Edit tour

Windows Analysis Report
http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com

Overview

General Information

Sample URL:	http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com
Analysis ID:	1635581
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious Javascript

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3056 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5280 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2112,i,11371315530667424221,9145693074874910444,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6840 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com/	Avira URL Cloud: Label: phishing
Source: http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com/	Avira URL Cloud: Label: phishing

Phishing

AI detected suspicious Javascript

Source: 0.58.d.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: ... This script demonstrates high-risk behavior, including dynamic code execution through the use of the `Function` constructor and access to a potentially sensitive `sRandomBlob` property. The script also exhibits obfuscated code, which raises concerns about its true purpose. While the context is unclear, the combination of these factors suggests a high likelihood of malicious intent.

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0

HTTP Parser: Base64 decoded: c15862b0-389c-4e81-92c1-c49ea59d82cc9ad64a4a-c25d-48eb-96fe-cda3514c2c1e

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com to https://www.office.com/login#
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.office.com to https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3a%2f%2fwww.office.com%2flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3a%2f%2fwww.office.com%2fv2%2fofficehome.all&response_mode=form_post&nonce=638773168918864076.yze1odyyyjatmzg5yy00ztgxltkyyzetyzq5zwe1owq4mmnjowfknjrhngetyzi1zc00ogviltk2zmuty2rhmzuxngmyyzfl&ui_locales=en-us&mkt=en-us&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=ohnd2ixkt3ajppjteyn4cocpztetxbhfs03qklce2myolmerz_dz3huszmrzlfxikocc6esm26q4fsloudsqxjtwrltbwbzorstzpdoha-a5qkecvafllayvfabsnnp9kbytl4uaqy5z4ljfmasctg7pwoi9vmixlwms-zplcebqx6hmc-wuqsef95ir_xk0elepd99newkxg4u8nrtbwkzdgxnvele8sbtfsloviip7-i_d3n-7lna5wrgck6jus8ydv7idtuwliaahk9o_oq&x-client-sku=id_net8_0&x-client-ver=7.5.1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.181.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.181.227
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: www.office.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-FzL3kq6xAMc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEb_t32lNc_37PuaDiHKTO0eiM3RNAIp1pthzwX-8wZlx591ZCX_bFVOLTZaLecJhIQkuMQ2BmHcDhF8mgZawAo9n1x-_kdvAXYo954cvEr_ux7Fo--thguN-jg-629lMb1My9sb2jwTG_YGg3QINMvSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXQAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB0AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEj76hlzcaZdqP7sX6jhffHQKfSclAQH1tkeh_o3iO88lADb4yacZxNcse87ibmkS9gq0Jfe6XcOote5xVZPvm-t9Ew7vlzB7VQjp56oXVEbsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEGlVmqCMUloIctEndE4GoNm2EQOr8xsN8wz4-m6kWPaknYRsb8Jj7kSCVReyMcA05GFZzdXU7dQKmpV69RRCfRlkrl5iMJnpouhlzxy1aPCAbEpU7F2ECNUMv0s5cHwZUUK4WUUcyeoOsVcfchij7uSv5-JGimWvmOhXUU5uQ54IgAA; esctx-DXVSjgVVZp4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEJ4ipyAx-59U-CjfuK1ubbkylg13n6S5fFpYJKHZRz0X1uZzDdMNAXz56HiQWHhh70be-WHWBXB9SZMQp1OQNx9si8frUw1JOTKsR9lTRsf46Ipna7anamTKL47wYsT_6E52diw61LEhQbv3z-NvZPCAA; fpc=AkWWIirCfJpNtxMVnUDm-WG8Ae7AAQAAACiBYt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=8e2b900f-b8c4-4341-9ab3-91348eac3008; brcap=0; ai_session=wggzEqd1KoV0Em4zbqOS+5\|1741720118064\|1741720118064; MSFPC=GUID=6d24232fc8d844b0b4788bd4cd96ce78&HASH=6d24&LV=202503&V=4&LU=1741720127650
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com
Source: global traffic	DNS traffic detected: DNS query: www.office.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com

Source: unknown

HTTP traffic detected: POST /api/report?catId=GW+estsfd+ams2 HTTP/1.1Host: identity.nel.measure.office.netConnection: keep-aliveContent-Length: 1233Content-Type: application/reports+jsonOrigin: https://login.microsoftonline.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_77.3.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_77.3.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49680
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir3056_1006742137

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir3056_1006742137

Jump to behavior

Source: classification engine

Classification label: mal60.win@25/39@26/10

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2112,i,11371315530667424221,9145693074874910444,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2112,i,11371315530667424221,9145693074874910444,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label	Link
https://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com/	100%	Avira URL Cloud	phishing
http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com/	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
e329293.dscd.akamaiedge.net	92.123.12.181	true	false	high
beacons-handoff.gcp.gvt2.com	142.250.180.67	true	false	high
b-0004.b-msedge.net	13.107.6.156	true	false	high
www.google.com	142.250.185.68	true	false	high
a1894.dscb.akamai.net	88.221.110.82	true	false	high
www.tm.a.prd.aadg.trafficmanager.net	20.190.159.128	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com	unknown	unknown	false	unknown
www.office.com	unknown	unknown	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US	false		high
https://www.office.com/login	false		high
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	false		high
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	false		high
https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2	false		high
https://beacons.gcp.gvt2.com/domainreliability/upload	false		high
http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com/	true	Avira URL Cloud: phishing	unknown
https://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com/	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com	chromecache_77.3.dr	false		high
https://login.windows-ppe.net	chromecache_77.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.6.156	b-0004.b-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
92.123.12.139	unknown	European Union	16625	AKAMAI-ASUS	false
88.221.110.82	a1894.dscb.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
20.190.159.68	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.159.23	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.187.94	unknown	United States	15169	GOOGLEUS	false
20.190.159.128	www.tm.a.prd.aadg.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
92.123.12.181	e329293.dscd.akamaiedge.net	European Union	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1635581
Start date and time:	2025-03-11 20:06:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.win@25/39@26/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.195, 142.250.74.206, 142.250.185.110, 64.233.184.84, 142.250.184.238, 216.58.206.78, 142.250.185.174, 142.250.186.142, 20.190.160.67, 20.190.160.128, 20.190.160.3, 20.190.160.65, 40.126.32.74, 40.126.31.0, 40.126.31.73, 216.58.206.46, 142.250.186.74, 142.250.185.106, 142.250.184.234, 142.250.185.74, 142.250.186.170, 142.250.185.170, 142.250.184.202, 142.250.186.138, 142.250.74.202, 172.217.18.10, 216.58.212.138, 216.58.206.74, 142.250.185.234, 142.250.185.202, 142.250.186.106, 142.250.185.138, 172.217.16.206, 52.178.17.234, 13.69.116.104, 142.250.186.163, 142.250.184.206, 142.250.74.195, 172.217.18.14, 199.232.214.172, 20.190.160.66, 40.126.32.136, 40.126.32.140, 40.126.31.129, 20.190.159.131, 40.126.31.1, 40.126.31.2, 23.60.203.209, 172.202.163.200, 20.190.159.4
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, clientservices.googleapis.com, clients2.google.com, redirector.gvt1.com, login.live.com, onedscolprdweu11.westeurope.cloudapp.azure.com, update.googleapis.com, onedscolprdweu06.westeurope.cloudapp.azure.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, eu.events.data.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net, eu-mobile.events.data.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 455713
Category:	downloaded
Size (bytes):	122939
Entropy (8bit):	7.997746253803481
Encrypted:	true
SSDEEP:	3072:mIoeB2wLj1vxBepFzXu1hafbiBz5ZurwOc4NbCwZQ9HL5:mIQQ0pBXW8qurwOjN+r5
MD5:	20CE87477D6D15DA34A741E403DE3FEC
SHA1:	39506B05FE4C40DF151748CE7D815DA94F484C5C
SHA-256:	25E14EF7716B473D159874C370A076CD21AFCFF5E466AAD0CBFD863EFBA9A084
SHA-512:	F116ACDE307C652A84B3ACC963365353FF348C729BE3E242F9707DFB3A78E3B160A6DF4240E34E64841D80EE44986936A384337A75D57F2CAFF546B336CEA921
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_Z-97xch0omzdvdz9EEve6A2.js
Preview:	...........{w.8.8.....fn..(..o+.....I.....Merd.v.%.$.1.......([NU....s.Q.H... .....w.......Oit....OJ.O..J..............F....^\.x>+...3....0y..F.0....f.o..~i...R..J.(..9I\.8.Bc..2T...K;J^K.....6o..P.....!).a.9.d.....G..."pYTz~...Da.N.R...=A#....M.%;b..%.I.%......!E.15.[...:..P.........8_...L...U..ie..\|.JIXz.....x.`Z...bj......I..a.,z...~)..D...%.2....-M#;@...`..i......cTt.Z.fs...L/.8..s...R..^...J.?.0.W..K.z.h..Z.5....d...>L..a1.:.......C.G.....G..?c^....,]....Q8..@.u.b.4..K..!`_.....q\|q.?]..<>.L....+..R........d..uO...v.G...c..;...A.KX.Y0M....g...>....'a.:g..;.>...9.b.:0.e[.....w...T......JE..V..;....wU...TYf....?.....ua8...i....$)W.....\..7... EC.h.&e.6..D,YDA..W.Na!..T..$k..;..2..ju .1,D}LdY=..a.>\|k....ND/.A...}{+'V?..W%#..o)a.S....c!P8..UI.".n.{.]C.q...-u..a.....$z%...[*.CX......l.}.U.Q.......\.nT..........Z...LK.~.\|."...D;U{>._....T$.C..^\|)..'e..!.k2=...)Y! )..+.Y.#%........C..>0.r_oo..%.>....=..g..!.V....<%J.D......

