73 20 74 6f 20 74 68 65 20 73 61 6d 65 20 65 6c 65 6d 65 6e 74 2e 22 29 3b 69 2e 68 64 3d 21 30 7d 69 66 28 73 7c 7c 28 69 2e 63 6f 6e 74 65 78 74 3d 74 29 2c 69 2e 5a 62 7c 7c 28 69 2e 5a 62 3d 7b 7d 29 2c 6e 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 6e 29 6f 3d 6e 3b 65 6c 73 65 7b 76 61 72 20 75 3d 53 2e 67 61 2e Data Ascii: ts),t&&!b[S.a.R(n)]&&d(t,n)}function p(e,n,t){var o,i=S.a.g.Ub(e,E,{}),s=i.hd;if(!n){if(s)throw Error("You cannot apply bindings multiple times to the same element.");i.hd=!0}if(s\|\|(i.context=t),i.Zb\|\|(i.Zb={}),n&&"function"!=typeof n)o=n;else{var u=S.ga.
2024-05-08 15:49:50 UTC	6	IN	Data Raw: 2e 69 2e 6d 61 28 Data Ascii: .i.ma(
2024-05-08 15:49:50 UTC	16383	IN	Data Raw: 65 2c 53 2e 69 2e 48 29 2c 53 2e 61 2e 77 64 28 65 29 2c 75 26 26 32 30 3c 4d 61 74 68 2e 61 62 73 28 75 2d 65 2e 73 63 72 6f 6c 6c 54 6f 70 29 26 26 28 65 2e 73 63 72 6f 6c 6c 54 6f 70 3d 75 29 7d 7d 2c 53 2e 63 2e 6f 70 74 69 6f 6e 73 2e 24 62 3d 53 2e 61 2e 67 2e 5a 28 29 2c 53 2e 63 2e 73 65 6c 65 63 74 65 64 4f 70 74 69 6f 6e 73 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 76 61 72 20 72 3d 6e 28 29 2c 6f 3d 5b 5d 3b 53 2e 61 2e 44 28 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6f 70 74 69 6f 6e 22 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 65 6c 65 63 74 65 64 26 26 6f 2e 70 75 73 68 28 53 2e 77 2e 4d 28 65 29 29 7d 29 29 2c 53 2e 6d 2e 65 62 28 72 Data Ascii: e,S.i.H),S.a.wd(e),u&&20<Math.abs(u-e.scrollTop)&&(e.scrollTop=u)}},S.c.options.$b=S.a.g.Z(),S.c.selectedOptions={init:function(e,n,t){function r(){var r=n(),o=[];S.a.D(e.getElementsByTagName("option"),(function(e){e.selected&&o.push(S.w.M(e))})),S.m.eb(r
2024-05-08 15:49:50 UTC	16383	IN	Data Raw: 65 66 61 75 6c 74 3f 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3a 65 2e 72 65 74 75 72 6e 56 61 6c 75 65 3d 21 31 7d 6e 2e 61 70 70 6c 79 45 78 74 65 6e 73 69 6f 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 3d 31 2c 6f 3d 7b 7d 3b 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2e 6c 6f 61 64 65 72 73 2e 75 6e 73 68 69 66 74 28 7b 6c 6f 61 64 43 6f 6d 70 6f 6e 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2e 64 65 66 61 75 6c 74 4c 6f 61 64 65 72 2e 6c 6f 61 64 43 6f 6d 70 6f 6e 65 6e 74 28 6e 2c 74 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 69 3b 74 2e 65 6e 61 62 6c 65 45 78 74 65 6e 73 69 6f 6e 73 26 26 28 69 3d 6e 2e 63 72 65 61 74 65 56 69 65 77 4d 6f 64 65 6c 2c 6e 2e Data Ascii: efault?e.preventDefault():e.returnValue=!1}n.applyExtensions=function(e){var n,t=1,o={};e.components.loaders.unshift({loadComponent:function(n,t,r){e.components.defaultLoader.loadComponent(n,t,(function(n){var i;t.enableExtensions&&(i=n.createViewModel,n.
2024-05-08 15:49:50 UTC	10235	IN	Data Raw: 28 65 2c 6e 2c 74 2c 72 2c 6f 29 7b 75 2e 74 72 61 63 65 45 6e 64 52 65 71 75 65 73 74 28 65 2c 6e 2c 74 2c 72 2c 6f 29 7d 66 75 6e 63 74 69 6f 6e 20 77 28 65 2c 6e 29 7b 76 61 72 20 74 3d 7b 7d 3b 72 65 74 75 72 6e 20 65 26 26 28 74 2e 78 68 72 5f 73 74 61 74 75 73 3d 65 2e 73 74 61 74 75 73 29 2c 74 2e 74 65 78 74 53 74 61 74 75 73 3d 6e 2c 74 7d 6e 2e 45 72 72 6f 72 73 3d 5b 5d 2c 6e 2e 4a 73 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 61 2c 73 2c 75 2c 63 2c 6c 29 7b 76 61 72 20 66 3d 21 28 21 61 26 26 21 73 29 2c 70 3d 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 2c 68 3d 65 2e 75 72 6c 3b 66 75 6e 63 74 69 6f 6e 20 62 28 65 2c 6e 29 7b 76 61 72 20 74 3d 7b 7d 3b 69 66 28 35 30 30 3d 3d 3d 65 2e 73 74 61 74 75 73 29 74 72 79 7b 74 Data Ascii: (e,n,t,r,o){u.traceEndRequest(e,n,t,r,o)}function w(e,n){var t={};return e&&(t.xhr_status=e.status),t.textStatus=n,t}n.Errors=[],n.Json=function(e,o,a,s,u,c,l){var f=!(!a&&!s),p=(new Date).getTime(),h=e.url;function b(e,n){var t={};if(500===e.status)try{t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49725	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:53 UTC	660	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:53 UTC	734	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3904168 Cache-Control: public, max-age=31536000 Content-MD5: kqhA3D0Xczna4D/t8ioitQ== Content-Type: text/css Date: Wed, 08 May 2024 15:49:53 GMT Etag: 0x8DC070858CA028D Last-Modified: Wed, 27 Dec 2023 18:19:21 GMT Server: ECAcc (sac/2568) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 3df15679-d01e-009e-43dd-7d1f4c000000 x-ms-version: 2009-09-19 Content-Length: 113084 Connection: close
2024-05-08 15:49:53 UTC	15668	IN	Data Raw: 2f 2a 21 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 2f 2f 2a 21 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 0a 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 Data Ascii: /! Copyright (C) Microsoft Corporation. All rights reserved. //*!------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------This file is based on or incorporates material from the projects listed
2024-05-08 15:49:53 UTC	16383	IN	Data Raw: 31 30 2c 2e 63 6f 6c 2d 6d 64 2d 31 30 2c 2e 63 6f 6c 2d 6c 67 2d 31 30 2c 2e 63 6f 6c 2d 78 73 2d 31 31 2c 2e 63 6f 6c 2d 73 6d 2d 31 31 2c 2e 63 6f 6c 2d 6d 64 2d 31 31 2c 2e 63 6f 6c 2d 6c 67 2d 31 31 2c 2e 63 6f 6c 2d 78 73 2d 31 32 2c 2e 63 6f 6c 2d 73 6d 2d 31 32 2c 2e 63 6f 6c 2d 6d 64 2d 31 32 2c 2e 63 6f 6c 2d 6c 67 2d 31 32 2c 2e 63 6f 6c 2d 78 73 2d 31 33 2c 2e 63 6f 6c 2d 73 6d 2d 31 33 2c 2e 63 6f 6c 2d 6d 64 2d 31 33 2c 2e 63 6f 6c 2d 6c 67 2d 31 33 2c 2e 63 6f 6c 2d 78 73 2d 31 34 2c 2e 63 6f 6c 2d 73 6d 2d 31 34 2c 2e 63 6f 6c 2d 6d 64 2d 31 34 2c 2e 63 6f 6c 2d 6c 67 2d 31 34 2c 2e 63 6f 6c 2d 78 73 2d 31 35 2c 2e 63 6f 6c 2d 73 6d 2d 31 35 2c 2e 63 6f 6c 2d 6d 64 2d 31 35 2c 2e 63 6f 6c 2d 6c 67 2d 31 35 2c 2e 63 6f 6c 2d 78 73 2d 31 36 Data Ascii: 10,.col-md-10,.col-lg-10,.col-xs-11,.col-sm-11,.col-md-11,.col-lg-11,.col-xs-12,.col-sm-12,.col-md-12,.col-lg-12,.col-xs-13,.col-sm-13,.col-md-13,.col-lg-13,.col-xs-14,.col-sm-14,.col-md-14,.col-lg-14,.col-xs-15,.col-sm-15,.col-md-15,.col-lg-15,.col-xs-16
2024-05-08 15:49:54 UTC	16383	IN	Data Raw: 31 36 2e 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 35 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 30 2e 38 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 36 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 35 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 37 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 39 2e 31 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 38 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 33 2e 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 39 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 37 2e 35 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 31 30 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 31 2e 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 31 31 7b 6d 61 Data Ascii: 16.66667%}.col-xl-offset-5{margin-left:20.83333%}.col-xl-offset-6{margin-left:25%}.col-xl-offset-7{margin-left:29.16667%}.col-xl-offset-8{margin-left:33.33333%}.col-xl-offset-9{margin-left:37.5%}.col-xl-offset-10{margin-left:41.66667%}.col-xl-offset-11{ma
2024-05-08 15:49:54 UTC	16383	IN	Data Raw: 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 74 68 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 74 61 62 6c 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 2c 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 64 2c 2e 74 61 62 6c 65 3e 74 62 6f 64 79 3e 74 72 3e 74 68 2c 2e 74 61 62 6c 65 3e 74 62 6f 64 79 3e 74 72 3e 74 64 2c 2e 74 61 62 6c 65 3e 74 66 6f 6f 74 3e 74 72 3e 74 68 2c 2e 74 61 62 6c 65 3e 74 66 6f 6f 74 3e 74 72 3e 74 64 7b 70 61 64 64 69 6e 67 3a 31 36 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 7d 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 7b 76 65 72 74 69 63 61 6c Data Ascii: {background-color:transparent}th{text-align:left}.table{width:100%;max-width:100%}.table>thead>tr>th,.table>thead>tr>td,.table>tbody>tr>th,.table>tbody>tr>td,.table>tfoot>tr>th,.table>tfoot>tr>td{padding:16px;vertical-align:top}.table>thead>tr>th{vertical
2024-05-08 15:49:54 UTC	16383	IN	Data Raw: 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 20 57 65 62 66 6f 6e 74 22 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 73 72 63 3a 6c 6f 63 61 6c 28 22 53 65 67 6f 65 20 55 49 20 53 65 6d 69 6c 69 67 68 74 22 29 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 20 57 65 62 66 6f 6e 74 22 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 73 72 63 3a 6c 6f 63 61 6c 28 22 53 65 67 6f 65 20 55 49 20 42 6f 6c 64 22 29 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 20 57 65 62 66 6f 6e 74 22 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 6c 6f 63 61 6c 28 22 53 65 Data Ascii: e{font-family:"Segoe UI Webfont";font-weight:300;src:local("Segoe UI Semilight")}@font-face{font-family:"Segoe UI Webfont";font-weight:700;src:local("Segoe UI Bold")}@font-face{font-family:"Segoe UI Webfont";font-style:italic;font-weight:400;src:local("Se
