SQLite format 3@ sDs-r  N U)a-triggerNetLog_on_insert_trimLogTableCREATE TRIGGER [NetLog_on_insert_trim] AFTER INSERT ON [LogTable] FOR EACH ROW BEGIN update LogTable set Text = trim(replace(replace(replace(Text, ' ', ' '), ' ', ' '), ' ', ' ')) where rowid = new.rowid; ENDD!i-uindexindex_LogTable_DateTimeLogTableCREATE INDEX index_LogTable_DateTime ON LogTable(DateTime)"!E-Uindexindex_LogTableLogTableCREATE UNIQUE INDEX index_LogTable ON LogTable(id)!II%tablesqlite_sequencesqlite_sequenceCREATE TABLE sqlite_sequence(name,seq)!--MtableLogTableLogTableCREATE TABLE LogTable ( id INTEGER PRIMARY KEY AUTOINCREMENT, DateTime INTEGER, Text TEXT, LogType INTEGER ) Muj~daca79jۃdate=2026-08-14 time=23:22:43 logver=2 id=96953 type=syste)'yEjdate=2026-08-15 time=19:05:09 logver=2 id=96602 type=securityevent subtype=sslvpn eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="SSLVPN service started successfully" vpnstate=1xYjdate=20536]jGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A devikFMjGdate=2026-08-16 time=07:04:38 logver=2 id=96520 type=sec}Jqjdate=20}Rqj date=2026-08-16 time=10:41:13 logver=2 id=96825 type=systemevent subtype=system eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" user=mcculloc@ONCONCORD msg="Update was successful, current engine/signature information recorded" avengine=6.00294 avsig=93.07742 avsigext=93.07738 rootkitengine=2.00068 rootkitsig=0.00000 vulnsig=2.00018 vulnengine=3.00002 "Q1j date=2026-08-16 time=10:41:12 logver=2 id=96650 type=systemevent subtype=update eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" user=mcculloc@ONCONCORD msg="Update was successful" avsigpallas=4.04813 avsiglastupdate="2026-08-16 07:41:47-04" -LogTableR LLLLLLLLLLLLLLLL88                                                                                            (((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( ~tj`VLB8.$zpf\RH>4*  vlbXND:0&  &? &?  &> &>  &= &=  &< &<  &; &;  &: &:  &9 &9  &8 &8  &7 &7  &6 &6  &5 &5  &4 &4  &3 &3  &2 &2  &1 &1  &0 &0  &/ &/  &. &.  &- &-  &, &,  &+ &+  &* &*  &) &)  &( &(  &' &'  && &&  &% &%  &$ &$  &# &#  &" &"  &! &!  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  & & & &Z & &  & & & & & & & &  & & & &  & & t & &| & &| & &| & &| & &| & &| & &| & &| & &| & &| & &|x & &|n & &|d & &|Z & &|P & &|F & &|< & &|2 & &|( & &| & &| & &| & &  & & & &l & &l & &l & &l & &l & &l & &l & &l & &l & &l & &lx & &ln &} &}ld &{ &{lZ &y &ylP &w &wlF &u &ul< &s &sl2 &q &ql( &o &ol &m &ml &k &kl &i &i  &g &g &f &f f &d &d f &b &b f &` &` f &^ &^ f &\ &\ f &Z &Z f &X &X f &V &V f &T &T f &R &R f &P &P fx &N &N fn &L &L  m m l l k k j j i i h h g g f f e e d d c c b b a a ` `| _ _r ^ ^h ] ]^ \ \T [ [J Z Z@ Y Y6 X X, W W" V V U U T T S S                            x n d Z P F  <  2  (                      ~ t j ` V L B 8 . $                 z p f \ R H > 4 *                  v l ,2,2X,1,1N,0,0D,/,/:,.,.0,-,-&,,,,,+,+,*,*,),),(,(,',',&,&,%,%,$,$,#,#,",",!,!, , ,,,,,,,,|,,r,,h,,^,,T,, kk@kk WW ΖΖ"ΕΕΔΔΓΓΒΒΑΑΐΐ ֵֵֶֶַַ  FFEEDDCCBBAAx@@n??d>>Z==P<<F;;<::299(8877 RR QQ ::::::::::::::::$$ a a a a a a a a a a a a a a a a a a a a a a a a a a a a x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x mDDDDDDDDDDDDDDDDDDDDDDDDDDDyncXMB7,! |qf[PE:/$ti^SH=2' e$ &% e$ &$ e$ &# e$ &" e$ &! e$ & e$ & e$ & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e% & e% & e%g & e%+ & e% &Je$ &J e$ & e$ & e$ &Re$ &Re$ &Re$ &Re$ &Re$ &Re$ &Re$ &Re$ &Re$ &Re$ &Re$ &Rye$ &Rne$ &Rce$ &RXe$ &RMe$ &RBe$ &R7e$ &R,e$ &R!e$ &Re$ &R e$ & e$ &e$ &Ze$ &Ze$ &Ze$ &Ze$ &Ze$ &Ze$ &Ze$ &Ze$ &Ze$ &Ze$ &Ze$ &Zye$ &}Zne$ &{Zce$ &yZXe$ &wZMe$ &uZBe$ &sZ7e$ &qZ,e$ &oZ!e$} &mZe$| &k f mf lf kfJ jf if hzf gofZ fdf eYf dNf cCfj b8f. a-f `"f _fz ^ f> ]f \f [f ZfN Yf Xf Wf Vf^ Uf" Tf S fǍ#  fǍ! }fǍ! rfƵ gfƵg \fƵ+ Qfƴ Ffƴ ;fƴw 0fƴ; %fƳ fƳ fƳ fƳK fƳ fƲ fƲ fƲ[ fƲ fƱ fƱ fƱk fƱ/ fư fư fư{ ufư? jfư _fƯ TfƯ IfƯO >fƯ 3fƮ (fƮ fƮ_ fƮ# fƭ fƭ fƭo fƭ3 fƬ fƬ fƬ fƬC fƬ fƫ fƫ fƫS fƫ xfƪ mfƪ bfƪc Wfƪ' LfƩ AfƩ 6fƩs +fƩ7  fƨ fƨ  fƨ fƨG fƨ fƧ fƧ fƧW fƧ fƦ fƦ fƦg fƦ+ fƥ fƥ {fƥw pfƥ; efƤ ZfƤ OfƤ DfƤK 9fƤ .fƣ #fƣ fƣ[  fƣ fƢ fƢ fƢk fƢ/ fơ fơ fơ{ fơ? fơ f|,2f|,1f| ,0~f{,/sf{,.hf{U,-]f{,,Rfz,+Gfz,*cjG=XjG<MjG;BjG:7jG9,jG8!jG7 j R j Q  836]jGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=4460 vulnname="Security Vulnerabilities fixed in ArcGIS ArcReader 10.8.2" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/4460 detectedpath="C:\\Program Files (x86)\\ArcGIS\\ArcReader10.6\\"C5}jGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=2256 vulnname="Intel Chipset Device Software CVE-2019-0128 Weak Authentication Vulnerability" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/2256 detectedpath={FEBB7B48-CC1C-4A50-A497-FA21413F6BE9}  |z$m e"date=2024-02-29 time=19:35:35 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253335 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0#!e"date=2z&m e"date=2024-02-29 time=19:35:36 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253336 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0z"m e"date=2024-02-29 time=19:35:31 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253331 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0 xq[E/t^H2 w a K 5  z d N 8 " r \ F 0   j T > 3   m W A + {eO9# s]G1&v`J4yncXMB7,! |qf[PE:/$ti^SH=2' e$ &% e$ &$ e$ &# e$ &" e$ &! e$ & e$ & e$ & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# %) e# % e# %? e# % e# %U e# % e# %k e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# %< e# % e# % e# %R e# % e# %h e# % e# %~ e# % e# % e# % e# % e# % e# % e#~ % e#| % e#{ % e#{ % e#z % e#z % e#y % e#y % e#x % e#w %. e#v % e#v %D e#u % e#u %Z e#t % e#t %p e#s % e#r % e#q % e#o % e#n % e#n % e#m % e#m % e#l % e#l % e#k % e#k % e#j % e#h % e#g % e#e % e#d % e#d % 6 e#c % e#a % L e#` % e#_ % b e#] % e#[ % x e#Z % e#Z % e#Y % e#Y % e#X % e#X % e#W % e#V %~ e#U %} e#S %| e#R %{ e#R %z e#Q %y e#O %x  e#N %w e#N %v ( e#M %u e#M %t I e#L %s e#K %r e#K %q _ e#J %p e#J %o u e#I %n e#G %m e#F %l e#F %k e#E %j e#C %i e#B %h e#B %g e#A %f e#? %e e#> %d e#< %c e#; %b e#; %a  e#: %` e#8 %_ % e#7 %^ e#4 %] ; e#3 %\ e#3 %[ Q e#2 %Z e#1 %Y g e#0 %X e#0 %W } e#/ %V e#, %U e#+ %T e#) %S e#( %R e#% %Q e#$ %P e#$ %O e## %N e## %M e#" %L e#! %K  e# %J e# %I  e# %H e# %G - e# %F e# %E C e# %D e# %C Y e# %B e# %A o e# %@ e# %? e# %> e# %= e# %< e# %; e# %: e# %9 e# %8 e# %7 e# %6 e# %5 e# %4 e# %3 e# %2  e# %1 e" %0 * e" %/ e" %. @ e" %- e" %, V e" %+ e" %* l e" %) e" %( e" %' e" %& e" %% e" %$ e" %# e" %" e" %! e" % e" % e" % e" % e" % e" % e" % e" %' e" % e" %= e" % e" %S e" % e" %i e" % e" % e" % e" % e" % e" %  e" % e" %  e" % e" %  e" % e" % e" % e" % e" % e" % e" %$ e" % e" %: e" $ e" $P e" $ e" $f e" $ e"m $| e"l $ e"l $ e"k $ e"[ $ e"V $ e"U $ e"U $ e"T $ e"L $ e"K $ e"K $ e"J $ e"9 $ e"8 $  z d N 8 " r \ F ; %  u _ I 3   x b L 6 {eO9# s]G1v`J4nXB,|f[E/^S='|qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq& e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ e$ & e$ &!e$ &e$ & e$ & e$ & e$ &e$ & e$ & e$ & e$ &e$ & e$ & e$ &2 e$ & e$ &H e$ & e$ &i e$ & e$ & e$ &e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ &$ e$ & e$ &: e$ & e$ &P e$ & e$ &q e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ & e$ &! e$ & e$ &7 e$ & e$ &M e$ & e$ &c e$ & e$ &y e$ & e$ & e$ &~ e$ &} e$ &| e$ &{ e$ &z e$ &y e$ &x e$ &w e$ &v e$ &u e$ &t e$ &s e$ &r e$ &q) e$ &p e$ &o? e$~ &n e$} &mU e$| &l e$| &kk e${ &j e$y &i e$x &h e$w &g e$w &f e$u &e e$s &d e$r &c e$r &b e$q &a e$o &` e$n &_ e$n &^ e$m &] e$l &\ e$k &[ e$k &Z& e$j &Y e$i &X< e$h &W e$f &VR e$e &U e$c &Th e$b &S e$b &R~ e$a &Q e$` &P e$^ &O e$\ &N e$[ &M e$Y &L e$Y &K e$W &J e$V &I e$T &H e$S &G e$S &F e$R &E e$P &D e$O &C e$N &B. e$M &A e$M &@D e$L &? e$I &>Z e$H &= e$H &<p e$G &; e$D &: e$C &9 e$> &8 e$= &7 e$; &6 e$5 &5 e$4 &4 e$. &3 e$- &2 e$- &1 e$, &0 e$* &/ e$) &. e$ &-  e$ &, e$ &+ + e$ &* e$ &) A e$ &( e$ &' W e$ && e$ &% m e$ &$ e$ &# e$ &" e$ &! e$ & e$ & e$ & e# & e# & e# & e# & e# & e# & e# & e# &  e# & e# & ( e# & e# & > e# & e# & T e# & e# & j e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# & e# &  e# % e# %  e# % e# % 0 e# % e# % Q e# % e# % e# % g e# % e# % } e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# %  e# % e# %  e# % e# % - e# % e# % C e# % e# % Y e# % e# % o e# % e# % e# % e# % e# % e# %e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e# % e#~ % e#| % e#{ % e#{ % e#z % e#z % e#y % e#y % e#x % e#w % e#v % e#v % e#u % e#u % e#t % e#t % e#s % e#r % e#q % e#o % e#n % e#n % e#m % e% & e% & e% & e%g & e%+ & e% & e% & e$ & e$ & e$ & e$ & e$ & e$ & \~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    | r h ^ T J @ 6 , "    x n d Z P F < 2 (   ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\RH>4*  vlbXND:0&  &? &?  &> &>  &= &=  &< &<  &; &;  &: &:  &9 &9  &8 &8  &7 &7  &6 &6  &5 &5  &4 &4  &3 &3  &2 &2  &1 &1  &0 &0  &/ &/  &. &.  &- &-  &, &,  &+ &+  &* &*  &) &)  &( &(  &' &'  && &&  &% &%  &$ &$  &# &#  &" &"  &! &!  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  %~ %~  %} %}  %| %|  %{ %{  %z %z  %y %y  %x %x  %w %w  %v %v  %u %u  %t %t  %s %s  %r %r  %q %q  %p %p  %o %o  %n %n  %m %m  %l %l  %k %k  %j %j  %i %i  %h %h  %g %g  %f %f  %e %e  %d %d  %c %c  %b %b  %a %a  %` %`  %_ %_  %^ %^  %] %]  %\ %\  %[ %[  %Z %Z  %Y %Y  %X %X  %W %W  %V %V  %U %U  %T %T  %S %S  %R %R  %Q %Q  %P %P  %O %O  %N %N  %M %M  %L %L  %K %K  %J %J  %I %I  %H %H  %G %G  %F %F  %E %E  %D %D  %C %C  %B %B  %A %A  %@ %@  %? %?  %> %>  %= %=  %< %<  %; %;  %: %:  %9 %9  %8 %8  %7 %7  %6 %6  %5 %5  %4 %4  %3 %3  %2 %2  %1 %1  %0 %0  %/ %/  %. %.  %- %-  %, %,  %+ %+  %* %*  %) %)  %( %(  %' %'  %& %&  %% %%  %$ %$  %# %#  %" %"  %! %!  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $  $ $ :~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    | r h ^ T J @ 6 , "    x n d Z P F < 2 (   ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\RH>4*    & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  &~ &~  &} &}  &| &|  &{ &{  &z &z  &y &y  &x &x  &w &w  &v &v  &u &u  &t &t  &s &s  &r &r  &q &q  &p &p  &o &o  &n &n  &m &m  &l &l  &k &k  &j &j  &i &i  &h &h  &g &g  &f &f  &e &e  &d &d  &c &c  &b &b  &a &a  &` &`  &_ &_  &^ &^  &] &]  &\ &\  &[ &[  &Z &Z  &Y &Y  &X &X  &W &W  &V &V  &U &U  &T &T  &S &S  &R &R  &Q &Q  &P &P  &O &O  &N &N  &M &M  &L &L  &K &K  &J &J  &I &I  &H &H  &G &G  &F &F  &E &E  &D &D  &C &C  &B &B  &A &A  &@ &@  &? &?  &> &>  &= &=  &< &<  &; &;  &: &:  &9 &9  &8 &8  &7 &7  &6 &6  &5 &5  &4 &4  &3 &3  &2 &2  &1 &1  &0 &0  &/ &/  &. &.  &- &-  &, &,  &+ &+  &* &*  &) &)  &( &(  &' &'  && &&  &% &%  &$ &$  &# &#  &" &"  &! &!  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  & &  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % %  % % . .pnfU dodate=2023-05-25 time=15:02:51 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=800978887 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51110 direction=outbound dstip=142.250.176.194 remotename=securepubads.g.doubleclick.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://securepubads.g.doubleclick.net/Ze- dodate=2023-05-25 time=15:02:51 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3047446498 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51106 direction=outbound dstip=8.43.72.41 remotename=fastlane.rubiconproject.