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113424
Category:	downloaded
Size (bytes):	20410
Entropy (8bit):	7.980582012022051
Encrypted:	false
SSDEEP:	384:8RvmaMFysnOXZ2m9zM+udO6GGUpeAU02oDGnN5EsQwWUQGTS8r2k:8pmm7ZFM+ObGGUIjN5PJV3Tp
MD5:	3BA4D76A17ADD0A6C34EE696F28C8541
SHA1:	5E8A4B8334539A7EAB798A7799F6E232016CB263
SHA-256:	17D6FF63DD857A72F37292B5906B40DC087EA27D7B1DEFCFA6DD1BA82AEA0B59
SHA-512:	8DA16A9759BB68A6B408F9F274B882ABB3EE7BA19F888448E495B721094BDB2CE5664E9A26BAE306A00491235EB94C143E53F618CCD6D50307C3C7F2EF1B4455
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
Category:	downloaded
Size (bytes):	116362
Entropy (8bit):	7.997473195483862
Encrypted:	true
SSDEEP:	3072:b4AjEJ6y6ebFHqvxmN75LyWZh7nUOJc4TG91lJa5l+2EqFonU:0AgsnM79PZh7nuN1naTdFoU
MD5:	81C7B985343C317ADEEA2C28F5C6FF4D
SHA1:	7A04D6215D0B79EEDE6823C4B3621795AD552534
SHA-256:	6BDBA6F0D2271DD20E6E6AEA2B459A1A23050EDE1B3BBADE4C913A1716F6E491
SHA-512:	DDF40137ED7F870C5E7475685BA9006F9C99C7C0632A9E7738DCF9BD081C105ABA5B94B3302BBD26DFF413DC065FC442D3CDDA33684709D6185B409F08158085
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js
Preview:	...........k{.H.(.}.......c....8=.Ib......#Ca.....K..o..ZU%...q..9...ct).....S..?U.6..rqyt~Y9}W..........Z.xzy..x.z.Q.w9......^...U.........<..G....=wZ.....Oxe.._.0.S/..k>..&T..gn.?TN....6.....a0...I\......)....$......7.T>x.0..q\...{..H...\|.....2..x"..\`IYkD..#....FP....a.^.].'0h.&.....ie..\|.qPy....l<..S.y.E..>.....a...3..-vq:..P<..dE.....C.h.P..]..\5.......3.<N.^?T...:B#c....\|...T.........(...Q.l7[...V.e.W.8.G.....O...0.m...f.F...7..h.......F..b...Yr.=...f.....?......S.}U..g.......t..../...G.......~.+...)y.X\...<.&.........`.v.....`^....c4c.Yh=.a.wB.m.......i..~v-..O..nY....A....5...v...t..FSw...Q/n...c.9Y{.-..>a..7h..o..ec...O...)~..8...j-M..nD....9......f5..'Q#...L.'......fZW."Q[.<.nx..O...LU.;..a.m..&.k.$...;.=L...yv....,.f<Hb{.w.@.8...8F.D.>.04.[K6v.i..2.#?..&.;-.].....1.X0w.H6mZ..A...t..e-.\...MC6.xt`..cu...@_...v....;z'.mV.T/o.i....-...K......\..Sn>B......%x..%......W.\|......~.6.%...+.:..x5..s5P.-..!.G...ZT.i...;.&

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3445), with CRLF line terminators
Category:	downloaded
Size (bytes):	3447
Entropy (8bit):	5.1147634913081745
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9cNHULI5m4n0imQBGLesqAsosushswsosry:a2IYz9c6qzmQBaC
MD5:	ACDEC8DAD3164FBA20E86D50F1B979F1
SHA1:	0C5FD1CCA5BECDB0080D20E6A90CCD91BC0D5894
SHA-256:	1D2CDE2E778A731CBD158758F735E1BCC2508A8252720D261D94068AFF45AACC
SHA-512:	A9D25D79EDF7BD8D668D5833263461B72B077AD3885A05DE749C7F0326BFC7C8D5D2D967E11FF40E52755211774DEC0E913532BC86AEEEC37B243A213CECEEC1
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 17174
Category:	downloaded
Size (bytes):	540
Entropy (8bit):	7.5407666474990105
Encrypted:	false
SSDEEP:	12:X61L4PLPiu6pTXa7unxRmvJAGjjjISl2TQ2HXJ31ELDpYnJkVHCkNv/jYW/RT:X61L4PLP2a7uxdG5l2TTXxu3+kpNv/zx
MD5:	A6C82159D8C8B565F8FE916B6598AD7F
SHA1:	AD8137F1FE2E4D750B287CEC1CCC67DFC11E49D6
SHA-256:	BC1A59D73D119C45A5201F5140103CEE788C3B6ADF62F6954687E2D0205DA413
SHA-512:	B7808D0263D30FD94E77578A0D95BDE37F8742172B81705B2534D522D5A9206185E5778B503D08020181F0E1DDFF48CD155FB070813D242AE967C7979D21A2E7
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	...........\1O.@.}....#.6.0..8i....!]....!vttu7.NN&..~......1..z.+p.QZ.).^....Gj..}.A......!qV........./b.R.....`..\|.(...B.- [..y..w.E/lW.X........V.O..\|...av4....H.z..z..z..z.7A...&...P8@.(..SO=..SO=..SO=..S......z.-....W.{...>rr..q.HaM.k..3ts0b........}.C...D.x......^#.>..O.\|d,.....d.z...N.5...e.W......0bNu..6..8....h-{8.sn.8..9.r.Y...@..4.....y...........3..l.....w.?.tE_..a.....k5.x...1....3k.o....\|...Wp2....C.Ja...fl.....C....j....<.yJ...v.,..GE_?.V.e..2oEnq..:...`k...>..X...vp.c..8.=....bY.......j.C..

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 58435
Category:	downloaded
Size (bytes):	16556
Entropy (8bit):	7.986602570292376
Encrypted:	false
SSDEEP:	384:hji1Q/wE+7hNotq3IGLdXXS0gQ/7M8OhpHAcIqvkiO:hjN/jqJFDLQHAcIClO
MD5:	209FD70F9BDA807BF117210BBCF03522
SHA1:	FD4A15809E2953DDDEE045F440DA62F9A11680ED
SHA-256:	58AC139774D14AACA1F5C7FE2F2B7DF96CD208AC5B1D03FFCB732552C4C05E54
SHA-512:	76AD5E7641A4F30E5662F48D3DB05F2D3EE2024F6E801EAF9D1F48DC4F8CAACFFF41448FC4E68FB21F69E5527D5119D75A3411DB1285A3BBD0E5C84B7A9C6342
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lh3lajrog_lmhvtw2rbbq2.js
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo.....].YYYY.Y.Y....I......T..............C..C...K......G7,..\|.x....oZ..E.N.....W.....w...U.N.$..}x.j.?..........J.p......F...{...{?&.p.............>.9.wb.s...4.C.G...s..3u"x.\,.{1.L..{.'...J..K..{Q,.a..'b...a.1.$t....p4.....^]z...._.7b1..Oq.......[..&a.....N&......o./Bo.n...f.......;O..>....5....d.......8..ET...~..&..Lo..Ox.f.z..G^.....].s.O..h..V...\|1..@.........KA._..S.^......... .t.;...D.........vZ......R+W.k.../..e..tP...U+..].....O.7.Y....x..]w......fg..3YN.KCz]...$.b........V..+.%h[.&,.p..{^...$..{/...=a..Aw..I..............O...1.]....W>..?N..(.4.K.t../&1....\G..`./[z......u..[,.7....)P..[....T\|..*.a!.!.t....h......d"......w.......y..!T.......)..a0..5....oF-.....S......>...A.....t$G..r.;....\|.....m../..i.....V...i.....-..7_.o.V..)...u.. ..`.n]._..(. d!...........e&d.....Ra(....g..N........> d.C.....^.H.-.e.ck./~...9>..]...`.%4b/b.@O...9n.Y.2.._B.Yzy.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	100
Entropy (8bit):	5.340078225325278
Encrypted:	false
SSDEEP:	3:Jq62iczBrhkI2yLrm0do+qBVcdwRKR:YdiczBeITm02+qQ
MD5:	4EB1BF41AB29B49E051D1BE8CB217DE7
SHA1:	777EE04B5498060CA06C2290AEE1CD152AAD3AD1
SHA-256:	D67D42DA1BE5B25B5938EF3CA1681D49B1181F3CCA7CBD207D51DAB056E2E272
SHA-512:	246D15CDF03ED0F86C758671C6C81682616A89F5A419FD6D46F3972C4D142B915F65F2EC827255406049D96E0C839C6DA027A03FB436A354F01B931F8796234D
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCYICaXLWAdtdEgUN0VtRUhIFDVd69_0h-84m-uq0q5g=?alt=proto
Preview:	CkgKDQ3RW1FSGgQIVhgCIAEKNw1Xevf9GgQISxgCKioIClImChxAISMuKiQtXyslJj8vXj0pKCw6O348JyJcXT5bEAEY/////w8=

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
Category:	downloaded
Size (bytes):	5529
Entropy (8bit):	7.963357626093036
Encrypted:	false
SSDEEP:	96:FC4lWyY3aCfrPHSuZ6WTgaPZT1rfaaCEIqgpxXpYUFUUjadVPht:c4lWyK/rvn3TgKdfaaCbqgmUfjIVPht
MD5:	2897F2B9FBDFCA48FD9E7C3EBACD4825
SHA1:	1AC29A73147FAB24EECEDE0BBF4ABAC2B09B4FDA
SHA-256:	34AC02CED788528E58CD6EBB75EDF624F4061D4839369AF860A36AC0BFC3C830
SHA-512:	508CE7E7E1D3AE2101737E8D26A1257D516F8644ADC3AB5BE2A6B86C0B21CCFC32C1030B2014BE1280B9AF29AEB78A005D2242A2D12C68D2C3733941BCF64A42
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4ba7c391e6f3f547d8ce.js
Preview:	...........[}w.......q.Q.f......q....c..&9:H.$b..E.UK......$!..ss.`vgggg.}...j_i.....G...{.e[..\7.+....].:.......7.6....9p...(.D..a..Q.\hS...n...h.....I...S...H.h...^3...+7I.Z......?.C..F..?OR-.R..57.$../...,.x..O..D...I$.Q.%\|..;l"f._.in.5.Sm.%.D.ai]......QHp...{@8....8........5Q....+dD.:.Z.i.h.Q_......6.r../..o6L..c.....A.E.O4.,A.k.!.....8qCby.....'.Oy.20.....Oc."O.4..(.y@w+....[..h.g.._[..f\|}t......cSMM.4.....O'..5...^4......[..;..{...P....l.j6..Z3..~..uU.~g..W9./.....tC.G.]......._..~.A... v....C.S1.X\|.dZ.LL........_}..=..C:..Y..x...a\|m...c.%x.....[...j6t...p......c.fNd.6...&.....%.. tS..<...A...c.3j=@3.5.. eS.u!>..j........B.kpE_.81.x./Z..&K.nI.L.n.vn.Q..&....Y:.... a8..f...)...."...;z..d(...{\.B.."R..n.g#.@.G<......S.qPt......r..H.V...s......w..['..$../..=.n.&sv...z.Q8...A.H...?..<..Y./....m.Y.........C.F`M..I..p.?.n2........D.......,.%....GE....\|..{....)....u......<!.>..~~.v...\|.Cj....V.^s..M.9.i7....8I..8}8%...'.I#...Y..i.........