2024-05-08 15:49:54 UTC	16383	IN	Data Raw: 74 6e 3a 68 6f 76 65 72 2c 62 75 74 74 6f 6e 3a 68 6f 76 65 72 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 3a 68 6f 76 65 72 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 3a 68 6f 76 65 72 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 65 73 65 74 22 5d 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 32 62 32 62 32 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 33 29 7d 2e 62 74 6e 2d 66 6f 63 75 73 2c 2e 62 74 6e 3a 66 6f 63 75 73 2c 62 75 74 74 6f 6e 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b Data Ascii: tn:hover,button:hover,input[type="button"]:hover,input[type="submit"]:hover,input[type="reset"]:hover{background-color:#b2b2b2;background-color:rgba(0,0,0,0.3)}.btn-focus,.btn:focus,button:focus,input[type="button"]:focus,input[type="submit"]:focus,input[
2024-05-08 15:49:54 UTC	15501	IN	Data Raw: 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 2e 32 35 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 37 35 72 65 6d 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 2e 33 36 33 32 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 32 2e 33 36 33 32 70 78 3b 63 6f 6c 6f 72 3a 23 31 62 31 62 31 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 36 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 32 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 22 2c 22 48 65 6c 76 65 74 69 Data Ascii: margin-top:1.25rem;font-size:24px;line-height:28px;font-weight:300;line-height:1.75rem;padding-bottom:2.3632px;padding-top:2.3632px;color:#1b1b1b;font-size:1.5rem;font-weight:600;padding:0;margin-top:16px;margin-bottom:12px;font-family:"Segoe UI","Helveti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49727	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:54 UTC	637	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_IDwaQXicOTFiRVOQGoK9bQ2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:54 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2308121 Cache-Control: public, max-age=31536000 Content-MD5: B86dIybsPdvBpavR5Hlk6g== Content-Type: application/x-javascript Date: Wed, 08 May 2024 15:49:54 GMT Etag: 0x8DC5997FCCA1D18 Last-Modified: Wed, 10 Apr 2024 19:54:09 GMT Server: ECAcc (sac/2527) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 3fefc599-d01e-00a2-6761-8cca44000000 x-ms-version: 2009-09-19 Content-Length: 444415 Connection: close
2024-05-08 15:49:54 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-05-08 15:49:54 UTC	1	IN	Data Raw: 37 Data Ascii: 7
2024-05-08 15:49:54 UTC	16383	IN	Data Raw: 38 44 36 22 2c 50 50 5f 45 5f 49 44 50 5f 47 49 54 48 55 42 5f 42 49 4e 44 49 4e 47 5f 4e 4f 54 5f 41 4c 4c 4f 57 45 44 3a 22 38 30 30 34 37 38 44 37 22 2c 50 50 5f 45 5f 49 44 50 5f 42 49 4e 44 49 4e 47 5f 45 58 49 53 54 53 5f 53 41 4d 53 55 4e 47 3a 22 38 30 30 34 34 35 33 45 22 2c 50 50 5f 45 5f 54 52 41 4e 53 46 45 52 5f 54 4f 4b 45 4e 5f 49 4e 56 41 4c 49 44 5f 53 45 53 53 49 4f 4e 3a 22 38 30 30 34 33 35 41 30 22 7d 2c 6e 2e 45 73 74 73 45 72 72 6f 72 3d 7b 55 73 65 72 41 63 63 6f 75 6e 74 53 65 6c 65 63 74 69 6f 6e 49 6e 76 61 6c 69 64 3a 22 31 36 30 30 31 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a 65 64 3a 22 35 30 30 32 30 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a 65 64 41 70 69 56 65 72 73 69 6f 6e 4e 6f 74 53 75 70 70 6f 72 74 65 64 Data Ascii: 8D6",PP_E_IDP_GITHUB_BINDING_NOT_ALLOWED:"800478D7",PP_E_IDP_BINDING_EXISTS_SAMSUNG:"8004453E",PP_E_TRANSFER_TOKEN_INVALID_SESSION:"800435A0"},n.EstsError={UserAccountSelectionInvalid:"16001",UserUnauthorized:"50020",UserUnauthorizedApiVersionNotSupported
2024-05-08 15:49:54 UTC	16383	IN	Data Raw: 72 6e 20 65 2e 71 75 65 72 79 26 26 28 6e 2b 3d 22 3f 22 2b 63 2e 6a 6f 69 6e 28 65 2e 71 75 65 72 79 2c 22 26 22 2c 22 3d 22 29 29 2c 65 2e 66 72 61 67 6d 65 6e 74 26 26 28 6e 2b 3d 22 23 22 2b 63 2e 6a 6f 69 6e 28 65 2e 66 72 61 67 6d 65 6e 74 2c 22 26 22 2c 22 3d 22 29 29 2c 6e 7d 2c 61 70 70 65 6e 64 43 75 72 72 65 6e 74 51 75 65 72 79 50 61 72 61 6d 65 74 65 72 49 66 4e 6f 74 45 78 69 73 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 44 2e 70 61 72 73 65 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3b 72 65 74 75 72 6e 20 63 2e 66 6f 72 45 61 63 68 28 6e 2e 71 75 65 72 79 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 65 3d 44 2e 61 64 64 49 66 4e 6f 74 45 78 69 73 74 28 65 2c 6e 2c 74 29 7d 29 29 2c 65 7d 2c 61 70 Data Ascii: rn e.query&&(n+="?"+c.join(e.query,"&","=")),e.fragment&&(n+="#"+c.join(e.fragment,"&","=")),n},appendCurrentQueryParameterIfNotExist:function(e){var n=D.parse(window.location.href);return c.forEach(n.query,(function(n,t){e=D.addIfNotExist(e,n,t)})),e},ap
2024-05-08 15:49:54 UTC	16383	IN	Data Raw: 65 71 75 65 73 74 22 29 2c 73 2e 74 72 61 63 65 45 6e 64 52 65 71 75 65 73 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 69 2c 61 29 7b 6c 3f 6c 2e 74 72 61 63 65 45 6e 64 52 65 71 75 65 73 74 28 65 2c 6e 2c 74 2c 69 2c 61 29 3a 61 26 26 61 28 29 7d 2c 73 2e 73 65 74 50 61 67 65 56 69 65 77 4d 6f 64 65 6c 3d 75 28 22 73 65 74 50 61 67 65 56 69 65 77 4d 6f 64 65 6c 22 29 2c 73 2e 6c 6f 67 43 6f 6d 70 6f 6e 65 6e 74 45 76 65 6e 74 3d 75 28 22 6c 6f 67 43 6f 6d 70 6f 6e 65 6e 74 45 76 65 6e 74 22 29 2c 73 2e 6c 6f 67 56 69 65 77 53 74 61 74 65 3d 75 28 22 6c 6f 67 56 69 65 77 53 74 61 74 65 22 29 2c 73 2e 73 65 74 56 69 65 77 56 69 65 77 4d 6f 64 65 6c 3d 75 28 22 73 65 74 56 69 65 77 56 69 65 77 4d 6f 64 65 6c 22 29 2c 73 2e 73 77 69 74 63 68 56 69 65 Data Ascii: equest"),s.traceEndRequest=function(e,n,t,i,a){l?l.traceEndRequest(e,n,t,i,a):a&&a()},s.setPageViewModel=u("setPageViewModel"),s.logComponentEvent=u("logComponentEvent"),s.logViewState=u("logViewState"),s.setViewViewModel=u("setViewViewModel"),s.switchVie
2024-05-08 15:49:54 UTC	3	IN	Data Raw: 6b 74 22 Data Ascii: kt"
2024-05-08 15:49:54 UTC	16383	IN	Data Raw: 2c 6e 5d 5d 3a 5b 5d 2c 74 3f 5b 5b 22 6c 63 69 64 22 2c 74 5d 5d 3a 5b 5d 2c 53 3f 5b 5b 22 69 64 22 2c 53 5d 5d 3a 5b 5d 2c 43 3f 5b 5b 22 63 6c 69 65 6e 74 5f 69 64 22 2c 43 5d 5d 3a 5b 5d 2c 77 3f 5b 5b 22 66 63 69 22 2c 77 5d 5d 3a 5b 5d 2c 78 3f 5b 5b 22 6e 6f 70 61 22 2c 78 5d 5d 3a 5b 5d 29 2c 63 3d 7b 74 61 72 67 65 74 55 72 6c 3a 72 2e 61 64 64 28 22 47 65 74 4f 6e 65 54 69 6d 65 43 6f 64 65 2e 73 72 66 22 2c 61 29 2c 72 65 71 75 65 73 74 54 79 70 65 3a 69 2e 52 65 71 75 65 73 74 54 79 70 65 2e 50 6f 73 74 2c 64 61 74 61 3a 6f 2e 67 65 6e 65 72 61 74 65 52 65 71 75 65 73 74 53 74 72 69 6e 67 28 6d 29 2c 69 73 41 73 79 6e 63 3a 21 30 2c 74 69 6d 65 6f 75 74 3a 5f 2c 73 75 63 63 65 73 73 43 61 6c 6c 62 61 63 6b 3a 79 2c 66 61 69 6c 75 72 65 43 61 Data Ascii: ,n]]:[],t?[["lcid",t]]:[],S?[["id",S]]:[],C?[["client_id",C]]:[],w?[["fci",w]]:[],x?[["nopa",x]]:[]),c={targetUrl:r.add("GetOneTimeCode.srf",a),requestType:i.RequestType.Post,data:o.generateRequestString(m),isAsync:!0,timeout:_,successCallback:y,failureCa
2024-05-08 15:49:55 UTC	16383	IN	Data Raw: 6e 64 4f 72 52 65 70 6c 61 63 65 28 65 2c 22 6c 63 22 2c 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 70 2e 65 78 74 72 61 63 74 28 22 6c 63 22 29 29 29 29 7d 28 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 46 65 64 65 72 61 74 69 6f 6e 52 65 64 69 72 65 63 74 55 72 6c 2c 65 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 6d 2e 43 6c 6f 75 64 46 65 64 65 72 61 74 69 6f 6e 3a 69 2e 69 64 70 52 65 64 69 72 65 63 74 55 72 6c 3d 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 46 65 64 65 72 61 74 69 6f 6e 52 65 64 69 72 65 63 74 55 72 6c 3b 62 72 65 61 6b 3b 63 61 73 65 20 6d 2e 4c 69 6e 6b 65 64 49 6e 3a 69 2e 69 64 70 52 65 64 69 72 65 63 74 55 72 6c 3d 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 4c 69 6e 6b Data Ascii: ndOrReplace(e,"lc",encodeURIComponent(decodeURIComponent(p.extract("lc"))))}(n.Credentials.FederationRedirectUrl,e);break;case m.CloudFederation:i.idpRedirectUrl=n.Credentials.FederationRedirectUrl;break;case m.LinkedIn:i.idpRedirectUrl=n.Credentials.Link
2024-05-08 15:49:55 UTC	16383	IN	Data Raw: 3b 73 77 69 74 63 68 28 6e 2e 63 72 65 64 4c 69 6e 6b 45 72 72 6f 72 28 22 22 29 2c 65 29 7b 63 61 73 65 20 6d 2e 4f 6e 65 54 69 6d 65 43 6f 64 65 3a 69 66 28 4f 2e 70 72 6f 6f 66 2e 63 6c 65 61 72 44 69 67 69 74 73 29 6e 2e 6f 6e 53 77 69 74 63 68 56 69 65 77 28 67 2e 50 72 6f 6f 66 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 2c 21 31 2c 4f 29 3b 65 6c 73 65 7b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 75 73 65 72 6e 61 6d 65 3a 66 2e 63 6c 65 61 6e 73 65 55 73 65 72 6e 61 6d 65 28 61 29 2c 70 72 6f 6f 66 44 61 74 61 3a 4f 2e 70 72 6f 6f 66 2e 64 61 74 61 2c 70 72 6f 6f 66 54 79 70 65 3a 4f 2e 70 72 6f 6f 66 2e 74 79 70 65 2c 70 75 72 70 6f 73 65 3a 4f 2e 70 72 6f 6f 66 2e 69 73 4e 6f 70 61 3f 6c 2e 50 75 72 70 6f 73 65 2e 4e 6f 50 Data Ascii: ;switch(n.credLinkError(""),e){case m.OneTimeCode:if(O.proof.clearDigits)n.onSwitchView(g.ProofConfirmation,!1,O);else{var t=function(){var e={username:f.cleanseUsername(a),proofData:O.proof.data,proofType:O.proof.type,purpose:O.proof.isNopa?l.Purpose.NoP