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://fastlane.rubiconproject.com/ OM<jGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=5840 vulnname="FortiClient CVE-2024-3661 Access Control Bypass Vulnerability" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/5840 detectedpath="C:\\Program Files\\Fortinet\\FortiClient\\FortiClient.exe"5;ajGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=5702 vulnname="OpenSSL CVE-2023-5678 Denial of Service Vulnerability" vulnseverity=Medium vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/5702 detectedpath="C:\\Program Files\\Fortinet\\FortiClient\\x86\\libssl-3.dll;C:\\Program Files\\Fortinet\\FortiClient\\x86\\libcrypto-3.dll;C:\\Program Files\\Fortinet\\FortiClient\\libssl-3-x64.dll;C:\\Program Files\\Fortinet\\FortiClient\\libcrypto-3-x64.dll" | |:8Di dodate=2023-05-25 time=15:01:35 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3090212418 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50955 direction=outbound dstip=70.109.162.90 remotename=owa.concordnh.gov dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://owa.concordnh.gov/BC} dodate=2023-05-25 time=15:01:27 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=25710908 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50964 direction=outbound dstip=151.101.66.133 remotename=jssdks.mparticle.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://jssdks.mparticle.com/ v v42r] dodate=2023-05-25 time=14:58:20 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=698510221 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50703 direction=outbound dstip=52.85.151.129 remotename=live.primis.tech dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://live.primis.tech/Nq dodate=2023-05-25 time=14:58:20 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=880911742 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50688 direction=outbound dstip=18.165.97.179 remotename=aax.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://aax.amazon-adsystem.com/  pnzU dodate=2023-05-25 time=14:58:54 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=4127152925 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50734 direction=outbound dstip=142.251.35.162 remotename=securepubads.g.doubleclick.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://securepubads.g.doubleclick.net/lyQ dodate=2023-05-25 time=14:58:52 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3718441581 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50741 direction=outbound dstip=150.136.25.38 remotename=insticator.technoratimedia.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://insticator.technoratimedia.com/ " "hfVE dodate=2023-05-25 time=15:02:05 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=4172150984 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51022 direction=outbound dstip=104.22.34.73 remotename=chunks-prd.stocktwits-cdn.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://chunks-prd.stocktwits-cdn.com/nUU dodate=2023-05-25 time=15:02:03 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2493298618 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51011 direction=outbound dstip=193.122.130.38 remotename=insticator.technoratimedia.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://insticator.technoratimedia.com/   @ fơ?date=2024-08-21 time=22:23:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=359 ephbemslast="2024-08-21 22:23:44" emshostname=ENDPOINT.onconcord.org ? fơdate=2024-08-21 time=22:22:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=358 ephbemslast="2024-08-21 22:22:44" emshostname=ENDPOINT.onconcord.org > fƠdate=2024-08-21 time=22:21:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=357 ephbemslast="2024-08-21 22:21:44" emshostname=ENDPOINT.onconcord.org P P:8Ji doWdate=2023-05-25 time=15:04:54 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3090212418 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51326 direction=outbound dstip=70.109.162.90 remotename=owa.concordnh.gov dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://owa.concordnh.gov/nIU doUdate=2023-05-25 time=15:04:52 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=4127152925 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51328 direction=outbound dstip=142.251.35.162 remotename=securepubads.g.doubleclick.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://securepubads.g.doubleclick.net/  DB>} dodate=2023-05-25 time=15:01:24 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=25710908 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50963 direction=outbound dstip=151.101.66.133 remotename=jssdks.mparticle.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://jssdks.mparticle.com/"== dowdate=2023-05-25 time=15:01:10 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2241557395 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50930 direction=outbound dstip=63.251.86.50 remotename=ap.lijit.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ap.lijit.com/  $"v= dodate=2023-05-25 time=14:58:26 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2220431780 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50715 direction=outbound dstip=63.251.86.51 remotename=ap.lijit.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ap.lijit.com/Nu dodate=2023-05-25 time=14:58:22 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=880911742 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50684 direction=outbound dstip=18.165.97.179 remotename=aax.