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	downloaded
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	downloaded
Size (bytes):	35169
Entropy (8bit):	7.993210932978764
Encrypted:	true
SSDEEP:	768:j6PfHtcQsNe72gH9i6EndaklFS0VBrXFm4soze9NJthWnXpjTbI8PgzK:5xoCgH9i6EFFhrXFmUzVXtbI8YO
MD5:	57EADECAC2A031883A702F6B12A14502
SHA1:	3C1E4F5ABE11775DD678085EAC97029DF618A9F7
SHA-256:	C76276A58DFB0E4D68D277526E5F05EE357E13957B4C91BE2C74BE7CD20B065E
SHA-512:	D98AC263512C6CDB0A522C8B550F4CA8B901F620A1ED416C49163B28E0D5D08EA9605BF681F9F0C5567EB244BBD319D6596C6B46E860F48AD5CE31154DD2CA5A
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_c4928fb5cff147a39780.js
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:{...r..._........,...A........:..x.>.y..u.....N..f...).......<?._.f..C.....%..@..~....`P../.Q4..IQ.' ...e)'.q..Y:...%.z..x..k.z.../....@.D.r?......GP....`..o.'..~1.....&.HJ.`.@.}mV../8.b.m..guo.H_.7Qv.....dQ.....-.NE......G:.U'.....~.1.....H.k...O..dk.d.\|.7..x\/..i^.Y..Q_/.`..i.&...-.......P...yEv....,....'.^...X.......YK.".....l.r.ax.....<...1!..4GQ.M_.....L..F..51.!.....].....y...(...=O5?.nT...~