2024-05-08 15:49:55 UTC	16383	IN	Data Raw: 75 67 44 65 74 61 69 6c 73 3d 69 2e 70 75 72 65 43 6f 6d 70 75 74 65 64 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 70 61 67 69 6e 61 74 69 6f 6e 43 6f 6e 74 72 6f 6c 4d 65 74 68 6f 64 73 28 29 26 26 61 2e 70 61 67 69 6e 61 74 69 6f 6e 43 6f 6e 74 72 6f 6c 4d 65 74 68 6f 64 73 28 29 2e 63 75 72 72 65 6e 74 56 69 65 77 48 61 73 4d 65 74 61 64 61 74 61 28 22 65 78 74 72 61 44 65 62 75 67 44 65 74 61 69 6c 73 22 29 7d 29 29 2c 61 2e 73 68 6f 77 46 6f 6f 74 65 72 43 6f 6e 74 72 6f 6c 3d 69 2e 70 75 72 65 43 6f 6d 70 75 74 65 64 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 72 26 26 61 2e 70 61 67 69 6e 61 74 69 6f 6e 43 6f 6e 74 72 6f 6c 4d 65 74 68 6f 64 73 28 29 26 26 61 2e 70 61 67 69 6e 61 74 69 6f 6e 43 6f 6e 74 72 6f Data Ascii: ugDetails=i.pureComputed((function(){return a.paginationControlMethods()&&a.paginationControlMethods().currentViewHasMetadata("extraDebugDetails")})),a.showFooterControl=i.pureComputed((function(){return!r&&a.paginationControlMethods()&&a.paginationContro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49728	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:54 UTC	656	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_il6fx5t9s506cdxfu3ywpg2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:54 UTC	749	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 1352044 Cache-Control: public, max-age=31536000 Content-MD5: 6mc6BKRXxvPJN8NLMqqfjQ== Content-Type: application/x-javascript Date: Wed, 08 May 2024 15:49:54 GMT Etag: 0x8DC62D04C4F4FA3 Last-Modified: Mon, 22 Apr 2024 13:29:55 GMT Server: ECAcc (sac/255B) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 7dbd39d1-f01e-00f4-3913-95537b000000 x-ms-version: 2009-09-19 Content-Length: 55182 Connection: close
2024-05-08 15:49:54 UTC	15653	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 69 5b 6e 5d 29 72 65 74 75 72 6e 20 69 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 69 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 6e 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 74 2e 6c 6f 61 64 65 64 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 69 3d 7b 7d 3b 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 69 2c 6f 2e 70 3d 22 22 2c 6f 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 69 29 7b 69 28 32 29 3b 76 61 72 20 6e 3d 69 28 31 29 2c 74 3d 69 28 35 29 2c 72 3d 69 28 36 29 2c 61 3d 72 2e 53 74 72 69 6e Data Ascii: !function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.Strin
2024-05-08 15:49:54 UTC	16383	IN	Data Raw: 6e 3d 22 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 22 2c 65 2e 43 54 5f 56 43 5f 53 54 52 5f 50 65 6e 64 69 6e 67 5f 54 69 74 6c 65 3d 22 53 68 61 72 65 20 61 20 56 65 72 69 66 69 65 64 20 49 44 20 74 6f 20 61 63 63 65 73 73 22 2c 65 2e 43 54 5f 56 43 5f 53 54 52 5f 50 65 6e 64 69 6e 67 5f 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 4f 70 65 6e 20 74 68 65 20 4d 69 63 72 6f 73 6f 66 74 20 41 75 74 68 65 6e 74 69 63 61 74 6f 72 20 61 70 70 20 61 6e 64 20 73 63 61 6e 20 74 68 65 20 51 52 20 63 6f 64 65 20 74 6f 20 73 68 61 72 65 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 56 65 72 69 66 69 65 64 20 49 44 73 2e 22 2c 65 2e 43 54 5f 56 43 5f 53 54 52 5f 52 65 66 72 65 73 68 5f 42 75 74 74 6f 6e 3d 22 52 65 66 72 65 73 68 22 2c 6f 2e 66 55 73 65 4e 65 77 50 68 6f Data Ascii: n="Redirecting...",e.CT_VC_STR_Pending_Title="Share a Verified ID to access",e.CT_VC_STR_Pending_Description="Open the Microsoft Authenticator app and scan the QR code to share the requested Verified IDs.",e.CT_VC_STR_Refresh_Button="Refresh",o.fUseNewPho
2024-05-08 15:49:55 UTC	16383	IN	Data Raw: 73 3f 20 3c 61 20 68 72 65 66 3d 22 23 22 20 69 64 3d 22 69 44 69 73 61 6d 62 69 67 52 65 6e 61 6d 65 4c 69 6e 6b 22 3e 52 65 6e 61 6d 65 20 79 6f 75 72 20 70 65 72 73 6f 6e 61 6c 20 4d 69 63 72 6f 73 6f 66 74 20 61 63 63 6f 75 6e 74 2e 3c 2f 61 3e 27 2c 0a 65 2e 43 54 5f 53 54 52 5f 43 6f 6f 6b 69 65 42 61 6e 6e 65 72 5f 54 65 78 74 3d 27 54 68 69 73 20 73 69 74 65 20 75 73 65 73 20 63 6f 6f 6b 69 65 73 20 66 6f 72 20 61 6e 61 6c 79 74 69 63 73 2c 20 70 65 72 73 6f 6e 61 6c 69 7a 65 64 20 63 6f 6e 74 65 6e 74 20 61 6e 64 20 61 64 73 2e c2 a0 42 79 20 63 6f 6e 74 69 6e 75 69 6e 67 20 74 6f 20 62 72 6f 77 73 65 20 74 68 69 73 20 73 69 74 65 2c 20 79 6f 75 20 61 67 72 65 65 20 74 6f 20 74 68 69 73 20 75 73 65 2e 20 3c 61 20 68 72 65 66 3d 22 23 22 20 69 64 Data Ascii: s? <a href="#" id="iDisambigRenameLink">Rename your personal Microsoft account.</a>',e.CT_STR_CookieBanner_Text='This site uses cookies for analytics, personalized content and ads.By continuing to browse this site, you agree to this use. <a href="#" id
2024-05-08 15:49:55 UTC	6763	IN	Data Raw: 6f 6e 65 41 70 70 4e 6f 52 65 73 70 6f 6e 73 65 3a 22 50 68 6f 6e 65 41 70 70 4e 6f 52 65 73 70 6f 6e 73 65 22 2c 55 73 65 72 32 57 61 79 53 4d 53 41 75 74 68 46 61 69 6c 65 64 57 72 6f 6e 67 43 6f 64 65 45 6e 74 65 72 65 64 3a 22 55 73 65 72 32 57 61 79 53 4d 53 41 75 74 68 46 61 69 6c 65 64 57 72 6f 6e 67 43 6f 64 65 45 6e 74 65 72 65 64 22 2c 50 68 6f 6e 65 41 70 70 49 6e 76 61 6c 69 64 52 65 73 75 6c 74 3a 22 50 68 6f 6e 65 41 70 70 49 6e 76 61 6c 69 64 52 65 73 75 6c 74 22 2c 50 68 6f 6e 65 41 70 70 44 65 6e 69 65 64 3a 22 50 68 6f 6e 65 41 70 70 44 65 6e 69 65 64 22 2c 50 68 6f 6e 65 41 70 70 54 6f 6b 65 6e 43 68 61 6e 67 65 64 3a 22 50 68 6f 6e 65 41 70 70 54 6f 6b 65 6e 43 68 61 6e 67 65 64 22 2c 53 4d 53 41 75 74 68 46 61 69 6c 65 64 4d 61 78 41 Data Ascii: oneAppNoResponse:"PhoneAppNoResponse",User2WaySMSAuthFailedWrongCodeEntered:"User2WaySMSAuthFailedWrongCodeEntered",PhoneAppInvalidResult:"PhoneAppInvalidResult",PhoneAppDenied:"PhoneAppDenied",PhoneAppTokenChanged:"PhoneAppTokenChanged",SMSAuthFailedMaxA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49722	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:55 UTC	620	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:55 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3061376 Cache-Control: public, max-age=31536000 Content-MD5: P5ihddUjL2Zb7/wjNS1xdg== Content-Type: application/x-javascript Date: Wed, 08 May 2024 15:49:55 GMT Etag: 0x8DC4F6D50F3D2E7 Last-Modified: Thu, 28 Mar 2024 21:23:30 GMT Server: ECAcc (sac/2563) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e90429e5-301e-0014-5787-85460c000000 x-ms-version: 2009-09-19 Content-Length: 223759 Connection: close
2024-05-08 15:49:55 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-05-08 15:49:55 UTC	1	IN	Data Raw: 30 Data Ascii: 0
2024-05-08 15:49:55 UTC	16383	IN	Data Raw: 21 3d 3d 28 6e 3d 65 2e 6f 72 69 67 69 6e 61 6c 4c 69 6e 65 2d 74 2e 6f 72 69 67 69 6e 61 6c 4c 69 6e 65 29 7c 7c 30 21 3d 3d 28 6e 3d 65 2e 6f 72 69 67 69 6e 61 6c 43 6f 6c 75 6d 6e 2d 74 2e 6f 72 69 67 69 6e 61 6c 43 6f 6c 75 6d 6e 29 3f 6e 3a 66 28 65 2e 6e 61 6d 65 2c 74 2e 6e 61 6d 65 29 7d 2c 74 2e 63 6f 6d 70 61 72 65 42 79 47 65 6e 65 72 61 74 65 64 50 6f 73 69 74 69 6f 6e 73 49 6e 66 6c 61 74 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 72 3d 65 2e 67 65 6e 65 72 61 74 65 64 4c 69 6e 65 2d 74 2e 67 65 6e 65 72 61 74 65 64 4c 69 6e 65 3b 72 65 74 75 72 6e 20 30 21 3d 3d 72 7c 7c 30 21 3d 3d 28 72 3d 65 2e 67 65 6e 65 72 61 74 65 64 43 6f 6c 75 6d 6e 2d 74 2e 67 65 6e 65 72 61 74 65 64 43 6f 6c 75 6d 6e 29 7c 7c 30 21 3d 3d 28 72 Data Ascii: !==(n=e.originalLine-t.originalLine)\|\|0!==(n=e.originalColumn-t.originalColumn)?n:f(e.name,t.name)},t.compareByGeneratedPositionsInflated=function(e,t){var r=e.generatedLine-t.generatedLine;return 0!==r\|\|0!==(r=e.generatedColumn-t.generatedColumn)\|\|0!==(r
2024-05-08 15:49:55 UTC	16383	IN	Data Raw: 74 68 3b 69 2b 3d 32 29 6f 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 5b 69 5d 2b 32 35 36 2a 6e 5b 69 2b 31 5d 29 3b 72 65 74 75 72 6e 20 6f 7d 66 75 6e 63 74 69 6f 6e 20 52 28 65 2c 74 2c 72 29 7b 69 66 28 65 25 31 21 3d 30 7c 7c 65 3c 30 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 6f 66 66 73 65 74 20 69 73 20 6e 6f 74 20 75 69 6e 74 22 29 3b 69 66 28 65 2b 74 3e 72 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 54 72 79 69 6e 67 20 74 6f 20 61 63 63 65 73 73 20 62 65 79 6f 6e 64 20 62 75 66 66 65 72 20 6c 65 6e 67 74 68 22 29 7d 66 75 6e 63 74 69 6f 6e 20 4d 28 65 2c 74 2c 72 2c 6e 2c 6f 2c 69 29 7b 69 66 28 21 75 2e 69 73 42 75 66 66 65 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 Data Ascii: th;i+=2)o+=String.fromCharCode(n[i]+256*n[i+1]);return o}function R(e,t,r){if(e%1!=0\|\|e<0)throw new RangeError("offset is not uint");if(e+t>r)throw new RangeError("Trying to access beyond buffer length")}function M(e,t,r,n,o,i){if(!u.isBuffer(e))throw new