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://aax.amazon-adsystem.com/ > ;>zxwi e$date=2024-02-29 time=19:42:45 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253765 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0Cv}e$date=2024-02-29 time=19:42:45 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\RMS\ComInt.EXE virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxui e$date=2024-02-29 time=19:42:44 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253764 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 | |*(I dodate=2023-05-25 time=14:59:38 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2225836821 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50807 direction=outbound dstip=104.18.21.206 remotename=a.pub.network dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://a.pub.network/R dodate=2023-05-25 time=14:59:37 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=300766235 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50802 direction=outbound dstip=142.250.80.78 remotename=www.google-analytics.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://www.google-analytics.com/   {fodate=2024-08-31 time=15:31:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=144 ephbemslast="2024-08-31 15:30:42" emshostname=ENDPOINT.onconcord.org zfo`date=2024-08-31 time=15:30:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=143 ephbemslast="2024-08-31 15:29:42" emshostname=ENDPOINT.onconcord.org yfo$date=2024-08-31 time=15:29:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=142 ephbemslast="2024-08-31 15:28:42" emshostname=ENDPOINT.onconcord.org > ;>zxqi e$date=2024-02-29 time=19:42:41 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253761 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0Cp}e$date=2024-02-29 time=19:42:40 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\RMS\Checks.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxoi e$date=2024-02-29 time=19:42:38 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253758 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 ' 'IGhe$xdate=2024-02-29 time=19:42:31 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\RMS\AddIndex.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystem g e$wdate=2024-02-29 time=19:42:30 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=24 ephbemslast="2024-02-29 19:41:41" emshostname=ENDPOINT.onconcord.org xfi e$wdate=2024-02-29 time=19:42:29 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253749 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 | |86ke f 3date=2024-04-09 time=07:02:11 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=1565107228 srcname=OneDrive.exe srcproduct="Microsoft OneDrive" srcip=166.239.12.171 srcport=53170 direction=outbound dstip=23.219.201.22 remotename=oneclient.sfx.ms dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://oneclient.sfx.ms/Dj f 3date=2024-04-09 time=07:02:10 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=2671167465 srcname=OneDrive.exe srcproduct="Microsoft OneDrive" srcip=166.239.12.171 srcport=53168 direction=outbound dstip=20.190.161.152 remotename=graph.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://graph.microsoft.com/ 4 14zx>i e$Idate=2024-02-29 time=19:41:44 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253704 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0M=e$Hdate=2024-02-29 time=19:41:44 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\MPS\CADExchange.Exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx<i e$Hdate=2024-02-29 time=19:41:43 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253703 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 j j\Z- dodate=2023-05-25 time=14:59:33 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3690053795 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50799 direction=outbound dstip=34.120.195.249 remotename=o1011479.ingest.sentry.io dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://o1011479.ingest.sentry.io/2 ] dodate=2023-05-25 time=14:59:32 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=5912656 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50795 direction=outbound dstip=35.172.126.33 remotename=ql.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ql.stocktwits.com/ . .^\1 do4date=2023-05-25 time=15:00:04 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3566206084 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50853 direction=outbound dstip=8.43.72.115 remotename=fastlane.rubiconproject.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://fastlane.rubiconproject.com/lQ do4date=2023-05-25 time=15:00:03 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3718441581 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50854 direction=outbound dstip=150.136.25.38 remotename=insticator.technoratimedia.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://insticator.technoratimedia.com/ 8 8rp2Y do]date=2023-05-25 time=15:00:44 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1344912670 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50905 direction=outbound dstip=209.54.181.15 remotename=aax-us-east.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://aax-us-east.amazon-adsystem.com/N1 doTdate=2023-05-25 time=15:00:35 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3857185398 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50902 direction=outbound dstip=18.160.1.134 remotename=aax.