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142588
Category:	downloaded
Size (bytes):	49982
Entropy (8bit):	7.995657643114965
Encrypted:	true
SSDEEP:	1536:Jxgptniucdklf46I3reB9kaGX2VDj/vlzQ4Orr:JehcdSPIbK9ggnnlzor
MD5:	47B6359A09BBEE6AA41B82E06C5A6105
SHA1:	7049BB7A20217A9153F9AED16A0A6B6DF27B1038
SHA-256:	EACBD5A1C958B4A2859D1D59FCDF028EDB6DD7567109218A83AA4E263A253A35
SHA-512:	16CAC5CD306721D5A117CA06CC42BBB38680697E811479F51C315A3967F5716ED9AC2A01A049BDBA027984312F268E2711E359936ED748394100A11953B231FC
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js
Preview:	...........m[.8.0........OL....;w.....6.ff.X.'V......4.r~........=........,..JU.......T~.l..?..E...r..r.....r.o....^.......(..q...?.......aP......h.Fn".....\|wR.G.C%...i.~..$.L.8.BC1..U...gn.<W...:./.6.....(.>..}R.......xT..^.XTf.'...?.....(..qR..H...x...OX.7..X$.q.%..ze....>._......{P.:....~.M...X&.&.u..ie..\|.IXy.g..Y....x{..;..U.M.f....f,.Gl.dR..<...bl{E\|..@<y..En.(W...s."!.D.X.<AE....a....Y..'.t&8.T.....".J.K......Rm5.;...F...$........Q......C.G_.s...../1.8b\....ZP9..\?P.:........)`_.... .......6..#lXU.s.\I....Q....Y..\5n,.~.7V.4..su........N\...._.7...........T.....)..L..S}.c_...\_......Y}:...._1-\|p..l@..[q...........?&.0Z_.Aw:3.RsV...qR5..Bv./..7...b.G,..jt...HfQP..:.).a...&9s.N....d.=_,:...B..@...+{.Mx.8k.,m.Q.B.......j....}.2bdEkE.G.a..5...1....G ...T...~....uV6.....i.=...AU.!.+."3c...D.&!*q.9L....8..&`>.....v....6aT\.U.S.q"+!.....Xi.@D2.....g..t\.nw.-..L..S.B@QZ.N>.\-...[...pD....sro//..H...i......}.U.....M.yJ........./.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 17174
Category:	dropped
Size (bytes):	540
Entropy (8bit):	7.5407666474990105
Encrypted:	false
SSDEEP:	12:X61L4PLPiu6pTXa7unxRmvJAGjjjISl2TQ2HXJ31ELDpYnJkVHCkNv/jYW/RT:X61L4PLP2a7uxdG5l2TTXxu3+kpNv/zx
MD5:	A6C82159D8C8B565F8FE916B6598AD7F
SHA1:	AD8137F1FE2E4D750B287CEC1CCC67DFC11E49D6
SHA-256:	BC1A59D73D119C45A5201F5140103CEE788C3B6ADF62F6954687E2D0205DA413
SHA-512:	B7808D0263D30FD94E77578A0D95BDE37F8742172B81705B2534D522D5A9206185E5778B503D08020181F0E1DDFF48CD155FB070813D242AE967C7979D21A2E7
Malicious:	false
Reputation:	low
Preview:	...........\1O.@.}....#.6.0..8i....!]....!vttu7.NN&..~......1..z.+p.QZ.).^....Gj..}.A......!qV........./b.R.....`..\|.(...B.- [..y..w.E/lW.X........V.O..\|...av4....H.z..z..z..z.7A...&...P8@.(..SO=..SO=..SO=..S......z.-....W.{...>rr..q.HaM.k..3ts0b........}.C...D.x......^#.>..O.\|d,.....d.z...N.5...e.W......0bNu..6..8....h-{8.sn.8..9.r.Y...@..4.....y...........3..l.....w.?.tE_..a.....k5.x...1....3k.o....\|...Wp2....C.Ja...fl.....C....j....<.yJ...v.,..GE_?.V.e..2oEnq..:...`k...>..X...vp.c..8.=....bY.......j.C..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 20:07:48.795387983 CET	49672	443	192.168.2.6	204.79.197.203
Mar 11, 2025 20:07:49.107615948 CET	49672	443	192.168.2.6	204.79.197.203
Mar 11, 2025 20:07:49.716960907 CET	49672	443	192.168.2.6	204.79.197.203
Mar 11, 2025 20:07:50.920129061 CET	49672	443	192.168.2.6	204.79.197.203
Mar 11, 2025 20:07:53.326329947 CET	49672	443	192.168.2.6	204.79.197.203
Mar 11, 2025 20:07:57.476073027 CET	49678	443	192.168.2.6	20.42.65.91
Mar 11, 2025 20:07:57.842369080 CET	49678	443	192.168.2.6	20.42.65.91
Mar 11, 2025 20:07:58.139177084 CET	49672	443	192.168.2.6	204.79.197.203
Mar 11, 2025 20:07:58.545517921 CET	49678	443	192.168.2.6	20.42.65.91
Mar 11, 2025 20:07:59.748613119 CET	49678	443	192.168.2.6	20.42.65.91
Mar 11, 2025 20:08:01.382894039 CET	49701	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:01.382927895 CET	443	49701	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:01.382998943 CET	49701	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:01.383333921 CET	49701	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:01.383353949 CET	443	49701	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:01.575053930 CET	49701	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:01.620328903 CET	443	49701	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:02.154768944 CET	49678	443	192.168.2.6	20.42.65.91
Mar 11, 2025 20:08:02.696253061 CET	49703	80	192.168.2.6	20.190.159.128
Mar 11, 2025 20:08:02.696387053 CET	49704	80	192.168.2.6	20.190.159.128
Mar 11, 2025 20:08:02.701631069 CET	80	49703	20.190.159.128	192.168.2.6
Mar 11, 2025 20:08:02.701646090 CET	80	49704	20.190.159.128	192.168.2.6
Mar 11, 2025 20:08:02.701723099 CET	49704	80	192.168.2.6	20.190.159.128
Mar 11, 2025 20:08:02.701730967 CET	49703	80	192.168.2.6	20.190.159.128
Mar 11, 2025 20:08:02.742295027 CET	49705	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:02.742358923 CET	443	49705	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:02.742605925 CET	49705	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:02.746292114 CET	49705	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:02.746330976 CET	443	49705	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:03.576847076 CET	443	49701	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:03.576905966 CET	49701	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:05.356636047 CET	443	49705	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:05.357028961 CET	49705	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:05.357069969 CET	443	49705	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:05.357470036 CET	443	49705	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:05.357548952 CET	49705	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:05.358180046 CET	443	49705	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:05.358305931 CET	49705	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:05.360402107 CET	49705	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:05.360479116 CET	443	49705	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:05.360642910 CET	49705	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:05.360657930 CET	443	49705	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:05.410026073 CET	49705	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:05.640288115 CET	49705	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:05.640372038 CET	443	49705	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:05.640515089 CET	49705	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:05.643070936 CET	49704	80	192.168.2.6	20.190.159.128
Mar 11, 2025 20:08:05.647800922 CET	80	49704	20.190.159.128	192.168.2.6
Mar 11, 2025 20:08:05.808360100 CET	80	49704	20.190.159.128	192.168.2.6
Mar 11, 2025 20:08:05.810879946 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:05.810972929 CET	443	49706	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:05.811064959 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:05.811460018 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:05.811500072 CET	443	49706	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:05.860546112 CET	49704	80	192.168.2.6	20.190.159.128
Mar 11, 2025 20:08:06.965296030 CET	49678	443	192.168.2.6	20.42.65.91
Mar 11, 2025 20:08:07.752048969 CET	49672	443	192.168.2.6	204.79.197.203
Mar 11, 2025 20:08:08.574495077 CET	443	49706	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:08.576495886 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:08.576554060 CET	443	49706	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:08.577892065 CET	443	49706	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:08.577980995 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:08.580398083 CET	443	49706	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:08.580482960 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:08.580735922 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:08.580887079 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:08.580910921 CET	443	49706	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:08.629329920 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:08.629343033 CET	443	49706	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:08.672933102 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:09.165653944 CET	443	49706	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:09.165744066 CET	443	49706	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:09.165754080 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:09.165806055 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:09.178055048 CET	49706	443	192.168.2.6	20.190.159.23
Mar 11, 2025 20:08:09.178109884 CET	443	49706	20.190.159.23	192.168.2.6
Mar 11, 2025 20:08:09.202759981 CET	49708	443	192.168.2.6	13.107.6.156
Mar 11, 2025 20:08:09.202786922 CET	443	49708	13.107.6.156	192.168.2.6
Mar 11, 2025 20:08:09.202862978 CET	49708	443	192.168.2.6	13.107.6.156
Mar 11, 2025 20:08:09.204220057 CET	49708	443	192.168.2.6	13.107.6.156
Mar 11, 2025 20:08:09.204236031 CET	443	49708	13.107.6.156	192.168.2.6
Mar 11, 2025 20:08:10.035397053 CET	49709	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:10.035499096 CET	443	49709	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:10.035605907 CET	49709	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:10.035995960 CET	49709	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:10.036035061 CET	443	49709	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:11.567516088 CET	443	49708	13.107.6.156	192.168.2.6
Mar 11, 2025 20:08:11.567893982 CET	49708	443	192.168.2.6	13.107.6.156
Mar 11, 2025 20:08:11.567920923 CET	443	49708	13.107.6.156	192.168.2.6
Mar 11, 2025 20:08:11.568823099 CET	443	49708	13.107.6.156	192.168.2.6
Mar 11, 2025 20:08:11.568883896 CET	49708	443	192.168.2.6	13.107.6.156
Mar 11, 2025 20:08:11.568898916 CET	443	49708	13.107.6.156	192.168.2.6
Mar 11, 2025 20:08:11.568939924 CET	49708	443	192.168.2.6	13.107.6.156
Mar 11, 2025 20:08:11.570388079 CET	49708	443	192.168.2.6	13.107.6.156
Mar 11, 2025 20:08:11.570445061 CET	443	49708	13.107.6.156	192.168.2.6
Mar 11, 2025 20:08:11.570630074 CET	49708	443	192.168.2.6	13.107.6.156
Mar 11, 2025 20:08:11.570637941 CET	443	49708	13.107.6.156	192.168.2.6
Mar 11, 2025 20:08:11.624300003 CET	49708	443	192.168.2.6	13.107.6.156
Mar 11, 2025 20:08:12.129247904 CET	443	49708	13.107.6.156	192.168.2.6
Mar 11, 2025 20:08:12.132215977 CET	443	49708	13.107.6.156	192.168.2.6
Mar 11, 2025 20:08:12.132267952 CET	49708	443	192.168.2.6	13.107.6.156
Mar 11, 2025 20:08:12.133343935 CET	49708	443	192.168.2.6	13.107.6.156
Mar 11, 2025 20:08:12.133367062 CET	443	49708	13.107.6.156	192.168.2.6
Mar 11, 2025 20:08:12.157675028 CET	443	49709	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:12.158127069 CET	49709	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:12.158210039 CET	443	49709	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:12.159698009 CET	443	49709	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:12.159774065 CET	49709	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:12.161139965 CET	49709	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:12.161230087 CET	443	49709	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:12.210601091 CET	49709	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:12.210690975 CET	443	49709	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:12.259073973 CET	49709	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:16.153110027 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:16.153182983 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:16.153285027 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:16.154283047 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:16.154323101 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:16.570806026 CET	49678	443	192.168.2.6	20.42.65.91
Mar 11, 2025 20:08:20.510747910 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:20.565848112 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:20.575556040 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:20.575717926 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:20.579174995 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:20.579212904 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:20.579402924 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:20.579423904 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:20.579638004 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:20.579658031 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.120379925 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.175765991 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.252711058 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.282646894 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.282780886 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.282815933 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.283204079 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.283238888 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.285482883 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.285576105 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.285656929 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.285690069 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.286926031 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.286974907 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.286987066 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.288213015 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.288270950 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.288281918 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.288332939 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.288388014 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.340221882 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.349811077 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.350037098 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.350056887 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.353090048 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.353149891 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.353166103 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.369848013 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.369929075 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.370055914 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.370218039 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.370286942 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.434204102 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.434268951 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.434457064 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.434469938 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.456744909 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.456964016 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.456976891 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.457050085 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.463351965 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.470081091 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.470135927 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.470155001 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.470169067 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.470185995 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.476741076 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.476802111 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.476813078 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.483515024 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.483576059 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.483593941 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.483606100 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.483670950 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.490183115 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.498182058 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.498267889 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.498281002 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.498364925 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.498375893 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.503628969 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.503707886 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.503719091 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.510335922 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.510409117 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.510421038 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:21.552678108 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:21.789966106 CET	443	49709	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:21.790024042 CET	443	49709	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:21.790112972 CET	49709	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:22.096755981 CET	49709	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:08:22.096839905 CET	443	49709	142.250.185.68	192.168.2.6
Mar 11, 2025 20:08:25.083453894 CET	49719	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:25.083483934 CET	443	49719	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:25.083543062 CET	49719	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:25.084151983 CET	49719	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:25.084163904 CET	443	49719	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:25.201764107 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.201807022 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.201877117 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.201919079 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.244330883 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.710285902 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.710448027 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.712275982 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.712372065 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.773582935 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.773614883 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.773741961 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.780046940 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.780127048 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.780144930 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.781028986 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.781071901 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.781090975 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.781104088 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.781152964 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.785213947 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.785387039 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.785459995 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.785473108 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.789530993 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.789585114 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.789612055 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.789769888 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.789783955 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.793683052 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.793741941 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.793859959 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.793870926 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.798063993 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.798140049 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.798146009 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.801965952 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.802026033 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.802032948 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.802067995 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.802159071 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.806215048 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.806236982 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.806303024 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.810455084 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.810516119 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.814611912 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.814650059 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.814691067 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.814696074 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.814706087 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.818847895 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.818916082 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.818921089 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.822949886 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.823016882 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.823021889 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.823036909 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.823085070 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.823090076 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.827136993 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.827199936 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.827263117 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.844661951 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.844739914 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.852926016 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.852989912 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.857168913 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.857208967 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.857222080 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.857228041 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.857253075 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.861354113 