2024-05-08 15:49:55 UTC	16383	IN	Data Raw: 65 3d 74 68 69 73 3b 65 3d 65 2e 70 61 72 65 6e 74 3b 29 65 5b 68 5d 3d 21 31 7d 7d 7d 2c 7b 6b 65 79 3a 22 6e 65 78 74 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 74 68 69 73 2e 70 61 72 65 6e 74 29 72 65 74 75 72 6e 20 75 6e 64 65 66 69 6e 65 64 3b 76 61 72 20 65 3d 74 68 69 73 2e 70 61 72 65 6e 74 2e 69 6e 64 65 78 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 61 72 65 6e 74 2e 6e 6f 64 65 73 5b 65 2b 31 5d 7d 7d 2c 7b 6b 65 79 3a 22 70 6f 73 69 74 69 6f 6e 42 79 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 72 3d 74 68 69 73 2e 73 6f 75 72 63 65 2e 73 74 61 72 74 3b 69 66 28 65 2e 69 6e 64 65 78 29 72 3d 74 68 69 73 2e 70 6f 73 69 74 69 6f 6e 49 6e 73 69 64 65 28 65 2e 69 6e 64 65 Data Ascii: e=this;e=e.parent;)e[h]=!1}}},{key:"next",value:function(){if(!this.parent)return undefined;var e=this.parent.index(this);return this.parent.nodes[e+1]}},{key:"positionBy",value:function(e,t){var r=this.source.start;if(e.index)r=this.positionInside(e.inde
2024-05-08 15:49:55 UTC	16383	IN	Data Raw: 61 72 73 65 28 29 7d 63 61 74 63 68 28 73 29 7b 74 68 72 6f 77 20 73 7d 72 65 74 75 72 6e 20 69 2e 72 6f 6f 74 7d 3b 74 5b 22 64 65 66 61 75 6c 74 22 5d 3d 73 2c 65 2e 65 78 70 6f 72 74 73 3d 74 5b 22 64 65 66 61 75 6c 74 22 5d 7d 2c 35 39 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3b 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 74 5b 22 64 65 66 61 75 6c 74 22 5d 3d 76 6f 69 64 20 30 3b 76 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 74 29 7b 76 61 72 20 72 3b 72 65 74 75 72 6e 28 72 3d 65 2e 63 61 6c 6c 28 74 68 69 73 2c 74 29 7c 7c 74 68 69 73 29 2e 74 79 70 65 3d 22 63 6f 6d 6d 65 6e 74 22 2c 72 7d 72 65 74 75 72 6e 20 72 Data Ascii: arse()}catch(s){throw s}return i.root};t["default"]=s,e.exports=t["default"]},596:function(e,t,r){"use strict";var n;t.__esModule=!0,t["default"]=void 0;var o=function(e){var t,r;function n(t){var r;return(r=e.call(this,t)\|\|this).type="comment",r}return r
2024-05-08 15:49:55 UTC	4	IN	Data Raw: 65 74 75 72 Data Ascii: etur
2024-05-08 15:49:55 UTC	16383	IN	Data Raw: 6e 20 61 20 70 72 69 6d 69 74 69 76 65 20 76 61 6c 75 65 2e 22 29 7d 72 65 74 75 72 6e 28 22 73 74 72 69 6e 67 22 3d 3d 3d 74 3f 53 74 72 69 6e 67 3a 4e 75 6d 62 65 72 29 28 65 29 7d 28 65 2c 22 73 74 72 69 6e 67 22 29 3b 72 65 74 75 72 6e 22 73 79 6d 62 6f 6c 22 3d 3d 6e 28 74 29 3f 74 3a 53 74 72 69 6e 67 28 74 29 7d 76 61 72 20 73 3d 72 28 36 33 37 29 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 72 2c 6e 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 74 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 28 74 68 69 73 2c 65 29 2c 74 68 Data Ascii: n a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"==n(t)?t:String(t)}var s=r(637),a=function(){function e(t,r,n){!function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}(this,e),th
2024-05-08 15:49:55 UTC	16383	IN	Data Raw: 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 61 73 79 6e 63 28 29 2e 74 68 65 6e 28 65 2c 65 29 7d 2c 66 2e 68 61 6e 64 6c 65 45 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 72 79 7b 69 66 28 74 68 69 73 2e 65 72 72 6f 72 3d 65 2c 22 43 73 73 53 79 6e 74 61 78 45 72 72 6f 72 22 21 3d 3d 65 2e 6e 61 6d 65 7c 7c 65 2e 70 6c 75 67 69 6e 29 7b 69 66 28 74 2e 70 6f 73 74 63 73 73 56 65 72 73 69 6f 6e 29 3b 7d 65 6c 73 65 20 65 2e 70 6c 75 67 69 6e 3d 74 2e 70 6f 73 74 63 73 73 50 6c 75 67 69 6e 2c 65 2e 73 65 74 4d 65 73 73 61 67 65 28 29 7d 63 61 74 63 68 28 72 29 7b 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 26 26 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 72 29 7d 7d 2c 66 2e 61 73 79 6e 63 54 69 63 6b 3d 66 75 6e 63 Data Ascii: (e){return this.async().then(e,e)},f.handleError=function(e,t){try{if(this.error=e,"CssSyntaxError"!==e.name\|\|e.plugin){if(t.postcssVersion);}else e.plugin=t.postcssPlugin,e.setMessage()}catch(r){console&&console.error&&console.error(r)}},f.asyncTick=func
2024-05-08 15:49:55 UTC	16383	IN	Data Raw: 22 21 3d 74 79 70 65 6f 66 20 65 2e 72 61 77 73 2e 62 65 74 77 65 65 6e 29 72 65 74 75 72 6e 20 74 3d 65 2e 72 61 77 73 2e 62 65 74 77 65 65 6e 2e 72 65 70 6c 61 63 65 28 2f 5b 5e 5c 73 3a 5d 2f 67 2c 22 22 29 2c 21 31 7d 29 29 2c 74 7d 7d 2c 7b 6b 65 79 3a 22 72 61 77 45 6d 70 74 79 42 6f 64 79 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 65 2e 77 61 6c 6b 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 2e 6e 6f 64 65 73 26 26 30 3d 3d 3d 65 2e 6e 6f 64 65 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 28 74 3d 65 2e 72 61 77 73 2e 61 66 74 65 72 29 29 72 65 74 75 72 6e 21 31 7d 29 29 2c 74 7d 7d 2c 7b 6b 65 79 3a 22 72 61 77 49 6e 64 65 6e 74 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 Data Ascii: "!=typeof e.raws.between)return t=e.raws.between.replace(/[^\s:]/g,""),!1})),t}},{key:"rawEmptyBody",value:function(e){var t;return e.walk((function(e){if(e.nodes&&0===e.nodes.length&&void 0!==(t=e.raws.after))return!1})),t}},{key:"rawIndent",value:functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49730	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:55 UTC	651	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:56 UTC	719	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3990490 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Wed, 08 May 2024 15:49:56 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (sac/2574) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 2006b57c-301e-0038-6b14-7d2326000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-05-08 15:49:56 UTC	16383	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-05-08 15:49:56 UTC	791	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49731	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:56 UTC	622	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:56 UTC	749	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3060732 Cache-Control: public, max-age=31536000 Content-MD5: NuzanQiiHb2/rc4qm18OGQ== Content-Type: application/x-javascript Date: Wed, 08 May 2024 15:49:56 GMT Etag: 0x8DC4F6D51B11E63 Last-Modified: Thu, 28 Mar 2024 21:23:32 GMT Server: ECAcc (sac/2510) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 45c6eeeb-101e-0082-6f89-855b77000000 x-ms-version: 2009-09-19 Content-Length: 15708 Connection: close
2024-05-08 15:49:56 UTC	15653	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-05-08 15:49:56 UTC	55	IN	Data Raw: 31 34 3d 21 30 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 2e 2e 2f 37 63 31 61 61 37 36 30 39 33 34 35 66 39 39 65 34 39 31 34 2e 6d 61 70 Data Ascii: 14=!0;//# sourceMappingURL=../7c1aa7609345f99e4914.map

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49733	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:56 UTC	670	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:56 UTC	715	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3817613 Cache-Control: public, max-age=31536000 Content-MD5: Fm3lNHEmUlOrOkVt7+baIw== Content-Type: image/gif Date: Wed, 08 May 2024 15:49:56 GMT Etag: 0x8DB5C3F4982FD30 Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (sac/252B) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 943e5264-601e-005d-5ea6-7ee60e000000 x-ms-version: 2009-09-19 Content-Length: 2672 Connection: close
2024-05-08 15:49:56 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49732	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:56 UTC	664	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:56 UTC	715	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3990734 Cache-Control: public, max-age=31536000 Content-MD5: tUCo5RgDcZLjLE/li/Lbqw== Content-Type: image/gif Date: Wed, 08 May 2024 15:49:56 GMT Etag: 0x8DB5C3F492F3EE5 Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (sac/254F) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 2c7a14ec-b01e-00dc-3e13-7d9a59000000 x-ms-version: 2009-09-19 Content-Length: 3620 Connection: close