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://aax.amazon-adsystem.com/ v vHF( do?date=2023-05-25 time=15:00:15 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2694636574 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50871 direction=outbound dstip=13.249.42.27 remotename=c.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://c.amazon-adsystem.com/:'m do?date=2023-05-25 time=15:00:14 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3735089924 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50874 direction=outbound dstip=104.22.10.38 remotename=api.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://api.stocktwits.com/   C fơdate=2024-08-21 time=22:26:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=362 ephbemslast="2024-08-21 22:26:44" emshostname=ENDPOINT.onconcord.org B fơdate=2024-08-21 time=22:25:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=361 ephbemslast="2024-08-21 22:25:44" emshostname=ENDPOINT.onconcord.org A fơ{date=2024-08-21 time=22:24:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=360 ephbemslast="2024-08-21 22:24:44" emshostname=ENDPOINT.onconcord.org  i" e9 f date=2024-04-09 time=07:01:45 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=903137952 srcname=SpeechRuntime.exe srcproduct="Microsoft Windows Operating System" srcip=166.239.12.171 srcport=53153 direction=outbound dstip=20.211.142.183 remotename=settings-win.data.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://settings-win.data.microsoft.com/d f date=2024-04-09 time=07:01:41 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=1828393104 srcname=backgroundTaskHost.exe srcproduct="Microsoft Windows Operating System" srcip=166.239.12.171 srcport=53152 direction=outbound dstip=40.126.24.148 remotename=login.microsoftonline.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://login.microsoftonline.com/ h h$"8= dojdate=2023-05-25 time=15:00:57 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2241557395 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50932 direction=outbound dstip=63.251.86.50 remotename=ap.lijit.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ap.lijit.com/l7Q dofdate=2023-05-25 time=15:00:54 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3718441581 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50899 direction=outbound dstip=150.136.25.38 remotename=insticator.technoratimedia.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://insticator.technoratimedia.com/ T TNLJ dodate=2023-05-25 time=15:01:46 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1789805786 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50984 direction=outbound dstip=18.67.64.51 remotename=aax.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://aax.amazon-adsystem.com/VI% dodate=2023-05-25 time=15:01:45 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3735089924 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50982 direction=outbound dstip=104.22.10.38 remotename=api-gw-prd.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://api-gw-prd.stocktwits.com/ < 9<zxJi e$Wdate=2024-02-29 time=19:41:58 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253718 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0EIe$Vdate=2024-02-29 time=19:41:57 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\MPS\Console.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxHi e$Tdate=2024-02-29 time=19:41:55 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253715 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 v v\ZZ- dodate=2023-05-25 time=15:02:26 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3690053795 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51048 direction=outbound dstip=34.120.195.249 remotename=o1011479.ingest.sentry.io dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://o1011479.ingest.sentry.io/&YE dodate=2023-05-25 time=15:02:12 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=772589734 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51026 direction=outbound dstip=104.22.4.61 remotename=ex.ingage.tech dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ex.ingage.tech/ j jVTl! dodate=2023-05-25 time=14:58:09 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3736193907 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50696 direction=outbound dstip=44.205.27.255 remotename=websocket.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://websocket.stocktwits.com/8ki dodate=2023-05-25 time=14:58:07 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3090212418 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50690 direction=outbound dstip=70.109.162.90 remotename=owa.concordnh.gov dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://owa.concordnh.gov/ p pPNj dodate=2023-05-25 time=14:58:06 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=880911742 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50687 direction=outbound dstip=18.165.97.179 remotename=aax.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://aax.amazon-adsystem.com/8ii dodate=2023-05-25 time=14:58:06 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3090212418 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50689 direction=outbound dstip=70.109.162.90 remotename=owa.concordnh.gov dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://owa.concordnh.gov/   + fƜSdate=2024-08-21 time=22:02:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=338 ephbemslast="2024-08-21 22:02:45" emshostname=ENDPOINT.onconcord.org * fƜdate=2024-08-21 time=22:01:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=337 ephbemslast="2024-08-21 22:01:45" emshostname=ENDPOINT.onconcord.org ) fƛdate=2024-08-21 time=22:00:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=336 ephbemslast="2024-08-21 22:00:45" emshostname=ENDPOINT.onconcord.org  42d] dodate=2023-05-25 time=14:58:01 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1940094486 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50680 direction=outbound dstip=34.149.20.76 remotename=ssc.33across.