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.861402988 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.861413956 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.861418962 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.861463070 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.865633965 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.865700006 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.869790077 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.869848967 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.869873047 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.873958111 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.873994112 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.874257088 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.879944086 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.880014896 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.882354975 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.882416010 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.882430077 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.886610985 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.886662006 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.886693954 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.886713982 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.890767097 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.890840054 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.890902042 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.895031929 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.895109892 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.900105953 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.900187969 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.900202036 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.900321960 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.903314114 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.903589010 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.903697014 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.915442944 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.915492058 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.915518999 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.915533066 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.915584087 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.916889906 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.916965008 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.919909954 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.919958115 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.919982910 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.919996977 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.920047045 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.922907114 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.922990084 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.925664902 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.925734997 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.925740957 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.925751925 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.925806046 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.928476095 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.928670883 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.928756952 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.931230068 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.933825016 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.933866024 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.933902025 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.933913946 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.933938026 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.972085953 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.972105980 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.972174883 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.972188950 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.972219944 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.972281933 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.972291946 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.972495079 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.972547054 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.972563028 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.972668886 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.972703934 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.972739935 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.972754002 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.972768068 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.972790956 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.972846031 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.974535942 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.975683928 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.975740910 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.975752115 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.976932049 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.976950884 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.976995945 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.977009058 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.977087975 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.978291035 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.979619026 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.979682922 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.979688883 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.979698896 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.979770899 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.981424093 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.981442928 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.981511116 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.981522083 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.981626987 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.983062029 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.983123064 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.983133078 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.984848976 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.984909058 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.984920025 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.987030029 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.987114906 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:25.987127066 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:25.987191916 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:26.005745888 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:26.005776882 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:26.005892038 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:26.005903959 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:26.036552906 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:26.036664963 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:26.036678076 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:26.078526020 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:26.084495068 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:26.093051910 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:26.093106985 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:26.093183041 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:26.093950033 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:26.093964100 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:26.140072107 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:27.166032076 CET	443	49719	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:27.219108105 CET	49719	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:27.297023058 CET	49719	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:27.297039986 CET	443	49719	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:27.298038960 CET	443	49719	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:27.298052073 CET	443	49719	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:27.298166990 CET	49719	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:27.303473949 CET	49719	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:27.303533077 CET	443	49719	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:27.304302931 CET	49719	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:27.304310083 CET	443	49719	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:27.345896959 CET	49719	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:27.838956118 CET	443	49719	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:27.839412928 CET	49719	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:27.839449883 CET	443	49719	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:27.839517117 CET	49719	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:27.840210915 CET	49722	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:27.840248108 CET	443	49722	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:27.840328932 CET	49722	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:27.840672016 CET	49722	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:27.840687037 CET	443	49722	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:29.986668110 CET	443	49722	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:29.987108946 CET	49722	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:29.987123013 CET	443	49722	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:29.987999916 CET	443	49722	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:29.988132954 CET	49722	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:29.988496065 CET	49722	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:29.988552094 CET	443	49722	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:29.988656998 CET	49722	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:29.988663912 CET	443	49722	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:29.988681078 CET	49722	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:30.029716015 CET	49722	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:30.029727936 CET	443	49722	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:30.679548979 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:30.679585934 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:30.679685116 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:30.680295944 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:30.680319071 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:30.680442095 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:30.680448055 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:30.680583954 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:30.680588961 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:31.379434109 CET	443	49722	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:31.379494905 CET	443	49722	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:31.379554987 CET	49722	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:31.379839897 CET	49722	443	192.168.2.6	88.221.110.82
Mar 11, 2025 20:08:31.379854918 CET	443	49722	88.221.110.82	192.168.2.6
Mar 11, 2025 20:08:31.712975025 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:31.754245043 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:32.483441114 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.483503103 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.483565092 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:32.483587980 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.483606100 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.483655930 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:32.483664036 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.484138966 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:32.484153032 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.490179062 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.490370989 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.490430117 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:32.497158051 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.497313023 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.497383118 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:32.503911972 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.504012108 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:32.509860992 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.509929895 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.509934902 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:32.509994030 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:32.516366005 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.560388088 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:32.560511112 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.003859997 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.051074028 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.179552078 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.181090117 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.181169033 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.181193113 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.190963030 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.191019058 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.191028118 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.191112995 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.191169977 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.191176891 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.239444971 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.280235052 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.285623074 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.285665989 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.285701036 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.285733938 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.285815954 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.293706894 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.293828011 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.293888092 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.293898106 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.333437920 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.403441906 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.403595924 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.403604984 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.406789064 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.406873941 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.406886101 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.458743095 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.870263100 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.871819019 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.871881962 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.871901035 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.878585100 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.878639936 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.878643036 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.878668070 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.878729105 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.885140896 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.885200024 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.885256052 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.885271072 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.891742945 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.891819954 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.891825914 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.898406029 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.898492098 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.898510933 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.905133963 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.905172110 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.905198097 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.905205011 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:33.905260086 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.938882113 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.980232954 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:33.980243921 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.440438986 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.457067966 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.457114935 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.457205057 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.457226038 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.457321882 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.517045021 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.517175913 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.517190933 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.524065018 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.524174929 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.524219990 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.524363995 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.524435997 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.524442911 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.530291080 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.530353069 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.530375957 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.537098885 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.537175894 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.537259102 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.543536901 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.543602943 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.543625116 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.553354979 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.553452969 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.553461075 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.553558111 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.559890985 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.560045958 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.560111046 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.566545963 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.566656113 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.566725969 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.566731930 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.573337078 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.573398113 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.573405981 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.579657078 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.579732895 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.579739094 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.587779999 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.587867022 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.587872982 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.626337051 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.626389027 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.626542091 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.626554966 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.626668930 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.630377054 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.667068958 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.667198896 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.667212009 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.667340994 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.669668913 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.673444986 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.673490047 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.673520088 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.673528910 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.673546076 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.673631907 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.687000036 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.687096119 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.687103033 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.687901020 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.688026905 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.688033104 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.691834927 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.691920996 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.691929102 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.692029953 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.703408957 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.703444004 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.703526020 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.703535080 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.705230951 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.705297947 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.705303907 