2024-05-08 15:49:56 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49734	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:57 UTC	406	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:57 UTC	719	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3990491 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Wed, 08 May 2024 15:49:57 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (sac/2574) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 2006b57c-301e-0038-6b14-7d2326000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-05-08 15:49:57 UTC	16383	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-05-08 15:49:57 UTC	791	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49735	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:57 UTC	419	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:57 UTC	715	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3990735 Cache-Control: public, max-age=31536000 Content-MD5: tUCo5RgDcZLjLE/li/Lbqw== Content-Type: image/gif Date: Wed, 08 May 2024 15:49:57 GMT Etag: 0x8DB5C3F492F3EE5 Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (sac/254F) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 2c7a14ec-b01e-00dc-3e13-7d9a59000000 x-ms-version: 2009-09-19 Content-Length: 3620 Connection: close
2024-05-08 15:49:57 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49736	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:57 UTC	425	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:57 UTC	715	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3817614 Cache-Control: public, max-age=31536000 Content-MD5: Fm3lNHEmUlOrOkVt7+baIw== Content-Type: image/gif Date: Wed, 08 May 2024 15:49:57 GMT Etag: 0x8DB5C3F4982FD30 Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (sac/252B) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 943e5264-601e-005d-5ea6-7ee60e000000 x-ms-version: 2009-09-19 Content-Length: 2672 Connection: close
2024-05-08 15:49:57 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49738	13.107.213.70	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:57 UTC	703	OUT	GET /c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/illustration?ts=637215083190613316 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:59 UTC	739	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 15:49:59 GMT Content-Type: image/* Content-Length: 241446 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Fri, 03 Apr 2020 10:58:39 GMT ETag: 0x8D7D7BDF76988E8 x-ms-request-id: 699d098a-401e-0044-505f-a1d193000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240508T154957Z-17c65945bcb85t7fdd7vae9k7n000000054g00000000nnke x-fd-int-roxy-purgeid: 50755578 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-05-08 15:49:59 UTC	15645	IN	Data Raw: ff d8 ff e1 10 3c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 0c 01 00 00 03 00 00 00 01 07 80 00 00 01 01 00 03 00 00 00 01 04 38 00 00 01 02 00 03 00 00 00 03 00 00 00 9e 01 06 00 03 00 00 00 01 00 02 00 00 01 12 00 03 00 00 00 01 00 01 00 00 01 15 00 03 00 00 00 01 00 03 00 00 01 1a 00 05 00 00 00 01 00 00 00 a4 01 1b 00 05 00 00 00 01 00 00 00 ac 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 b4 01 32 00 02 00 00 00 14 00 00 00 d3 87 69 00 04 00 00 00 01 00 00 00 e8 00 00 01 20 00 08 00 08 00 08 00 0a fc 80 00 00 27 10 00 0a fc 80 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 30 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 30 3a 30 34 3a 30 33 20 31 31 3a 35 38 3a 32 33 00 00 00 04 90 00 00 07 00 00 00 04 30 Data Ascii: <ExifMM*8(12i ''Adobe Photoshop 21.0 (Windows)2020:04:03 11:58:230
2024-05-08 15:49:59 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2024-05-08 15:49:59 UTC	16384	IN	Data Raw: 96 06 21 7b 6c 84 9c 29 41 03 c9 80 f0 c5 57 b1 a9 03 b7 7c b2 21 90 7e e7 7f cf b5 7c a1 fa 23 c8 57 de 6d 99 69 26 a7 74 55 49 eb c1 32 e6 71 d9 fa 36 7c 72 27 75 2b 41 a9 a6 41 81 36 b9 05 48 c8 da 84 f7 4e 4a 02 de 39 16 74 9c 0e 99 12 50 d7 5c 8a 90 b9 00 ad 4f 41 fc 31 28 25 f8 57 ff 00 39 cd e6 bf ae 2d d4 71 bd 5a ff 00 52 65 1f ea 47 82 9a cb f3 71 7c 32 61 31 0b d9 b6 03 df 0a a8 3b 72 90 91 88 2a a7 25 5f e0 15 24 d0 0f 99 cc 88 14 bf a4 df f9 c6 bf 2c 0f 29 7e 59 79 77 47 e3 c5 da d5 66 71 fe 54 9f 16 12 c8 3d dc 8d b6 ca e6 82 a9 16 d9 04 2b a2 d5 a9 84 ab 28 85 38 a8 af 86 40 b3 5f d0 ed 91 e6 ad 72 ed 81 57 83 41 8a ae 8c 80 d5 3b 0c 55 f8 3d ff 00 39 8f ad 49 7f a8 eb 37 c9 27 25 bf d5 e4 86 33 4e b1 c0 02 f8 f8 e2 c7 89 f0 a2 4c 57 67 19 Data Ascii: !{l)AW\|!~\|#Wmi&tUI2q6\|r'u+AA6HNJ9tP\OA1(%W9-qZReGq\|2a1;r*%_$,)~YywGfqT=+(8@_rWA;U=9I7'%3NLWg
2024-05-08 15:49:59 UTC	16384	IN	Data Raw: 2f f3 64 42 48 e5 6f 15 59 07 d0 46 1b 54 92 d1 81 45 61 d2 98 12 9a b2 7a 90 3a fb 61 b4 bc a6 e8 70 77 07 1b 54 c3 4a bd 58 94 a1 c0 a9 ab 5d 3c 9f 67 be 2a d7 a3 24 9d 4e 2a 8b 4b 45 5f b5 be 10 14 23 63 45 5e 83 0d 25 5b a6 f8 90 a5 53 bd 32 28 01 20 03 ea fa 93 29 e8 ea 18 62 9a 64 88 77 07 14 22 c0 dc 62 a8 80 70 85 57 43 4a d3 02 af 53 f8 64 d5 7b 37 7c 2a d8 34 db 7c 0a aa 9b 8a 61 01 56 1a 9a 9c 55 8e ea 70 fa 91 4b 1f 8a 9c 81 36 84 3e 83 27 2b 78 c3 75 15 07 10 52 03 32 88 ed 41 d3 25 6a ac 3c 3b 62 8b 5c a7 7d f1 55 6a ed 5e f8 a0 b6 0d 71 4d 2f fb 27 14 2a 06 c5 55 15 a9 8a af ad 71 64 87 be 51 2c 2d 11 fd a5 38 a6 d8 97 95 e5 a4 52 5a 1e b1 39 1b f8 64 7a 21 97 c4 d5 c0 aa a6 80 e2 85 45 db 71 8a 5b 26 a3 15 40 b8 e4 0d 71 56 67 a5 41 fa 63 Data Ascii: /dBHoYFTEaz:apwTJX]<g$NKE_#cE^%[S2( )bdw"bpWCJSd{7\|4\|aVUpK6>'+xuR2A%j<;b\}Uj^qM/'UqdQ,-8RZ9dz!Eq[&@qVgAc
2024-05-08 15:49:59 UTC	16384	IN	Data Raw: 14 c2 94 7c 71 9a f8 0c 55 11 41 b0 c5 54 a4 34 18 ab 12 f3 a0 e7 e5 fd 5b fe 60 a6 ff 00 88 e0 56 35 f9 2a fc bc a5 a7 03 5a 88 cf eb c4 2b d7 83 50 e4 95 79 61 df 1b 55 26 3e 38 15 61 60 3b e4 ad 56 16 f7 df 22 ab 79 78 e2 ab 59 87 41 88 55 32 6a 6b 87 9a ac 27 08 50 b0 36 34 ab 4e 46 95 4d 9a 98 aa de 5d 6b 8a d2 81 38 ab 51 91 cc 03 80 ab e6 9f c9 60 6d f5 9f 35 d9 0e 86 f3 d4 ff 00 86 6c 0a fa 02 bd f1 57 72 ae c7 0a ad ae fb 62 15 c4 1e b8 55 61 7c 0a b5 9b 08 2a a0 e6 bd 31 54 3d 36 a1 eb 91 48 63 7e 74 8b d6 d0 6f a3 02 a7 d3 af dd 88 52 f8 e1 0f c2 2b e0 32 25 82 f2 45 2b 81 5b 07 15 4a b5 8f b1 19 f0 6c 52 cf 34 e7 0f 63 0f b6 48 35 96 37 af 0a 4a 09 f0 c2 86 34 c3 e1 db c7 15 43 b0 ae d8 a6 2b 22 5a c1 79 1a ff 00 28 6a 7c b2 0c d4 e3 23 88 f9 Data Ascii: \|qUAT4[`V5Z+PyaU&>8a`;V"yxYAU2jk'P64NFM]k8Q`m5lWrbUa\|1T=6Hc~toR+2%E+[JlR4cH57J4C+"Zy(j\|#
2024-05-08 15:49:59 UTC	16384	IN	Data Raw: 45 47 d3 90 45 a0 a6 d4 60 b7 a9 77 03 25 b2 58 ae a3 e7 2b 2b 31 bc 8b f7 e0 b5 0f 08 fc e0 f3 fc 5a a7 96 6e f4 8b 72 09 9a 48 7e e5 6a e1 b4 be 49 af 8e 49 8a c6 6c 2a a4 cf 5e 98 aa 83 3e 2a a4 5f be 02 aa 0c d5 c4 2a 8b 36 2a 96 5e 92 d6 f3 20 ea 63 7a 7f c0 9c 0a f2 ff 00 c8 37 ff 00 9d 61 92 bd 2f 27 07 fe 0b 15 7b 49 6e c3 15 5a 4f 73 8a bb 90 ef 81 56 13 bd 46 49 5a 0d 5a e0 55 32 d4 eb 8a a9 f2 ae 1a 56 ab 4c 2a b4 b6 1b 55 3a e0 55 36 3e f8 0a 54 4b 50 e2 10 b0 b5 77 df 12 9a 52 2d 5f 9e 04 29 57 b1 d8 e2 af 0d fc e1 8c 1b ef 2f dc 7f 2d d1 1f ab 15 7b 34 87 7a fc bf 56 2a b5 4d 77 ae d8 ab b9 75 ae 2a d1 6f 0c 55 4d 89 c5 54 b9 11 d7 a9 c5 54 99 ab d3 15 6b a6 2a e2 76 fa 71 57 81 7e 6f 25 2f 6d 67 a7 58 ca e2 af 24 ae 41 8b 86 fb 9c 55 72 b6 Data Ascii: EGE`w%X++1ZnrH~jIIl^>_6^ cz7a/'{InZOsVFIZZU2VLU:U6>TKPwR-_)W/-{4zVMwuoUMTTkvqW~o%/mgX$AUr
2024-05-08 15:49:59 UTC	16384	IN	Data Raw: 10 d2 5d 04 34 f0 ca cc d9 08 a0 de f7 c3 20 66 c8 05 16 bb 76 1e de 19 13 91 90 08 67 ba a7 da 39 0e 22 b5 49 6d c6 a8 91 8d da a7 26 01 2c 09 79 d7 e6 1f 9c ff 00 42 79 6b 57 d5 53 6f 4a d2 40 1a b4 dc 82 32 d8 86 b2 fe 6f ff 00 35 b5 13 36 95 63 09 eb 75 7d 71 74 df 49 a6 5f 00 c6 41 e1 e1 b7 ae 58 0b 1e 15 2b 93 f0 85 fe 66 03 0d a5 b7 90 99 1e 9f cd 4f bb 6c 28 d9 2b bb 7f 8c 92 7e ca 9c 01 84 b6 55 d2 be 36 54 1d d8 61 40 7b 54 a0 47 e9 c5 e0 a3 22 ce a9 38 b7 90 00 07 b6 49 1c 49 dd bb f8 7c b1 43 d7 bc bf e7 5d 56 ca 31 0c 17 0c 14 00 a3 7e 80 61 e1 b4 71 33 15 f3 7e ab 75 4f 52 e6 4f f8 23 96 08 31 e2 44 a5 f5 c4 bb cd 33 b7 2f f2 8e 11 8d 81 95 a3 60 62 4f 26 66 3f 4e 3c 34 8b 64 36 ec 14 6d be 48 30 28 cf 5e 80 64 92 a5 2d dd 00 dc 03 84 20 1b Data Ascii: ]4 fvg9"Im&,yBykWSoJ@2o56cu}qtI_AX+fOl(+~U6Ta@{TG"8II\|C]V1~aq3~uORO#1D3/`bO&f?N<4d6mH0(^d-
2024-05-08 15:49:59 UTC	16384	IN	Data Raw: 40 65 91 71 f2 3e b6 ff 00 9c 7a f3 95 d3 e8 3f e1 f0 ff 00 15 a3 14 a0 f0 cc 88 0b 75 f9 4d 3d f6 2b d9 e5 04 48 c4 9f 73 99 30 83 8a 72 14 b6 fb 99 21 eb 97 70 d3 59 99 41 db a0 27 7d eb 84 84 db 22 f2 ad f1 d2 ef 59 93 6e 40 8c aa 51 50 53 bb 2d 4a ea d7 cc 13 1f 50 88 ae 10 38 15 da ab 94 c8 37 c1 ec 93 f9 8a 3d 4e c4 da 96 0e cb b3 0f 0c 83 72 8f 94 a6 11 6a a9 0b 1a 2c ab c3 20 df 09 3f ff d5 f9 15 04 6f 33 2c 31 82 d2 48 cb 1a 81 d4 96 34 1f af 33 a0 18 d3 fa b6 ff 00 9c 7e f2 2a fe 5c 7e 5c f9 73 ca 5c 42 cb 05 8c 4f 35 05 2a ee a0 b1 3f 4e 48 b2 7a fb 1a 1a 0f 0c a8 b1 53 a6 fb 57 22 58 14 42 81 81 42 6d a7 46 0b d7 c0 64 64 db 16 50 36 eb 95 96 56 d8 35 eb 80 30 2f c9 bf f9 f8 bf e6 10 b1 b8 4d 1e 37 f8 74 cd 3e 4b 86 50 7a 49 2f c2 9f 4e f9 1a Data Ascii: @eq>z?uM=+Hs0r!pYA'}"Yn@QPS-JP87=Nrj, ?o3,1H43~\~\s\BO5?NHzSW"XBBmFddP6V50/M7t>KPzI/N