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ssc.33across.com/"c= dodate=2023-05-25 time=14:58:00 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2220431780 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50676 direction=outbound dstip=63.251.86.51 remotename=ap.lijit.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ap.lijit.com/ v v420] doSdate=2023-05-25 time=15:00:34 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1940094486 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50898 direction=outbound dstip=34.149.20.76 remotename=ssc.33across.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ssc.33across.com/N/ doSdate=2023-05-25 time=15:00:34 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3857185398 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50897 direction=outbound dstip=18.160.1.134 remotename=aax.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://aax.amazon-adsystem.com/  *(,I doIdate=2023-05-25 time=15:00:25 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3746409904 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50889 direction=outbound dstip=108.138.85.55 remotename=cmp.osano.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://cmp.osano.com/@+y doIdate=2023-05-25 time=15:00:24 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1658479199 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50883 direction=outbound dstip=35.190.80.1 remotename=a.nel.cloudflare.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://a.nel.cloudflare.com/  (&*E doDdate=2023-05-25 time=15:00:19 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=772589734 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50879 direction=outbound dstip=104.22.4.61 remotename=ex.ingage.tech dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ex.ingage.tech/")= doBdate=2023-05-25 time=15:00:16 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=4225821440 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50876 direction=outbound dstip=3.217.97.145 remotename=1x1.a-mo.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://1x1.a-mo.net/   F fƢdate=2024-08-21 time=22:29:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=365 ephbemslast="2024-08-21 22:29:44" emshostname=ENDPOINT.onconcord.org E fƢkdate=2024-08-21 time=22:28:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=364 ephbemslast="2024-08-21 22:28:44" emshostname=ENDPOINT.onconcord.org D fƢ/date=2024-08-21 time=22:27:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=363 ephbemslast="2024-08-21 22:27:44" emshostname=ENDPOINT.onconcord.org  :8bi dodate=2023-05-25 time=15:02:46 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3597974930 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51042 direction=outbound dstip=34.238.22.151 remotename=ql.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ql.stocktwits.com/0aY dodate=2023-05-25 time=15:02:46 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3545992476 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51086 direction=outbound dstip=147.28.129.37 remotename=prebid.a-mo.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://prebid.a-mo.net/ > ;>zxi e$date=2024-02-29 time=19:43:20 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253800 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0C}e$date=2024-02-29 time=19:43:19 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\RMS\IMCMap.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx i e$date=2024-02-29 time=19:43:07 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253787 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 : 7:zxi e$date=2024-02-29 time=19:43:26 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253806 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0Ge$date=2024-02-29 time=19:43:25 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\RMS\NMSMAINT.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxi e$date=2024-02-29 time=19:43:23 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253803 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0  FDi f 3date=2024-04-09 time=07:02:10 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=2671167465 srcname=OneDrive.exe srcproduct="Microsoft OneDrive" srcip=166.239.12.171 srcport=53169 direction=outbound dstip=20.190.161.152 remotename=graph.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://graph.microsoft.com/h1 f 3date=2024-04-09 time=07:02:10 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=3369899258 srcname=OneDrive.exe srcproduct="Microsoft OneDrive" srcip=166.239.12.171 srcport=53166 direction=outbound dstip=20.22.207.36 remotename=g.live.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://g.live.com/  :8di dodate=2023-05-25 time=15:02:50 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3597974930 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51094 direction=outbound dstip=34.238.22.151 remotename=ql.