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.749916077 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.752422094 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.758323908 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.758414030 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.759897947 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.759987116 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.760009050 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.760023117 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.760102987 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.763190985 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.766587973 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.766639948 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.766674995 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.766684055 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.766750097 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.769654989 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.769728899 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.769736052 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.772928953 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.773009062 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.773016930 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.773030996 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.773121119 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.773128033 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.776230097 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.776278019 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.776323080 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.779454947 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.779486895 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.779527903 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.779537916 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.779589891 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.782788992 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.782881021 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.782886982 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.786103964 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.786209106 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.789254904 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.789442062 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.789447069 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.792577982 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.792619944 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.792648077 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.792654991 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.792761087 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.795727968 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.799093962 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.799149036 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.799173117 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.799180031 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.799218893 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.799261093 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.802293062 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.802361965 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.802373886 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.802449942 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.802520990 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.805649042 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.810033083 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.810085058 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.810105085 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.810153008 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.810203075 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.810245037 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.810250998 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.810306072 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.845274925 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:34.845372915 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:34.845468998 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:34.845793009 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:34.845830917 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:34.846852064 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.846894979 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.846923113 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:34.847034931 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:34.892323971 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.394009113 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.394063950 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.394196987 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:35.394754887 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.441593885 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:35.441601992 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.483514071 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:35.483525038 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.519145012 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:35.519159079 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.519639969 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:35.519644022 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.528702021 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:35.528707027 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.528724909 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:35.528728008 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.530533075 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:35.530536890 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.535563946 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.536112070 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.536216021 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:35.536223888 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.536344051 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:35.580029011 CET	49725	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:35.580073118 CET	443	49725	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:35.580152988 CET	49725	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:35.580430984 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.580621004 CET	49725	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:35.580641985 CET	443	49725	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:35.625246048 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:35.625263929 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:35.671077967 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:35.768304110 CET	49727	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:35.768416882 CET	443	49727	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:35.768524885 CET	49727	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:35.768948078 CET	49727	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:35.768979073 CET	443	49727	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:36.020456076 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:36.067392111 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:36.156869888 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:36.156963110 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:36.448101997 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:36.492366076 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:36.610994101 CET	49728	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:36.611026049 CET	443	49728	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:36.611140013 CET	49728	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:36.611407042 CET	49728	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:36.611423016 CET	443	49728	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:36.612900972 CET	49729	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:36.613006115 CET	443	49729	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:36.613089085 CET	49729	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:36.613404989 CET	49729	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:36.613434076 CET	443	49729	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.902013063 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.902256966 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.902324915 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.906409025 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.944298983 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.944354057 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.949796915 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.949810028 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.949868917 CET	49725	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.949995995 CET	49727	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.950040102 CET	443	49725	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.950113058 CET	49725	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.950141907 CET	443	49727	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.950197935 CET	49727	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.953866005 CET	49728	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.953943968 CET	49729	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.953974009 CET	443	49728	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.954171896 CET	443	49729	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.954245090 CET	49728	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.954267025 CET	49729	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.966329098 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.966341019 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.966379881 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.966388941 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.966424942 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.966424942 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.966438055 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.966479063 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:38.966500044 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:38.966510057 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.480884075 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.532366991 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:39.539922953 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:39.539938927 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:39.610764980 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.612226009 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.612323046 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:39.612394094 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.612462997 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:39.618911982 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.618974924 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.619036913 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:39.619071007 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.627252102 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:39.627291918 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.634460926 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:39.634473085 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:39.634807110 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.634874105 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.634938955 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:39.634955883 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.675326109 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:39.697463989 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:39.750736952 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:40.036010981 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.037319899 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.037421942 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.037445068 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.037517071 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.039297104 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.039375067 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.039434910 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.081958055 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.082017899 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.082092047 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.082112074 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.082123041 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.082171917 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.083273888 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.083389997 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.083492041 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.083497047 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.084944963 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.085001945 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.085007906 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.087707043 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.087764978 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.088861942 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.088881969 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.088917017 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.088922977 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.088972092 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.091017008 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.091037035 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.091094017 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.091099024 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.093147039 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.093252897 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.095215082 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.095298052 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.095304966 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.097347021 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.097408056 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.097414017 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.097476006 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.097518921 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.122706890 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.168675900 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.209530115 CET	443	49721	92.123.12.181	192.168.2.6
Mar 11, 2025 20:08:40.252866030 CET	49721	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:08:40.263716936 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:40.308322906 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:40.607878923 CET	49685	80	192.168.2.6	142.250.181.227
Mar 11, 2025 20:08:40.608067989 CET	49686	80	192.168.2.6	88.221.110.121
Mar 11, 2025 20:08:40.612797976 CET	80	49685	142.250.181.227	192.168.2.6
Mar 11, 2025 20:08:40.612864971 CET	49685	80	192.168.2.6	142.250.181.227
Mar 11, 2025 20:08:40.613065958 CET	80	49686	88.221.110.121	192.168.2.6
Mar 11, 2025 20:08:40.613148928 CET	49686	80	192.168.2.6	88.221.110.121
Mar 11, 2025 20:08:40.814732075 CET	443	49723	92.123.12.139	192.168.2.6
Mar 11, 2025 20:08:40.859724045 CET	49723	443	192.168.2.6	92.123.12.139
Mar 11, 2025 20:08:47.703244925 CET	49703	80	192.168.2.6	20.190.159.128
Mar 11, 2025 20:08:47.708131075 CET	80	49703	20.190.159.128	192.168.2.6
Mar 11, 2025 20:08:50.813916922 CET	49704	80	192.168.2.6	20.190.159.128
Mar 11, 2025 20:08:50.818640947 CET	80	49704	20.190.159.128	192.168.2.6
Mar 11, 2025 20:08:52.613720894 CET	49736	443	192.168.2.6	20.190.159.68
Mar 11, 2025 20:08:52.613802910 CET	443	49736	20.190.159.68	192.168.2.6
Mar 11, 2025 20:08:52.613884926 CET	49736	443	192.168.2.6	20.190.159.68
Mar 11, 2025 20:08:52.614319086 CET	49736	443	192.168.2.6	20.190.159.68
Mar 11, 2025 20:08:52.614352942 CET	443	49736	20.190.159.68	192.168.2.6
Mar 11, 2025 20:08:55.221308947 CET	443	49736	20.190.159.68	192.168.2.6
Mar 11, 2025 20:08:55.221740007 CET	49736	443	192.168.2.6	20.190.159.68
Mar 11, 2025 20:08:55.221785069 CET	443	49736	20.190.159.68	192.168.2.6
Mar 11, 2025 20:08:55.222347975 CET	443	49736	20.190.159.68	192.168.2.6
Mar 11, 2025 20:08:55.222424984 CET	49736	443	192.168.2.6	20.190.159.68
Mar 11, 2025 20:08:55.223361969 CET	443	49736	20.190.159.68	192.168.2.6
Mar 11, 2025 20:08:55.223423004 CET	49736	443	192.168.2.6	20.190.159.68
Mar 11, 2025 20:08:55.224410057 CET	49736	443	192.168.2.6	20.190.159.68
Mar 11, 2025 20:08:55.224518061 CET	443	49736	20.190.159.68	192.168.2.6
Mar 11, 2025 20:08:55.224670887 CET	49736	443	192.168.2.6	20.190.159.68
Mar 11, 2025 20:08:55.224695921 CET	443	49736	20.190.159.68	192.168.2.6
Mar 11, 2025 20:08:55.264875889 CET	49736	443	192.168.2.6	20.190.159.68
Mar 11, 2025 20:08:55.773056030 CET	443	49736	20.190.159.68	192.168.2.6
Mar 11, 2025 20:08:55.773169994 CET	443	49736	20.190.159.68	192.168.2.6
Mar 11, 2025 20:08:55.773206949 CET	49736	443	192.168.2.6	20.190.159.68
Mar 11, 2025 20:08:55.773260117 CET	49736	443	192.168.2.6	20.190.159.68
Mar 11, 2025 20:08:55.774821043 CET	49736	443	192.168.2.6	20.190.159.68
Mar 11, 2025 20:08:55.774859905 CET	443	49736	20.190.159.68	192.168.2.6
Mar 11, 2025 20:09:01.437730074 CET	49739	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:09:01.437792063 CET	443	49739	142.250.185.68	192.168.2.6
Mar 11, 2025 20:09:01.437896013 CET	49739	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:09:01.438292980 CET	49739	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:09:01.438307047 CET	443	49739	142.250.185.68	192.168.2.6
Mar 11, 2025 20:09:03.522912025 CET	443	49739	142.250.185.68	192.168.2.6
Mar 11, 2025 20:09:03.523333073 CET	49739	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:09:03.523401022 CET	443	49739	142.250.185.68	192.168.2.6
Mar 11, 2025 20:09:03.523777962 CET	443	49739	142.250.185.68	192.168.2.6
Mar 11, 2025 20:09:03.524133921 CET	49739	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:09:03.524218082 CET	443	49739	142.250.185.68	192.168.2.6
Mar 11, 2025 20:09:03.577456951 CET	49739	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:09:04.005902052 CET	49703	80	192.168.2.6	20.190.159.128
Mar 11, 2025 20:09:04.011518002 CET	80	49703	20.190.159.128	192.168.2.6
Mar 11, 2025 20:09:04.011595011 CET	49703	80	192.168.2.6	20.190.159.128
Mar 11, 2025 20:09:07.302268028 CET	443	49680	2.23.227.215	192.168.2.6
Mar 11, 2025 20:09:07.302326918 CET	443	49680	2.23.227.215	192.168.2.6
Mar 11, 2025 20:09:07.302525043 CET	49680	443	192.168.2.6	2.23.227.215
Mar 11, 2025 20:09:07.302525043 CET	49680	443	192.168.2.6	2.23.227.215
Mar 11, 2025 20:09:11.092191935 CET	49711	443	192.168.2.6	92.123.12.181
Mar 11, 2025 20:09:11.092255116 CET	443	49711	92.123.12.181	192.168.2.6
Mar 11, 2025 20:09:13.138593912 CET	443	49739	142.250.185.68	192.168.2.6
Mar 11, 2025 20:09:13.138668060 CET	443	49739	142.250.185.68	192.168.2.6
Mar 11, 2025 20:09:13.138895035 CET	49739	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:09:14.172375917 CET	49739	443	192.168.2.6	142.250.185.68
Mar 11, 2025 20:09:14.172456026 CET	443	49739	142.250.185.68	192.168.2.6
Mar 11, 2025 20:09:17.241137028 CET	58894	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:09:17.246000051 CET	53	58894	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:17.246098995 CET	58894	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:09:17.246124983 CET	58894	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:09:17.250859022 CET	53	58894	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:17.702950001 CET	53	58894	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:17.704019070 CET	58894	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:09:17.706321955 CET	58895	443	192.168.2.6	142.251.187.94
Mar 11, 2025 20:09:17.706412077 CET	443	58895	142.251.187.94	192.168.2.6
Mar 11, 2025 20:09:17.706506014 CET	58895	443	192.168.2.6	142.251.187.94
Mar 11, 2025 20:09:17.706897020 CET	58895	443	192.168.2.6	142.251.187.94
Mar 11, 2025 20:09:17.706933975 CET	443	58895	142.251.187.94	192.168.2.6
Mar 11, 2025 20:09:17.710004091 CET	53	58894	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:17.710062981 CET	58894	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:09:19.627979994 CET	443	58895	142.251.187.94	192.168.2.6
Mar 11, 2025 20:09:19.628396034 CET	58895	443	192.168.2.6	142.251.187.94
Mar 11, 2025 20:09:19.628463030 CET	443	58895	142.251.187.94	192.168.2.6
Mar 11, 2025 20:09:19.629508972 CET	443	58895	142.251.187.94	192.168.2.6
Mar 11, 2025 20:09:19.629590988 CET	58895	443	192.168.2.6	142.251.187.94
Mar 11, 2025 20:09:19.630825996 CET	58895	443	192.168.2.6	142.251.187.94
Mar 11, 2025 20:09:19.630898952 CET	443	58895	142.251.187.94	192.168.2.6
Mar 11, 2025 20:09:19.631050110 CET	58895	443	192.168.2.6	142.251.187.94
Mar 11, 2025 20:09:19.631069899 CET	443	58895	142.251.187.94	192.168.2.6
Mar 11, 2025 20:09:19.670862913 CET	58895	443	192.168.2.6	142.251.187.94
Mar 11, 2025 20:09:20.629870892 CET	443	58895	142.251.187.94	192.168.2.6
Mar 11, 2025 20:09:20.641541004 CET	443	58895	142.251.187.94	192.168.2.6
Mar 11, 2025 20:09:20.641618013 CET	58895	443	192.168.2.6	142.251.187.94