2024-05-08 15:49:59 UTC	16384	IN	Data Raw: 6c 54 2c e5 4c 55 65 71 57 72 ee 71 55 85 c7 7c 53 6c 63 cd a3 9e 8f 78 3f e2 a3 fa f2 25 05 09 e4 99 39 e8 d6 c7 c0 11 f8 e0 56 60 0e 4c 2a ec 2a d8 e9 53 81 5a af 86 14 ad 27 c3 02 16 13 8a a8 39 c5 50 a5 a8 70 2a 8b 75 a6 2a f1 cf 39 27 1d 4d 9b f9 95 4f e1 95 d5 b2 0c 57 be df 2c 69 8a ea 7b d3 08 d9 0b 7a 9a 8c 24 a8 60 be 71 4f df 41 21 e8 50 8c 83 2e 6c 3c ef 8b 12 1a 02 98 a8 0d 91 4a 53 14 ba bb 62 ad 62 ad 62 ad 83 4c 55 52 bd c6 10 a8 dd 33 53 9f 48 ba 8b 52 b1 72 92 c6 c0 82 36 e9 89 45 bf 51 bf 26 ff 00 32 21 f3 ce 94 82 47 1f 5b 85 42 b0 ae e6 83 20 97 b4 9a d0 d7 10 a9 7d e2 f2 8d d0 f7 53 f8 8c 98 57 e5 bf 9a ed fe a7 af ea 76 9f cb 70 f8 da a5 48 76 c6 d5 10 0d 7a 61 57 d1 1f f3 8e 62 1b ad 76 f7 45 bb 15 8e f2 cd 81 1e 24 61 56 1f f9 99 Data Ascii: lT,LUeqWrqU\|Slcx?%9V`L*SZ'9Ppu*9'MOW,i{z$`qOA!P.l<JSbbbLUR3SHRr6EQ&2!G[B }SWvpHvzaWbvE$aV
2024-05-08 15:49:59 UTC	16384	IN	Data Raw: ad 63 8a ad c5 5b 07 c7 15 6c 1a 62 ad 13 5c 55 63 0a 8a 62 ab 41 28 72 6a bf 95 72 0a bb a7 5c 55 c4 d7 15 68 ef 8a ae 0d 41 8a 43 8b 62 a5 61 34 c5 0d 72 c5 5d cb 15 5d 5f 0c 24 ab 47 02 ac a9 eb 8a ae 1e f8 ab aa 31 4d bb 71 8a 1d 5a e2 ad 71 c5 5c 71 57 1f c7 15 5a 77 df 1b 4b 78 da 92 ec 16 87 62 ae c5 5d 8a bb 15 5c 7a 62 ab 71 57 57 15 5d cb b6 2a a9 4a 8a 8c 6d 2b 7e 58 50 f7 6f c9 c0 56 ce fb 8e e7 d7 42 7f e0 72 41 5e d8 1e a2 b9 3b 55 ea 71 0a e3 be e3 1b 56 d4 d3 ae 02 ad 83 b6 db e0 56 b9 0a d7 24 15 aa e1 55 c4 e0 bb 57 94 f9 aa 12 9e 65 d3 ee 8f 42 54 7e 39 14 3d 8d ea 1c 83 e2 72 41 2d 63 e6 ae 07 c7 1b 55 a4 f8 63 ba b4 5b b7 6c 1b ab 8b 60 55 3a e4 d5 69 6c 17 4a b0 9c 04 aa d6 38 15 65 40 eb 8a 16 d4 74 03 14 ae 24 62 ab 09 c5 56 9d ba Data Ascii: c[lb\UcbA(rjr\UhACba4r]]_$G1MqZq\qWZwKxb]\zbqWW]*Jm+~XPoVBrA^;UqVV$UWeBT~9=rA-cUc[l`U:ilJ8e@t$bV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49737	13.107.213.70	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:57 UTC	701	OUT	GET /c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/bannerlogo?ts=637217897975221135 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:58 UTC	737	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 15:49:58 GMT Content-Type: image/* Content-Length: 4900 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Mon, 06 Apr 2020 17:09:57 GMT ETag: 0x8D7DA4D557EE74B x-ms-request-id: dded9ed6-301e-0013-375f-a17fa0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240508T154957Z-17c65945bcb6v65wtps664a6z000000004x00000000093pr x-fd-int-roxy-purgeid: 50755578 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-05-08 15:49:58 UTC	4900	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 18 00 00 00 3a 08 03 00 00 00 5c 43 b6 37 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 03 00 50 4c 54 45 00 00 00 ee 7d 7c ec 70 70 e3 25 25 e2 1f 1f ac a4 a6 e6 3d 3c e9 5a 5a c7 8a 8b e2 26 25 a6 a1 a3 eb 65 65 eb 65 65 e5 34 33 e4 31 31 9c 9d 9f 9c 9a 9c e5 34 34 e7 4c 4c e4 31 31 f0 84 83 e8 4a 4a ee 7a 7a f0 8e 8e e2 26 25 e6 3f 3f ed 70 70 e4 2b 2a f1 90 90 e8 49 49 e1 15 15 e3 2b 2a e6 3e 3e f3 9d 9d e5 31 31 94 95 98 e7 43 43 e2 25 24 e2 25 25 e9 4e 4e e1 1d 1c a9 a9 ab b2 b2 b4 ec 6d 6d e8 50 50 8f 8f 93 e6 3c 3c e9 54 54 f3 a3 a2 7d 7e 82 ae b3 b6 93 93 96 96 98 9b 9b 9b 9e 93 94 96 e7 43 43 e3 24 24 e6 3f 3f e6 42 42 ec 6b 6b e9 53 53 85 86 Data Ascii: PNGIHDR:\C7gAMAasRGBPLTE}\|pp%%=<ZZ&%eeee431144LL11JJzz&%??pp+II+>>11CC%$%%NNmmPP<<TT}~CC$$??BBkkSS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49739	20.190.151.70	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:57 UTC	727	OUT	GET /6ef02721-9d08-4e5a-b493-ca348312dd39/winauth/ssoprobe?client-request-id=c39cabc7-d05b-44f2-80cb-1ea2f657286a&_=1715183396054 HTTP/1.1 Host: autologon.microsoftazuread-sso.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:58 UTC	1180	IN	HTTP/1.1 401 Unauthorized Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: image/png; charset=utf-8 Expires: -1 Vary: Origin X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://login.microsoftonline.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, OPTIONS P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: be16f752-5572-4468-b14d-f5e1d9565500 x-ms-ests-server: 2.1.18037.7 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+est"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Referrer-Policy: strict-origin-when-cross-origin X-XSS-Protection: 0 WWW-Authenticate: Negotiate Set-Cookie: fpc=Amh1JrQ0ueZDgOiq7Lurq8Y; expires=Fri, 07-Jun-2024 15:49:58 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 08 May 2024 15:49:57 GMT Connection: close Content-Length: 12
2024-05-08 15:49:58 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49743	13.107.246.70	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:59 UTC	456	OUT	GET /c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/bannerlogo?ts=637217897975221135 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:49:59 UTC	757	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 15:49:59 GMT Content-Type: image/* Content-Length: 4900 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Mon, 06 Apr 2020 17:09:57 GMT ETag: 0x8D7DA4D557EE74B x-ms-request-id: dded9ed6-301e-0013-375f-a17fa0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240508T154959Z-17c65945bcbvk4l659yvhryr5c00000004r0000000028r6q x-fd-int-roxy-purgeid: 50755578 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-05-08 15:49:59 UTC	4900	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 18 00 00 00 3a 08 03 00 00 00 5c 43 b6 37 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 03 00 50 4c 54 45 00 00 00 ee 7d 7c ec 70 70 e3 25 25 e2 1f 1f ac a4 a6 e6 3d 3c e9 5a 5a c7 8a 8b e2 26 25 a6 a1 a3 eb 65 65 eb 65 65 e5 34 33 e4 31 31 9c 9d 9f 9c 9a 9c e5 34 34 e7 4c 4c e4 31 31 f0 84 83 e8 4a 4a ee 7a 7a f0 8e 8e e2 26 25 e6 3f 3f ed 70 70 e4 2b 2a f1 90 90 e8 49 49 e1 15 15 e3 2b 2a e6 3e 3e f3 9d 9d e5 31 31 94 95 98 e7 43 43 e2 25 24 e2 25 25 e9 4e 4e e1 1d 1c a9 a9 ab b2 b2 b4 ec 6d 6d e8 50 50 8f 8f 93 e6 3c 3c e9 54 54 f3 a3 a2 7d 7e 82 ae b3 b6 93 93 96 96 98 9b 9b 9b 9e 93 94 96 e7 43 43 e3 24 24 e6 3f 3f e6 42 42 ec 6b 6b e9 53 53 85 86 Data Ascii: PNGIHDR:\C7gAMAasRGBPLTE}\|pp%%=<ZZ&%eeee431144LL11JJzz&%??pp+II+>>11CC%$%%NNmmPP<<TT}~CC$$??BBkkSS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49744	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:59 UTC	665	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:50:00 UTC	738	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20488888 Cache-Control: public, max-age=31536000 Content-MD5: R2FAVxfpONfnQAuxVxXbHg== Content-Type: image/svg+xml Date: Wed, 08 May 2024 15:49:59 GMT Etag: 0x8DB5C3F4BB4F03C Last-Modified: Wed, 24 May 2023 10:11:52 GMT Server: ECAcc (sac/253C) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 3a7bcc78-201e-001d-2406-e7351f000000 x-ms-version: 2009-09-19 Content-Length: 1592 Connection: close
2024-05-08 15:50:00 UTC	1592	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49745	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:49:59 UTC	626	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:50:00 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3060897 Cache-Control: public, max-age=31536000 Content-MD5: /PcUcu/J5hSxDf1JmAX3KQ== Content-Type: application/x-javascript Date: Wed, 08 May 2024 15:49:59 GMT Etag: 0x8DC4F6D5254E400 Last-Modified: Thu, 28 Mar 2024 21:23:33 GMT Server: ECAcc (sac/2519) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1d35613f-201e-00f1-6788-85d471000000 x-ms-version: 2009-09-19 Content-Length: 113657 Connection: close
2024-05-08 15:50:00 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-05-08 15:50:00 UTC	1	IN	Data Raw: 69 Data Ascii: i
2024-05-08 15:50:00 UTC	16383	IN	Data Raw: 74 60 20 70 72 65 73 65 74 2c 20 63 61 6e 27 74 20 62 65 20 65 6d 70 74 79 22 29 3b 72 65 74 75 72 6e 20 65 2e 6f 70 74 69 6f 6e 73 26 26 72 2e 73 65 74 28 65 2e 6f 70 74 69 6f 6e 73 29 2c 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 26 26 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 5b 74 5d 2e 72 75 6c 65 73 26 26 72 5b 74 5d 2e 72 75 6c 65 72 2e 65 6e 61 62 6c 65 4f 6e 6c 79 28 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 5b 74 5d 2e 72 75 6c 65 73 29 2c 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 5b 74 5d 2e 72 75 6c 65 73 32 26 26 72 5b 74 5d 2e 72 75 6c 65 72 32 2e 65 6e 61 62 6c 65 4f 6e 6c 79 28 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 5b 74 5d 2e Data Ascii: t` preset, can't be empty");return e.options&&r.set(e.options),e.components&&Object.keys(e.components).forEach((function(t){e.components[t].rules&&r[t].ruler.enableOnly(e.components[t].rules),e.components[t].rules2&&r[t].ruler2.enableOnly(e.components[t].