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ql.stocktwits.com/2c] dodate=2023-05-25 time=15:02:47 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1659225 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51096 direction=outbound dstip=18.165.98.128 remotename=video.primis.tech dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://video.primis.tech/   U fƦ+date=2024-08-21 time=22:44:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=380 ephbemslast="2024-08-21 22:44:45" emshostname=ENDPOINT.onconcord.org T fƥdate=2024-08-21 time=22:43:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=379 ephbemslast="2024-08-21 22:43:44" emshostname=ENDPOINT.onconcord.org S fƥdate=2024-08-21 time=22:42:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=378 ephbemslast="2024-08-21 22:42:44" emshostname=ENDPOINT.onconcord.org : 7:zx$i e$date=2024-02-29 time=19:43:45 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253825 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0G#e$date=2024-02-29 time=19:43:44 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\RMS\RMsignon.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx"i e$date=2024-02-29 time=19:43:44 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253824 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 < 9<zxi e$date=2024-02-29 time=19:42:57 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253777 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0Ee$date=2024-02-29 time=19:42:56 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\RMS\IBRView.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxi e$date=2024-02-29 time=19:42:55 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253775 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0  $"T= dodate=2023-05-25 time=15:02:03 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2241557395 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51004 direction=outbound dstip=63.251.86.50 remotename=ap.lijit.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ap.lijit.com/2S] dodate=2023-05-25 time=15:02:03 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2686954048 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51017 direction=outbound dstip=99.84.108.29 remotename=live.primis.tech dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://live.primis.tech/   a fƨdate=2024-08-21 time=22:56:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=392 ephbemslast="2024-08-21 22:56:45" emshostname=ENDPOINT.onconcord.org ` fƨdate=2024-08-21 time=22:55:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=391 ephbemslast="2024-08-21 22:55:45" emshostname=ENDPOINT.onconcord.org _ fƨdate=2024-08-21 time=22:54:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=390 ephbemslast="2024-08-21 22:54:45" emshostname=ENDPOINT.onconcord.org   7 fƟ#date=2024-08-21 time=22:14:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=350 ephbemslast="2024-08-21 22:14:44" emshostname=ENDPOINT.onconcord.org 6 fƞdate=2024-08-21 time=22:13:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=349 ephbemslast="2024-08-21 22:13:45" emshostname=ENDPOINT.onconcord.org 5 fƞdate=2024-08-21 time=22:12:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=348 ephbemslast="2024-08-21 22:12:45" emshostname=ENDPOINT.onconcord.org  $"&= do?date=2023-05-25 time=15:00:14 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=4225821440 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50797 direction=outbound dstip=3.217.97.145 remotename=1x1.a-mo.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://1x1.a-mo.net/2%] doq@$y_}?7]&me/3 \cxzZ%=NAY6B01j5~{so a "R2FutH)JVU9I!.LW[4<8  subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=4127152925 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50669 direction=outbound dstip=142.251.35.162 remotename=securepubads.g.doubleclick.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://securepubads.g.doubleclick.net/N_ dodate=2023-05-25 time=14:57:53 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1815953851 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50662 direction=outbound dstip=104.36.115.111 remotename=hbopenbid.pubmatic.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://hbopenbid.pubmatic.com/ l l x5 dodate=2023-05-25 time=14:58:51 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=370159026 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50737 direction=outbound dstip=199.127.204.163 remotename=tag.1rx.io dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://tag.1rx.io/lwQ dodate=2023-05-25 time=14:58:51 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3718441581 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50735 direction=outbound dstip=150.136.25.38 remotename=insticator.technoratimedia.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://insticator.technoratimedia.com/ D DJHm f 5date=2024-04-09 time=07:02:12 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=160859381 srcname=SearchApp.exe srcproduct="Microsoft Windows Operating System" srcip=166.239.12.171 srcport=53178 direction=outbound dstip=23.194.131.171 remotename=th.bing.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://th.bing.com/jlM f 5date=2024-04-09 time=07:02:12 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=473860723 srcname=SearchApp.exe srcproduct="Microsoft Windows Operating System" srcip=166.239.12.171 srcport=53173 direction=outbound dstip=40.97.188.226 remotename=substrate.office.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://substrate.office.com/ x x^\"1 do9date=2023-05-25 time=15:00:08 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3566206084 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50848 direction=outbound dstip=8.43.72.115 remotename=fastlane.rubiconproject.