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 20:07:57.404166937 CET	53	55657	1.1.1.1	192.168.2.6
Mar 11, 2025 20:07:57.476108074 CET	53	61310	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:01.233247995 CET	53	54069	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:01.374501944 CET	53456	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:01.374785900 CET	51221	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:01.381742001 CET	53	51221	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:01.381777048 CET	53	53456	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:01.584191084 CET	53	55382	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:02.628427982 CET	59227	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:02.629839897 CET	49533	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:02.636068106 CET	52819	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:02.636068106 CET	51611	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:02.667227983 CET	53	49533	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:02.689488888 CET	53	52819	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:02.694994926 CET	53	59227	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:02.741453886 CET	53	51611	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:09.179343939 CET	50760	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:09.179610968 CET	58223	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:09.186497927 CET	53	50760	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:09.216661930 CET	53	58223	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:12.136862993 CET	55977	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:12.137135983 CET	50816	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:12.143821955 CET	53	50816	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:12.143980980 CET	53	55977	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:16.144386053 CET	61571	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:16.144609928 CET	49737	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:16.152097940 CET	53	49737	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:16.152153015 CET	53	61571	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:18.587712049 CET	53	54187	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:25.074544907 CET	59391	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:25.074716091 CET	65081	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:25.082101107 CET	53	65081	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:25.082881927 CET	53	59391	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:34.818834066 CET	59376	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:34.819107056 CET	49203	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:34.833007097 CET	53	49203	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:34.833048105 CET	53	59376	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:37.323326111 CET	53	49637	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:39.653990984 CET	53	53511	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:52.602830887 CET	60016	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:52.603084087 CET	62185	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:08:52.609957933 CET	53	62185	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:52.610258102 CET	53	60016	1.1.1.1	192.168.2.6
Mar 11, 2025 20:08:55.459142923 CET	138	138	192.168.2.6	192.168.2.255
Mar 11, 2025 20:08:57.010791063 CET	53	61694	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:00.039705038 CET	53	59907	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:01.728888035 CET	53	64191	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:12.176110029 CET	62727	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:09:12.176372051 CET	59263	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:09:12.182737112 CET	53	62727	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:12.183084965 CET	53	59263	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:13.187279940 CET	61464	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:09:13.187602997 CET	52037	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:09:13.194303989 CET	53	52037	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:13.194552898 CET	53	61464	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:15.218645096 CET	53001	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:09:15.226022959 CET	53	53001	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:16.233649969 CET	53001	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:09:16.241307974 CET	53	53001	1.1.1.1	192.168.2.6
Mar 11, 2025 20:09:17.233779907 CET	53001	53	192.168.2.6	1.1.1.1
Mar 11, 2025 20:09:17.240664005 CET	53	53001	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 11, 2025 20:08:09.216737986 CET	192.168.2.6	1.1.1.1	c26d	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 11, 2025 20:08:01.374501944 CET	192.168.2.6	1.1.1.1	0xf5b6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:01.374785900 CET	192.168.2.6	1.1.1.1	0x4ec9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 11, 2025 20:08:02.628427982 CET	192.168.2.6	1.1.1.1	0xbe4b	Standard query (0)	a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.629839897 CET	192.168.2.6	1.1.1.1	0x128a	Standard query (0)	a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com	65	IN (0x0001)	false
Mar 11, 2025 20:08:02.636068106 CET	192.168.2.6	1.1.1.1	0x2f70	Standard query (0)	a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com	65	IN (0x0001)	false
Mar 11, 2025 20:08:02.636068106 CET	192.168.2.6	1.1.1.1	0xbf5d	Standard query (0)	a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:09.179343939 CET	192.168.2.6	1.1.1.1	0x4bcb	Standard query (0)	www.office.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:09.179610968 CET	192.168.2.6	1.1.1.1	0x7a42	Standard query (0)	www.office.com	65	IN (0x0001)	false
Mar 11, 2025 20:08:12.136862993 CET	192.168.2.6	1.1.1.1	0x7fdc	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:12.137135983 CET	192.168.2.6	1.1.1.1	0x45b6	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Mar 11, 2025 20:08:16.144386053 CET	192.168.2.6	1.1.1.1	0xeeb0	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:16.144609928 CET	192.168.2.6	1.1.1.1	0x9e02	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Mar 11, 2025 20:08:25.074544907 CET	192.168.2.6	1.1.1.1	0x4b8a	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:25.074716091 CET	192.168.2.6	1.1.1.1	0x1d7c	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Mar 11, 2025 20:08:34.818834066 CET	192.168.2.6	1.1.1.1	0x2166	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:34.819107056 CET	192.168.2.6	1.1.1.1	0xf2a9	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Mar 11, 2025 20:08:52.602830887 CET	192.168.2.6	1.1.1.1	0xaa0f	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:52.603084087 CET	192.168.2.6	1.1.1.1	0x7023	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Mar 11, 2025 20:09:12.176110029 CET	192.168.2.6	1.1.1.1	0x2cf8	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:09:12.176372051 CET	192.168.2.6	1.1.1.1	0xd1a6	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 11, 2025 20:09:13.187279940 CET	192.168.2.6	1.1.1.1	0xfc4b	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:09:13.187602997 CET	192.168.2.6	1.1.1.1	0xaeb0	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 11, 2025 20:09:15.218645096 CET	192.168.2.6	1.1.1.1	0x86eb	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:09:16.233649969 CET	192.168.2.6	1.1.1.1	0x86eb	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:09:17.233779907 CET	192.168.2.6	1.1.1.1	0x86eb	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:09:17.246124983 CET	192.168.2.6	1.1.1.1	0x1	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 11, 2025 20:08:01.381742001 CET	1.1.1.1	192.168.2.6	0x4ec9	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 11, 2025 20:08:01.381777048 CET	1.1.1.1	192.168.2.6	0xf5b6	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.667227983 CET	1.1.1.1	192.168.2.6	0x128a	No error (0)	a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com	ak.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:02.667227983 CET	1.1.1.1	192.168.2.6	0x128a	No error (0)	ak.privatelink.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:02.689488888 CET	1.1.1.1	192.168.2.6	0x2f70	No error (0)	a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com	ak.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:02.689488888 CET	1.1.1.1	192.168.2.6	0x2f70	No error (0)	ak.privatelink.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:02.694994926 CET	1.1.1.1	192.168.2.6	0xbe4b	No error (0)	a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com	ak.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:02.694994926 CET	1.1.1.1	192.168.2.6	0xbe4b	No error (0)	ak.privatelink.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:02.694994926 CET	1.1.1.1	192.168.2.6	0xbe4b	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.128	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.694994926 CET	1.1.1.1	192.168.2.6	0xbe4b	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.73	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.694994926 CET	1.1.1.1	192.168.2.6	0xbe4b	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.64	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.694994926 CET	1.1.1.1	192.168.2.6	0xbe4b	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.4	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.694994926 CET	1.1.1.1	192.168.2.6	0xbe4b	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.129	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.694994926 CET	1.1.1.1	192.168.2.6	0xbe4b	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.31.3	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.694994926 CET	1.1.1.1	192.168.2.6	0xbe4b	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.31.2	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.694994926 CET	1.1.1.1	192.168.2.6	0xbe4b	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.31.1	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.741453886 CET	1.1.1.1	192.168.2.6	0xbf5d	No error (0)	a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com	ak.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:02.741453886 CET	1.1.1.1	192.168.2.6	0xbf5d	No error (0)	ak.privatelink.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:02.741453886 CET	1.1.1.1	192.168.2.6	0xbf5d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.23	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.741453886 CET	1.1.1.1	192.168.2.6	0xbf5d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.31.129	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.741453886 CET	1.1.1.1	192.168.2.6	0xbf5d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.73	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.741453886 CET	1.1.1.1	192.168.2.6	0xbf5d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.71	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.741453886 CET	1.1.1.1	192.168.2.6	0xbf5d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.31.1	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.741453886 CET	1.1.1.1	192.168.2.6	0xbf5d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.131	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.741453886 CET	1.1.1.1	192.168.2.6	0xbf5d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.68	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:02.741453886 CET	1.1.1.1	192.168.2.6	0xbf5d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.31.67	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:09.186497927 CET	1.1.1.1	192.168.2.6	0x4bcb	No error (0)	www.office.com	home-portal.office.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:09.186497927 CET	1.1.1.1	192.168.2.6	0x4bcb	No error (0)	home-portal.office.com	home-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:09.186497927 CET	1.1.1.1	192.168.2.6	0x4bcb	No error (0)	home-office365-com.b-0004.b-msedge.net	b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:09.186497927 CET	1.1.1.1	192.168.2.6	0x4bcb	No error (0)	b-0004.b-msedge.net		13.107.6.156	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:09.216661930 CET	1.1.1.1	192.168.2.6	0x7a42	No error (0)	www.office.com	home-portal.office.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:09.216661930 CET	1.1.1.1	192.168.2.6	0x7a42	No error (0)	home-portal.office.com	home-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143821955 CET	1.1.1.1	192.168.2.6	0x45b6	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143821955 CET	1.1.1.1	192.168.2.6	0x45b6	No error (0)	login.mso.msidentity.com	ak.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143821955 CET	1.1.1.1	192.168.2.6	0x45b6	No error (0)	ak.privatelink.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143980980 CET	1.1.1.1	192.168.2.6	0x7fdc	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143980980 CET	1.1.1.1	192.168.2.6	0x7fdc	No error (0)	login.mso.msidentity.com	ak.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143980980 CET	1.1.1.1	192.168.2.6	0x7fdc	No error (0)	ak.privatelink.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143980980 CET	1.1.1.1	192.168.2.6	0x7fdc	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.66	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143980980 CET	1.1.1.1	192.168.2.6	0x7fdc	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.32.72	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143980980 CET	1.1.1.1	192.168.2.6	0x7fdc	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.32.140	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143980980 CET	1.1.1.1	192.168.2.6	0x7fdc	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.2	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143980980 CET	1.1.1.1	192.168.2.6	0x7fdc	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.22	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143980980 CET	1.1.1.1	192.168.2.6	0x7fdc	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.5	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143980980 CET	1.1.1.1	192.168.2.6	0x7fdc	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.32.136	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:12.143980980 CET	1.1.1.1	192.168.2.6	0x7fdc	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.132	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:16.152097940 CET	1.1.1.1	192.168.2.6	0x9e02	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:16.152097940 CET	1.1.1.1	192.168.2.6	0x9e02	No error (0)	www.tm.aadcdn.msftauth.akadns.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:16.152097940 CET	1.1.1.1	192.168.2.6	0x9e02	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:16.152153015 CET	1.1.1.1	192.168.2.6	0xeeb0	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:16.152153015 CET	1.1.1.1	192.168.2.6	0xeeb0	No error (0)	www.tm.aadcdn.msftauth.akadns.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:16.152153015 CET	1.1.1.1	192.168.2.6	0xeeb0	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:16.152153015 CET	1.1.1.1	192.168.2.6	0xeeb0	No error (0)	e329293.dscd.akamaiedge.net		92.123.12.181	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:16.152153015 CET	1.1.1.1	192.168.2.6	0xeeb0	No error (0)	e329293.dscd.akamaiedge.net		92.123.12.139	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:25.082101107 CET	1.1.1.1	192.168.2.6	0x1d7c	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:25.082101107 CET	1.1.1.1	192.168.2.6	0x1d7c	No error (0)	nel.measure.office.net.edgesuite.net	a1894.dscb.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:25.082881927 CET	1.1.1.1	192.168.2.6	0x4b8a	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:25.082881927 CET	1.1.1.1	192.168.2.6	0x4b8a	No error (0)	nel.measure.office.net.edgesuite.net	a1894.dscb.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:25.082881927 CET	1.1.1.1	192.168.2.6	0x4b8a	No error (0)	a1894.dscb.akamai.net		88.221.110.82	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:25.082881927 CET	1.1.1.1	192.168.2.6	0x4b8a	No error (0)	a1894.dscb.akamai.net		2.16.100.176	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:25.092187881 CET	1.1.1.1	192.168.2.6	0x6cd1	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:25.092187881 CET	1.1.1.1	192.168.2.6	0x6cd1	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:34.833007097 CET	1.1.1.1	192.168.2.6	0xf2a9	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:34.833007097 CET	1.1.1.1	192.168.2.6	0xf2a9	No error (0)	www.tm.aadcdn.msftauth.trafficmanager.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:34.833007097 CET	1.1.1.1	192.168.2.6	0xf2a9	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:34.833048105 CET	1.1.1.1	192.168.2.6	0x2166	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:34.833048105 CET	1.1.1.1	192.168.2.6	0x2166	No error (0)	www.tm.aadcdn.msftauth.trafficmanager.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:34.833048105 CET	1.1.1.1	192.168.2.6	0x2166	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:34.833048105 CET	1.1.1.1	192.168.2.6	0x2166	No error (0)	e329293.dscd.akamaiedge.net		92.123.12.139	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:34.833048105 CET	1.1.1.1	192.168.2.6	0x2166	No error (0)	e329293.dscd.akamaiedge.net		92.123.12.181	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:52.609957933 CET	1.1.1.1	192.168.2.6	0x7023	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:52.609957933 CET	1.1.1.1	192.168.2.6	0x7023	No error (0)	login.mso.msidentity.com	ak.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:52.609957933 CET	1.1.1.1	192.168.2.6	0x7023	No error (0)	ak.privatelink.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:52.610258102 CET	1.1.1.1	192.168.2.6	0xaa0f	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:52.610258102 CET	1.1.1.1	192.168.2.6	0xaa0f	No error (0)	login.mso.msidentity.com	ak.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:52.610258102 CET	1.1.1.1	192.168.2.6	0xaa0f	No error (0)	ak.privatelink.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:08:52.610258102 CET	1.1.1.1	192.168.2.6	0xaa0f	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.68	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:52.610258102 CET	1.1.1.1	192.168.2.6	0xaa0f	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.31.3	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:52.610258102 CET	1.1.1.1	192.168.2.6	0xaa0f	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.0	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:52.610258102 CET	1.1.1.1	192.168.2.6	0xaa0f	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.4	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:52.610258102 CET	1.1.1.1	192.168.2.6	0xaa0f	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.31.131	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:52.610258102 CET	1.1.1.1	192.168.2.6	0xaa0f	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.64	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:52.610258102 CET	1.1.1.1	192.168.2.6	0xaa0f	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.159.130	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:08:52.610258102 CET	1.1.1.1	192.168.2.6	0xaa0f	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.31.67	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:09:12.182737112 CET	1.1.1.1	192.168.2.6	0x2cf8	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:09:12.182737112 CET	1.1.1.1	192.168.2.6	0x2cf8	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.67	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:09:12.183084965 CET	1.1.1.1	192.168.2.6	0xd1a6	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:09:13.194303989 CET	1.1.1.1	192.168.2.6	0xaeb0	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:09:13.194552898 CET	1.1.1.1	192.168.2.6	0xfc4b	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:09:13.194552898 CET	1.1.1.1	192.168.2.6	0xfc4b	No error (0)	beacons-handoff.gcp.gvt2.com		172.217.18.3	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:09:15.226022959 CET	1.1.1.1	192.168.2.6	0x86eb	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:09:15.226022959 CET	1.1.1.1	192.168.2.6	0x86eb	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.185.99	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:09:16.241307974 CET	1.1.1.1	192.168.2.6	0x86eb	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:09:16.241307974 CET	1.1.1.1	192.168.2.6	0x86eb	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.185.99	A (IP address)	IN (0x0001)	false
Mar 11, 2025 20:09:17.702950001 CET	1.1.1.1	192.168.2.6	0x1	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 20:09:17.702950001 CET	1.1.1.1	192.168.2.6	0x1	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.187.94	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com