2024-05-08 15:50:00 UTC	16383	IN	Data Raw: 30 33 66 30 22 2c 22 4b 63 65 64 69 6c 22 3a 22 5c 75 30 31 33 36 22 2c 22 6b 63 65 64 69 6c 22 3a 22 5c 75 30 31 33 37 22 2c 22 4b 63 79 22 3a 22 5c 75 30 34 31 61 22 2c 22 6b 63 79 22 3a 22 5c 75 30 34 33 61 22 2c 22 4b 66 72 22 3a 22 5c 75 64 38 33 35 5c 75 64 64 30 65 22 2c 22 6b 66 72 22 3a 22 5c 75 64 38 33 35 5c 75 64 64 32 38 22 2c 22 6b 67 72 65 65 6e 22 3a 22 5c 75 30 31 33 38 22 2c 22 4b 48 63 79 22 3a 22 5c 75 30 34 32 35 22 2c 22 6b 68 63 79 22 3a 22 5c 75 30 34 34 35 22 2c 22 4b 4a 63 79 22 3a 22 5c 75 30 34 30 63 22 2c 22 6b 6a 63 79 22 3a 22 5c 75 30 34 35 63 22 2c 22 4b 6f 70 66 22 3a 22 5c 75 64 38 33 35 5c 75 64 64 34 32 22 2c 22 6b 6f 70 66 22 3a 22 5c 75 64 38 33 35 5c 75 64 64 35 63 22 2c 22 4b 73 63 72 22 3a 22 5c 75 64 38 33 35 5c Data Ascii: 03f0","Kcedil":"\u0136","kcedil":"\u0137","Kcy":"\u041a","kcy":"\u043a","Kfr":"\ud835\udd0e","kfr":"\ud835\udd28","kgreen":"\u0138","KHcy":"\u0425","khcy":"\u0445","KJcy":"\u040c","kjcy":"\u045c","Kopf":"\ud835\udd42","kopf":"\ud835\udd5c","Kscr":"\ud835\
2024-05-08 15:50:00 UTC	16383	IN	Data Raw: 63 61 72 6f 6e 22 3a 22 5c 75 30 31 36 30 22 2c 22 73 63 61 72 6f 6e 22 3a 22 5c 75 30 31 36 31 22 2c 22 53 63 22 3a 22 5c 75 32 61 62 63 22 2c 22 73 63 22 3a 22 5c 75 32 32 37 62 22 2c 22 73 63 63 75 65 22 3a 22 5c 75 32 32 37 64 22 2c 22 73 63 65 22 3a 22 5c 75 32 61 62 30 22 2c 22 73 63 45 22 3a 22 5c 75 32 61 62 34 22 2c 22 53 63 65 64 69 6c 22 3a 22 5c 75 30 31 35 65 22 2c 22 73 63 65 64 69 6c 22 3a 22 5c 75 30 31 35 66 22 2c 22 53 63 69 72 63 22 3a 22 5c 75 30 31 35 63 22 2c 22 73 63 69 72 63 22 3a 22 5c 75 30 31 35 64 22 2c 22 73 63 6e 61 70 22 3a 22 5c 75 32 61 62 61 22 2c 22 73 63 6e 45 22 3a 22 5c 75 32 61 62 36 22 2c 22 73 63 6e 73 69 6d 22 3a 22 5c 75 32 32 65 39 22 2c 22 73 63 70 6f 6c 69 6e 74 22 3a 22 5c 75 32 61 31 33 22 2c 22 73 63 73 69 Data Ascii: caron":"\u0160","scaron":"\u0161","Sc":"\u2abc","sc":"\u227b","sccue":"\u227d","sce":"\u2ab0","scE":"\u2ab4","Scedil":"\u015e","scedil":"\u015f","Scirc":"\u015c","scirc":"\u015d","scnap":"\u2aba","scnE":"\u2ab6","scnsim":"\u22e9","scpolint":"\u2a13","scsi
2024-05-08 15:50:00 UTC	16383	IN	Data Raw: 5b 5d 2c 63 3c 30 3f 6c 2e 70 75 73 68 28 5b 22 63 6c 61 73 73 22 2c 72 2e 6c 61 6e 67 50 72 65 66 69 78 2b 64 5d 29 3a 28 6c 5b 63 5d 3d 6c 5b 63 5d 2e 73 6c 69 63 65 28 29 2c 6c 5b 63 5d 5b 31 5d 2b 3d 22 20 22 2b 72 2e 6c 61 6e 67 50 72 65 66 69 78 2b 64 29 2c 70 3d 7b 61 74 74 72 73 3a 6c 7d 2c 22 3c 70 72 65 3e 3c 63 6f 64 65 22 2b 69 2e 72 65 6e 64 65 72 41 74 74 72 73 28 70 29 2b 22 3e 22 2b 61 2b 22 3c 2f 63 6f 64 65 3e 3c 2f 70 72 65 3e 5c 6e 22 29 3a 22 3c 70 72 65 3e 3c 63 6f 64 65 22 2b 69 2e 72 65 6e 64 65 72 41 74 74 72 73 28 68 29 2b 22 3e 22 2b 61 2b 22 3c 2f 63 6f 64 65 3e 3c 2f 70 72 65 3e 5c 6e 22 7d 2c 69 2e 69 6d 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 2c 6e 2c 73 29 7b 76 61 72 20 6f 3d 65 5b 74 5d 3b 72 65 74 75 72 6e Data Ascii: [],c<0?l.push(["class",r.langPrefix+d]):(l[c]=l[c].slice(),l[c][1]+=" "+r.langPrefix+d),p={attrs:l},"<pre><code"+i.renderAttrs(p)+">"+a+"</code></pre>\n"):"<pre><code"+i.renderAttrs(h)+">"+a+"</code></pre>\n"},i.image=function(e,t,r,n,s){var o=e[t];return
2024-05-08 15:50:00 UTC	4	IN	Data Raw: 6f 75 6e 74 Data Ascii: ount
2024-05-08 15:50:00 UTC	16383	IN	Data Raw: 5b 74 5d 2d 65 2e 62 6c 6b 49 6e 64 65 6e 74 3e 3d 34 29 62 72 65 61 6b 3b 66 6f 72 28 4c 3d 21 31 2c 63 3d 30 2c 64 3d 7a 2e 6c 65 6e 67 74 68 3b 63 3c 64 3b 63 2b 2b 29 69 66 28 7a 5b 63 5d 28 65 2c 76 2c 72 2c 21 30 29 29 7b 4c 3d 21 30 3b 62 72 65 61 6b 7d 69 66 28 4c 29 62 72 65 61 6b 3b 69 66 28 68 29 7b 69 66 28 28 45 3d 6f 28 65 2c 76 29 29 3c 30 29 62 72 65 61 6b 3b 46 3d 65 2e 62 4d 61 72 6b 73 5b 76 5d 2b 65 2e 74 53 68 69 66 74 5b 76 5d 7d 65 6c 73 65 20 69 66 28 28 45 3d 73 28 65 2c 76 29 29 3c 30 29 62 72 65 61 6b 3b 69 66 28 5f 21 3d 3d 65 2e 73 72 63 2e 63 68 61 72 43 6f 64 65 41 74 28 45 2d 31 29 29 62 72 65 61 6b 7d 72 65 74 75 72 6e 28 52 3d 68 3f 65 2e 70 75 73 68 28 22 6f 72 64 65 72 65 64 5f 6c 69 73 74 5f 63 6c 6f 73 65 22 2c 22 6f Data Ascii: [t]-e.blkIndent>=4)break;for(L=!1,c=0,d=z.length;c<d;c++)if(z[c](e,v,r,!0)){L=!0;break}if(L)break;if(h){if((E=o(e,v))<0)break;F=e.bMarks[v]+e.tShift[v]}else if((E=s(e,v))<0)break;if(_!==e.src.charCodeAt(E-1))break}return(R=h?e.push("ordered_list_close","o
2024-05-08 15:50:00 UTC	15354	IN	Data Raw: 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 2c 6e 3d 30 2c 73 3d 65 2e 74 6f 6b 65 6e 73 2c 6f 3d 65 2e 74 6f 6b 65 6e 73 2e 6c 65 6e 67 74 68 3b 66 6f 72 28 74 3d 72 3d 30 3b 74 3c 6f 3b 74 2b 2b 29 73 5b 74 5d 2e 6e 65 73 74 69 6e 67 3c 30 26 26 6e 2d 2d 2c 73 5b 74 5d 2e 6c 65 76 65 6c 3d 6e 2c 73 5b 74 5d 2e 6e 65 73 74 69 6e 67 3e 30 26 26 6e 2b 2b 2c 22 74 65 78 74 22 3d 3d 3d 73 5b 74 5d 2e 74 79 70 65 26 26 74 2b 31 3c 6f 26 26 22 74 65 78 74 22 3d 3d 3d 73 5b 74 2b 31 5d 2e 74 79 70 65 3f 73 5b 74 2b 31 5d 2e 63 6f 6e 74 65 6e 74 3d 73 5b 74 5d 2e 63 6f 6e 74 65 6e 74 2b 73 5b 74 2b 31 5d 2e 63 6f 6e 74 65 6e 74 3a 28 74 21 3d 3d 72 26 26 28 73 5b 72 5d 3d 73 5b 74 5d 29 2c 72 2b 2b 29 3b 74 21 3d 3d 72 26 26 28 73 2e 6c 65 6e 67 74 68 3d 72 Data Ascii: ction(e){var t,r,n=0,s=e.tokens,o=e.tokens.length;for(t=r=0;t<o;t++)s[t].nesting<0&&n--,s[t].level=n,s[t].nesting>0&&n++,"text"===s[t].type&&t+1<o&&"text"===s[t+1].type?s[t+1].content=s[t].content+s[t+1].content:(t!==r&&(s[r]=s[t]),r++);t!==r&&(s.length=r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49753	152.199.4.44	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:50:00 UTC	420	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:50:00 UTC	738	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20488889 Cache-Control: public, max-age=31536000 Content-MD5: R2FAVxfpONfnQAuxVxXbHg== Content-Type: image/svg+xml Date: Wed, 08 May 2024 15:50:00 GMT Etag: 0x8DB5C3F4BB4F03C Last-Modified: Wed, 24 May 2023 10:11:52 GMT Server: ECAcc (sac/253C) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 3a7bcc78-201e-001d-2406-e7351f000000 x-ms-version: 2009-09-19 Content-Length: 1592 Connection: close
2024-05-08 15:50:00 UTC	1592	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49749	13.107.246.70	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-08 15:50:00 UTC	458	OUT	GET /c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/illustration?ts=637215083190613316 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-08 15:50:01 UTC	759	IN	HTTP/1.1 200 OK Date: Wed, 08 May 2024 15:50:00 GMT Content-Type: image/* Content-Length: 241446 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Fri, 03 Apr 2020 10:58:39 GMT ETag: 0x8D7D7BDF76988E8 x-ms-request-id: 699d098a-401e-0044-505f-a1d193000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240508T155000Z-17c65945bcbjgbzl82qfb00z0c00000005d000000000t76e x-fd-int-roxy-purgeid: 50755578 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-05-08 15:50:01 UTC	15625	IN	Data Raw: ff d8 ff e1 10 3c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 0c 01 00 00 03 00 00 00 01 07 80 00 00 01 01 00 03 00 00 00 01 04 38 00 00 01 02 00 03 00 00 00 03 00 00 00 9e 01 06 00 03 00 00 00 01 00 02 00 00 01 12 00 03 00 00 00 01 00 01 00 00 01 15 00 03 00 00 00 01 00 03 00 00 01 1a 00 05 00 00 00 01 00 00 00 a4 01 1b 00 05 00 00 00 01 00 00 00 ac 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 b4 01 32 00 02 00 00 00 14 00 00 00 d3 87 69 00 04 00 00 00 01 00 00 00 e8 00 00 01 20 00 08 00 08 00 08 00 0a fc 80 00 00 27 10 00 0a fc 80 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 30 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 30 3a 30 34 3a 30 33 20 31 31 3a 35 38 3a 32 33 00 00 00 04 90 00 00 07 00 00 00 04 30 Data Ascii: <ExifMM*8(12i ''Adobe Photoshop 21.0 (Windows)2020:04:03 11:58:230
2024-05-08 15:50:01 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2024-05-08 15:50:01 UTC	16384	IN	Data Raw: 85 88 e5 22 58 ad 0f f2 8a b7 e3 91 e4 c1 f8 f4 bf 08 0b e1 96 06 21 7b 6c 84 9c 29 41 03 c9 80 f0 c5 57 b1 a9 03 b7 7c b2 21 90 7e e7 7f cf b5 7c a1 fa 23 c8 57 de 6d 99 69 26 a7 74 55 49 eb c1 32 e6 71 d9 fa 36 7c 72 27 75 2b 41 a9 a6 41 81 36 b9 05 48 c8 da 84 f7 4e 4a 02 de 39 16 74 9c 0e 99 12 50 d7 5c 8a 90 b9 00 ad 4f 41 fc 31 28 25 f8 57 ff 00 39 cd e6 bf ae 2d d4 71 bd 5a ff 00 52 65 1f ea 47 82 9a cb f3 71 7c 32 61 31 0b d9 b6 03 df 0a a8 3b 72 90 91 88 2a a7 25 5f e0 15 24 d0 0f 99 cc 88 14 bf a4 df f9 c6 bf 2c 0f 29 7e 59 79 77 47 e3 c5 da d5 66 71 fe 54 9f 16 12 c8 3d dc 8d b6 ca e6 82 a9 16 d9 04 2b a2 d5 a9 84 ab 28 85 38 a8 af 86 40 b3 5f d0 ed 91 e6 ad 72 ed 81 57 83 41 8a ae 8c 80 d5 3b 0c 55 f8 3d ff 00 39 8f ad 49 7f a8 eb 37 c9 27 25 Data Ascii: "X!{l)AW\|!~\|#Wmi&tUI2q6\|r'u+AA6HNJ9tP\OA1(%W9-qZReGq\|2a1;r*%_$,)~YywGfqT=+(8@_rWA;U=9I7'%
2024-05-08 15:50:01 UTC	16384	IN	Data Raw: 29 c1 4c 81 b5 08 1a 83 22 cd 51 5f d2 b9 82 65 ed 20 c5 8b 2f f3 64 42 48 e5 6f 15 59 07 d0 46 1b 54 92 d1 81 45 61 d2 98 12 9a b2 7a 90 3a fb 61 b4 bc a6 e8 70 77 07 1b 54 c3 4a bd 58 94 a1 c0 a9 ab 5d 3c 9f 67 be 2a d7 a3 24 9d 4e 2a 8b 4b 45 5f b5 be 10 14 23 63 45 5e 83 0d 25 5b a6 f8 90 a5 53 bd 32 28 01 20 03 ea fa 93 29 e8 ea 18 62 9a 64 88 77 07 14 22 c0 dc 62 a8 80 70 85 57 43 4a d3 02 af 53 f8 64 d5 7b 37 7c 2a d8 34 db 7c 0a aa 9b 8a 61 01 56 1a 9a 9c 55 8e ea 70 fa 91 4b 1f 8a 9c 81 36 84 3e 83 27 2b 78 c3 75 15 07 10 52 03 32 88 ed 41 d3 25 6a ac 3c 3b 62 8b 5c a7 7d f1 55 6a ed 5e f8 a0 b6 0d 71 4d 2f fb 27 14 2a 06 c5 55 15 a9 8a af ad 71 64 87 be 51 2c 2d 11 fd a5 38 a6 d8 97 95 e5 a4 52 5a 1e b1 39 1b f8 64 7a 21 97 c4 d5 c0 aa a6 80 e2 Data Ascii: )L"Q_e /dBHoYFTEaz:apwTJX]<g$NKE_#cE^%[S2( )bdw"bpWCJSd{7\|4\|aVUpK6>'+xuR2A%j<;b\}Uj^qM/'UqdQ,-8RZ9dz!