www.office.com

identity.nel.measure.office.net

beacons.gcp.gvt2.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49704	20.190.159.128	80	5280	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 20:08:05.643070936 CET	465	OUT	GET / HTTP/1.1 Host: a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 11, 2025 20:08:05.808360100 CET	540	IN	HTTP/1.1 302 Found Content-Length: 0 Location: https://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com:443/ Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly client-request-id: 148fee15-fee3-485c-87ed-d93b9a9bbdb5 nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]} Date: Tue, 11 Mar 2025 19:08:05 GMT
Mar 11, 2025 20:08:50.813916922 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49703	20.190.159.128	80	5280	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 20:08:47.703244925 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49705	20.190.159.23	443	5280	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 19:08:05 UTC	700	OUT	GET / HTTP/1.1 Host: a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49706	20.190.159.23	443	5280	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 19:08:08 UTC	700	OUT	GET / HTTP/1.1 Host: a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 19:08:09 UTC	1923	IN	HTTP/1.1 302 Found Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://www.office.com/login# X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: b382f816-7e08-4845-bfdc-3a9f3ee80000 x-ms-ests-server: 2.1.20203.6 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-mD_RJcVvU-iHJl4zNSIkKA' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=AqPDBABBJldNmxNSYNN-I7o; expires=Thu, 10-Apr-2025 19:08:08 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEDFspIYl2sA9En1MTJe4tu-oQZ8OZr8bkNrHRZcCGtUh94PynkTKDVXkINpvt7_pPS12_YFAd-ebcC1rLDBxYjr8tS1vnZC8JN7O33R9KtBsNUB5yiPJCg6H3osj63RdmcQMU8dapDaI6Vv0T6-u0_uszvyPETv_06sSHVDNRju0gAA; domain=.a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Tue, 11 Mar 2025 19:08:08 GMT Connection: close Content-Length: 146
2025-03-11 19:08:09 UTC	146	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6f 66 66 69 63 65 2e 63 6f 6d 2f 6c 6f 67 69 6e 23 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://www.office.com/login#">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49708	13.107.6.156	443	5280	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 19:08:11 UTC	669	OUT	GET /login HTTP/1.1 Host: www.office.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 19:08:12 UTC	2128	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Location: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638773168918864076.YzE1ODYyYjAtMzg5Yy00ZTgxLTkyYzEtYzQ5ZWE1OWQ4MmNjOWFkNjRhNGEtYzI1ZC00OGViLTk2ZmUtY2RhMzUxNGMyYzFl&ui_locales=en-US&mkt=en-US&client-request-id=e39431f3-0450-44f6-b8f1-2265fed25ebb&state=OHnd2ixKt3AjppjTeyN4CoCpztetXbhFS03QKLCE2mYOlmerZ_dZ3huSzMrZLFXiKocC6eSM26q4fSLOUdSQXjTWrLtBWBZorSTzPdOhA-A5QkecvAFLLayvFABsnNP9KByTL4UAQY5z4LjfMAsCTG7pwOi9VmIxlwMS-zPLCEbqx6hMc-WuQSEf95IR_xk0ElEPD99NEWKXG4u8NrtBwKzdGxNVELE8sBtfSLoViiP7-i_D3N-7lNa5wrGck6jUs8Ydv7idTUwLiAAHK9o_OQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Set-Cookie: OH.FLID=a556f97b-9d2a-4667-8207-7889f6129dcf; expires=Wed, 11 Mar 2026 19:08:11 GMT; path=/; secure; samesite=none; httponly Set-Cookie: OH.SID=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.10hAcRtHRSeWl6WJzkcS_w48l6KxgK43DqePamczGhiiIWrwr8hnSNOJEnPrlTpfs9EWNGz8PtSnbTLFV4ZHGUcUgN49XVptCSbmnNG6azlbNx7w6g9Ieg2zrDrQtWKQ5p2_dFg-4vaQGa8KDTYhZARddCEo2r2_7XbsGKkU9-BvNeWTCKZf-470VyALN3Ddabjl-tnl4FItu295NtW0f_Tm887lLP6XdvIhWBxqj7WuWU5wUp8PYlY0CzE6jFXD=N; expires=Tue, 11 Mar 2025 19:23:11 GMT; path=/; secure; samesite=none; httponly Set-Cookie: .AspNetCore.Correlation.7_YGg3hh9GXP3ux-n7g05YIrrLGokaL3uQuvqqIF7ss=N; expires=Tue, 11 Mar 2025 19:23:11 GMT; path=/; secure; samesite=none; httponly Request-Context: appId= Strict-Transport-Security: max-age=31536000; includeSubDomains Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-UA-Compatible: IE=edge,chrome=1 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 438055715D904EB4A116E002469F47B5 Ref B: CH1AA2020618049 Ref C: 2025-03-11T19:08:11Z Date: Tue, 11 Mar 2025 19:08:11 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49719	88.221.110.82	443	5280	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 19:08:27 UTC	442	OUT	OPTIONS /api/report?catId=GW+estsfd+ams2 HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Origin: https://login.microsoftonline.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 19:08:27 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Tue, 11 Mar 2025 19:08:27 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-03-11 19:08:27 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49722	88.221.110.82	443	5280	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 19:08:29 UTC	418	OUT	POST /api/report?catId=GW+estsfd+ams2 HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Content-Length: 1233 Content-Type: application/reports+json Origin: https://login.microsoftonline.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 19:08:29 UTC	1233	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 33 35 30 38 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 2f 76 32 2e 30 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 34 37 36 35 34 34 35 62 2d 33 32 63 36 2d 34 39 62 30 2d 38 33 65 36 2d 31 64 39 33 37 36 35 32 37 36 63 61 26 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 6f 66 66 69 63 Data Ascii: [{"age":0,"body":{"elapsed_time":3508,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.offic
2025-03-11 19:08:31 UTC	399	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:0df9f0fa-2b61-4bcc-8864-10ea6079c765 Date: Tue, 11 Mar 2025 19:08:30 GMT Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49736	20.190.159.68	443	5280	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 19:08:55 UTC	1639	OUT	GET /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-FzL3kq6xAMc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEb_t32lNc_37PuaDiHKTO0eiM3RNAIp1pthzwX-8wZlx591ZCX_bFVOLTZaLecJhIQkuMQ2BmHcDhF8mgZawAo9n1x-_kdvAXYo954cvEr_ux7Fo--thguN-jg-629lMb1My9sb2jwTG_YGg3QINMvSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXQAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB0AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEj76hlzcaZdqP7sX6jhffHQKfSclAQH1tkeh_o3iO88lADb4yacZxNcse87ibmkS9gq0Jfe6XcOote5xVZPvm-t9Ew7vlzB7VQjp56oXVEbsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEGlVmqCMUloIctEndE4GoNm2EQOr8xsN8wz4-m6kWPaknYRsb8Jj7kSCVReyMcA05GFZzdXU7dQKmpV69RRCfRlkrl5iMJnpouhlzxy1aPCAbEpU7F2ECNUMv0s5cHwZUUK4WUUcyeoOsVcfchij7uSv5-JGimWvmOhXUU5uQ54IgAA; esctx-DXVSjgVVZp4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEJ4ipyAx-59U-CjfuK1ubbkylg13n6S5fFpYJKHZRz0X1uZzDdMNAXz56HiQWHhh70be-WHWBXB9SZMQp1OQNx9si8frUw1JOTKsR9lTRsf46Ipna7anamTKL47wYsT_6E52diw61LEhQbv3z-NvZPCAA; fpc=AkWWIirCfJpNtxMVnUDm-WG8Ae7AAQAAACiBYt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=8e2b [TRUNCATED]
2025-03-11 19:08:55 UTC	1565	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: f9c2b3fc-f824-4eda-93d0-e679928d1300 x-ms-ests-server: 2.1.20203.6 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-PWFEhShxU4RFys9iHwsQjg' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=AkWWIirCfJpNtxMVnUDm-WG8Ae7AAQAAACiBYt8OAAAA; expires=Thu, 10-Apr-2025 19:08:55 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Tue, 11 Mar 2025 19:08:54 GMT Connection: close Content-Length: 164
2025-03-11 19:08:55 UTC	164	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 38 39 32 30 61 66 62 34 2d 39 64 39 63 2d 34 65 66 36 2d 39 66 39 38 2d 38 35 37 64 64 65 33 38 33 38 39 31 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 35 2d 30 33 2d 31 31 20 31 39 3a 30 38 3a 35 35 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d Data Ascii: {"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"8920afb4-9d9c-4ef6-9f98-857dde383891","timestamp":"2025-03-11 19:08:55Z","message":"AADSTS900561"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	58895	142.251.187.94	443	5280	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 19:09:19 UTC	363	OUT	POST /domainreliability/upload HTTP/1.1 Host: beacons.gcp.gvt2.com Connection: keep-alive Content-Length: 277 Content-Type: application/json; charset=utf-8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 19:09:19 UTC	277	OUT	Data Raw: 7b 22 65 6e 74 72 69 65 73 22 3a 5b 7b 22 66 61 69 6c 75 72 65 5f 64 61 74 61 22 3a 7b 22 63 75 73 74 6f 6d 5f 65 72 72 6f 72 22 3a 22 6e 65 74 3a 3a 45 52 52 5f 41 42 4f 52 54 45 44 22 7d 2c 22 6e 65 74 77 6f 72 6b 5f 63 68 61 6e 67 65 64 22 3a 66 61 6c 73 65 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 22 2c 22 72 65 71 75 65 73 74 5f 61 67 65 5f 6d 73 22 3a 36 32 31 34 31 2c 22 72 65 71 75 65 73 74 5f 65 6c 61 70 73 65 64 5f 6d 73 22 3a 31 35 31 32 2c 22 73 61 6d 70 6c 65 5f 72 61 74 65 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 61 62 6f 72 74 65 64 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 22 2c 22 77 61 73 5f 70 72 6f 78 69 65 64 22 3a 66 61 6c 73 65 7d Data Ascii: {"entries":[{"failure_data":{"custom_error":"net::ERR_ABORTED"},"network_changed":false,"protocol":"","request_age_ms":62141,"request_elapsed_ms":1512,"sample_rate":1.0,"server_ip":"","status":"aborted","url":"https://www.google.com/","was_proxied":false}
2025-03-11 19:09:20 UTC	806	IN	HTTP/1.1 200 OK Report-To: {"group":"ntbdioescrec:47:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ntbdioescrec:47:0"}],} NEL: {"failure_fraction":1,"include_subdomains":false,"max_age":300,"report_to":"nel","success_fraction":0.25} Content-Type: application/javascript; charset=utf-8 Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ntbdioescrec:47:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=ntbdioescrec:47:0 Date: Tue, 11 Mar 2025 19:09:20 GMT Server: Domain Reliability Server Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	2
Start time:	15:07:50
Start date:	11/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	15:07:55
Start date:	11/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2112,i,11371315530667424221,9145693074874910444,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	15:08:01
Start date:	11/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com"
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

Windows Analysis Report
http://a6691cd0-2aca-4f5d-b954-fae129580e64.ciamlogin.com