2024-05-08 15:50:01 UTC	16384	IN	Data Raw: 23 45 51 25 f3 b3 b7 80 e9 8a 40 66 76 9a 45 b5 9a f1 82 25 14 c2 94 7c 71 9a f8 0c 55 11 41 b0 c5 54 a4 34 18 ab 12 f3 a0 e7 e5 fd 5b fe 60 a6 ff 00 88 e0 56 35 f9 2a fc bc a5 a7 03 5a 88 cf eb c4 2b d7 83 50 e4 95 79 61 df 1b 55 26 3e 38 15 61 60 3b e4 ad 56 16 f7 df 22 ab 79 78 e2 ab 59 87 41 88 55 32 6a 6b 87 9a ac 27 08 50 b0 36 34 ab 4e 46 95 4d 9a 98 aa de 5d 6b 8a d2 81 38 ab 51 91 cc 03 80 ab e6 9f c9 60 6d f5 9f 35 d9 0e 86 f3 d4 ff 00 86 6c 0a fa 02 bd f1 57 72 ae c7 0a ad ae fb 62 15 c4 1e b8 55 61 7c 0a b5 9b 08 2a a0 e6 bd 31 54 3d 36 a1 eb 91 48 63 7e 74 8b d6 d0 6f a3 02 a7 d3 af dd 88 52 f8 e1 0f c2 2b e0 32 25 82 f2 45 2b 81 5b 07 15 4a b5 8f b1 19 f0 6c 52 cf 34 e7 0f 63 0f b6 48 35 96 37 af 0a 4a 09 f0 c2 86 34 c3 e1 db c7 15 43 b0 ae Data Ascii: #EQ%@fvE%\|qUAT4[`V5Z+PyaU&>8a`;V"yxYAU2jk'P64NFM]k8Q`m5lWrbUa\|1T=6Hc~toR+2%E+[JlR4cH57J4C
2024-05-08 15:50:01 UTC	16384	IN	Data Raw: 08 03 15 4b e7 d6 6d a1 04 33 8a fc c6 2a 8d e6 bc 43 b1 a5 45 47 d3 90 45 a0 a6 d4 60 b7 a9 77 03 25 b2 58 ae a3 e7 2b 2b 31 bc 8b f7 e0 b5 0f 08 fc e0 f3 fc 5a a7 96 6e f4 8b 72 09 9a 48 7e e5 6a e1 b4 be 49 af 8e 49 8a c6 6c 2a a4 cf 5e 98 aa 83 3e 2a a4 5f be 02 aa 0c d5 c4 2a 8b 36 2a 96 5e 92 d6 f3 20 ea 63 7a 7f c0 9c 0a f2 ff 00 c8 37 ff 00 9d 61 92 bd 2f 27 07 fe 0b 15 7b 49 6e c3 15 5a 4f 73 8a bb 90 ef 81 56 13 bd 46 49 5a 0d 5a e0 55 32 d4 eb 8a a9 f2 ae 1a 56 ab 4c 2a b4 b6 1b 55 3a e0 55 36 3e f8 0a 54 4b 50 e2 10 b0 b5 77 df 12 9a 52 2d 5f 9e 04 29 57 b1 d8 e2 af 0d fc e1 8c 1b ef 2f dc 7f 2d d1 1f ab 15 7b 34 87 7a fc bf 56 2a b5 4d 77 ae d8 ab b9 75 ae 2a d1 6f 0c 55 4d 89 c5 54 b9 11 d7 a9 c5 54 99 ab d3 15 6b a6 2a e2 76 fa 71 57 81 7e Data Ascii: Km3CEGE`w%X++1ZnrH~jIIl^>_6^ cz7a/'{InZOsVFIZZU2VLU:U6>TKPwR-_)W/-{4zVMwuoUMTTk*vqW~
2024-05-08 15:50:01 UTC	16384	IN	Data Raw: d9 4c 82 d2 ca 38 98 14 19 59 c8 59 70 32 04 a0 d8 53 01 92 10 d2 5d 04 34 f0 ca cc d9 08 a0 de f7 c3 20 66 c8 05 16 bb 76 1e de 19 13 91 90 08 67 ba a7 da 39 0e 22 b5 49 6d c6 a8 91 8d da a7 26 01 2c 09 79 d7 e6 1f 9c ff 00 42 79 6b 57 d5 53 6f 4a d2 40 1a b4 dc 82 32 d8 86 b2 fe 6f ff 00 35 b5 13 36 95 63 09 eb 75 7d 71 74 df 49 a6 5f 00 c6 41 e1 e1 b7 ae 58 0b 1e 15 2b 93 f0 85 fe 66 03 0d a5 b7 90 99 1e 9f cd 4f bb 6c 28 d9 2b bb 7f 8c 92 7e ca 9c 01 84 b6 55 d2 be 36 54 1d d8 61 40 7b 54 a0 47 e9 c5 e0 a3 22 ce a9 38 b7 90 00 07 b6 49 1c 49 dd bb f8 7c b1 43 d7 bc bf e7 5d 56 ca 31 0c 17 0c 14 00 a3 7e 80 61 e1 b4 71 33 15 f3 7e ab 75 4f 52 e6 4f f8 23 96 08 31 e2 44 a5 f5 c4 bb cd 33 b7 2f f2 8e 11 8d 81 95 a3 60 62 4f 26 66 3f 4e 3c 34 8b 64 36 ec Data Ascii: L8YYp2S]4 fvg9"Im&,yBykWSoJ@2o56cu}qtI_AX+fOl(+~U6Ta@{TG"8II\|C]V1~aq3~uORO#1D3/`bO&f?N<4d6
2024-05-08 15:50:01 UTC	16384	IN	Data Raw: 00 ae 58 10 f3 df 23 5d 0b ab 4d 4b 40 97 ec dc c3 c9 47 f9 40 65 91 71 f2 3e b6 ff 00 9c 7a f3 95 d3 e8 3f e1 f0 ff 00 15 a3 14 a0 f0 cc 88 0b 75 f9 4d 3d f6 2b d9 e5 04 48 c4 9f 73 99 30 83 8a 72 14 b6 fb 99 21 eb 97 70 d3 59 99 41 db a0 27 7d eb 84 84 db 22 f2 ad f1 d2 ef 59 93 6e 40 8c aa 51 50 53 bb 2d 4a ea d7 cc 13 1f 50 88 ae 10 38 15 da ab 94 c8 37 c1 ec 93 f9 8a 3d 4e c4 da 96 0e cb b3 0f 0c 83 72 8f 94 a6 11 6a a9 0b 1a 2c ab c3 20 df 09 3f ff d5 f9 15 04 6f 33 2c 31 82 d2 48 cb 1a 81 d4 96 34 1f af 33 a0 18 d3 fa b6 ff 00 9c 7e f2 2a fe 5c 7e 5c f9 73 ca 5c 42 cb 05 8c 4f 35 05 2a ee a0 b1 3f 4e 48 b2 7a fb 1a 1a 0f 0c a8 b1 53 a6 fb 57 22 58 14 42 81 81 42 6d a7 46 0b d7 c0 64 64 db 16 50 36 eb 95 96 56 d8 35 eb 80 30 2f c9 bf f9 f8 bf e6 10 Data Ascii: X#]MK@G@eq>z?uM=+Hs0r!pYA'}"Yn@QPS-JP87=Nrj, ?o3,1H43~\~\s\BO5?NHzSW"XBBmFddP6V50/
2024-05-08 15:50:01 UTC	16384	IN	Data Raw: b0 c5 0b 0b 76 c5 5a 2d db 15 59 cb df 15 6a a3 15 5a 48 07 6c 54 2c e5 4c 55 65 71 57 72 ee 71 55 85 c7 7c 53 6c 63 cd a3 9e 8f 78 3f e2 a3 fa f2 25 05 09 e4 99 39 e8 d6 c7 c0 11 f8 e0 56 60 0e 4c 2a ec 2a d8 e9 53 81 5a af 86 14 ad 27 c3 02 16 13 8a a8 39 c5 50 a5 a8 70 2a 8b 75 a6 2a f1 cf 39 27 1d 4d 9b f9 95 4f e1 95 d5 b2 0c 57 be df 2c 69 8a ea 7b d3 08 d9 0b 7a 9a 8c 24 a8 60 be 71 4f df 41 21 e8 50 8c 83 2e 6c 3c ef 8b 12 1a 02 98 a8 0d 91 4a 53 14 ba bb 62 ad 62 ad 62 ad 83 4c 55 52 bd c6 10 a8 dd 33 53 9f 48 ba 8b 52 b1 72 92 c6 c0 82 36 e9 89 45 bf 51 bf 26 ff 00 32 21 f3 ce 94 82 47 1f 5b 85 42 b0 ae e6 83 20 97 b4 9a d0 d7 10 a9 7d e2 f2 8d d0 f7 53 f8 8c 98 57 e5 bf 9a ed fe a7 af ea 76 9f cb 70 f8 da a5 48 76 c6 d5 10 0d 7a 61 57 d1 1f f3 Data Ascii: vZ-YjZHlT,LUeqWrqU\|Slcx?%9V`L*SZ'9Ppu*9'MOW,i{z$`qOA!P.l<JSbbbLUR3SHRr6EQ&2!G[B }SWvpHvzaW
2024-05-08 15:50:01 UTC	16384	IN	Data Raw: 55 be d8 42 b4 70 15 75 2b be 20 2a df 9e 02 ab 97 15 5f 8a ad 63 8a ad c5 5b 07 c7 15 6c 1a 62 ad 13 5c 55 63 0a 8a 62 ab 41 28 72 6a bf 95 72 0a bb a7 5c 55 c4 d7 15 68 ef 8a ae 0d 41 8a 43 8b 62 a5 61 34 c5 0d 72 c5 5d cb 15 5d 5f 0c 24 ab 47 02 ac a9 eb 8a ae 1e f8 ab aa 31 4d bb 71 8a 1d 5a e2 ad 71 c5 5c 71 57 1f c7 15 5a 77 df 1b 4b 78 da 92 ec 16 87 62 ae c5 5d 8a bb 15 5c 7a 62 ab 71 57 57 15 5d cb b6 2a a9 4a 8a 8c 6d 2b 7e 58 50 f7 6f c9 c0 56 ce fb 8e e7 d7 42 7f e0 72 41 5e d8 1e a2 b9 3b 55 ea 71 0a e3 be e3 1b 56 d4 d3 ae 02 ad 83 b6 db e0 56 b9 0a d7 24 15 aa e1 55 c4 e0 bb 57 94 f9 aa 12 9e 65 d3 ee 8f 42 54 7e 39 14 3d 8d ea 1c 83 e2 72 41 2d 63 e6 ae 07 c7 1b 55 a4 f8 63 ba b4 5b b7 6c 1b ab 8b 60 55 3a e4 d5 69 6c 17 4a b0 9c 04 aa d6 Data Ascii: UBpu+ _c[lb\UcbA(rjr\UhACba4r]]_$G1MqZq\qWZwKxb]\zbqWW]Jm+~XPoVBrA^;UqVV$UWeBT~9=rA-cUc[l`U:ilJ

Target ID:	0
Start time:	17:49:38
Start date:	08/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:49:41
Start date:	08/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2012,i,17688312714450364625,6802732224170712627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:49:43
Start date:	08/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://replicon.coverys.co.uk"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://replicon.coverys.co.uk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Windows Analysis Report
http://replicon.coverys.co.uk