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://fastlane.rubiconproject.com/"!= do9date=2023-05-25 time=15:00:08 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2241557395 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50862 direction=outbound dstip=63.251.86.50 remotename=ap.lijit.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ap.lijit.com/   ( fƛdate=2024-08-21 time=21:59:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=335 ephbemslast="2024-08-21 21:59:44" emshostname=ENDPOINT.onconcord.org ' fƛcdate=2024-08-21 time=21:58:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=334 ephbemslast="2024-08-21 21:58:44" emshostname=ENDPOINT.onconcord.org & fƛ'date=2024-08-21 time=21:57:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=333 ephbemslast="2024-08-21 21:57:44" emshostname=ENDPOINT.onconcord.org   : fƟdate=2024-08-21 time=22:17:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=353 ephbemslast="2024-08-21 22:17:44" emshostname=ENDPOINT.onconcord.org 9 fƟdate=2024-08-21 time=22:16:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=352 ephbemslast="2024-08-21 22:16:44" emshostname=ENDPOINT.onconcord.org 8 fƟ_date=2024-08-21 time=22:15:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=351 ephbemslast="2024-08-21 22:15:44" emshostname=ENDPOINT.onconcord.org   . fƝdate=2024-08-21 time=22:05:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=341 ephbemslast="2024-08-21 22:05:45" emshostname=ENDPOINT.onconcord.org - fƜdate=2024-08-21 time=22:04:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=340 ephbemslast="2024-08-21 22:04:45" emshostname=ENDPOINT.onconcord.org , fƜdate=2024-08-21 time=22:03:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=339 ephbemslast="2024-08-21 22:03:45" emshostname=ENDPOINT.onconcord.org V V42] do6date=2023-05-25 time=15:00:06 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2621358776 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50849 direction=outbound dstip=147.75.198.144 remotename=prebid.a-mo.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://prebid.a-mo.net/nU do6date=2023-05-25 time=15:00:05 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=4127152925 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50857 direction=outbound dstip=142.251.35.162 remotename=securepubads.g.doubleclick.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://securepubads.g.doubleclick.net/   I fƣ[date=2024-08-21 time=22:32:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=368 ephbemslast="2024-08-21 22:32:44" emshostname=ENDPOINT.onconcord.org H fƣdate=2024-08-21 time=22:31:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=367 ephbemslast="2024-08-21 22:31:44" emshostname=ENDPOINT.onconcord.org G fƢdate=2024-08-21 time=22:30:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=366 ephbemslast="2024-08-21 22:30:44" emshostname=ENDPOINT.onconcord.org  $"= dodate=2023-05-25 time=14:59:13 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2220431780 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50774 direction=outbound dstip=63.251.86.51 remotename=ap.lijit.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ap.lijit.com/4a dodate=2023-05-25 time=14:59:12 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=49128683 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50771 direction=outbound dstip=78.138.31.110 remotename=video.primis.tech dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://video.primis.tech/ 8 58zxVi e$fdate=2024-02-29 time=19:42:13 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253733 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0IU e$edate=2024-02-29 time=19:42:12 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\MPS\MDBSignon.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxTi e$cdate=2024-02-29 time=19:42:10 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253730 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 r rDB@} dodate=2023-05-25 time=15:01:25 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=25710908 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50965 direction=outbound dstip=151.101.66.133 remotename=jssdks.mparticle.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://jssdks.mparticle.com/B?} dodate=2023-05-25 time=15:01:25 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=25710908 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50962 direction=outbound dstip=151.101.66.133 remotename=jssdks.mparticle.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://jssdks.mparticle.com/ L L^\1 dodate=2023-05-25 time=14:59:06 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3566206084 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50755 direction=outbound dstip=8.43.72.115 remotename=fastlane.rubiconproject.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://fastlane.rubiconproject.com/N dodate=2023-05-25 time=14:59:03 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=880911742 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50759 direction=outbound dstip=18.165.97.179 remotename=aax.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://aax.amazon-adsystem.com/  42 ] dodate=2023-05-25 time=14:59:32 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=5912656 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50796 direction=outbound dstip=35.172.126.33 remotename=ql.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ql.stocktwits.com/8 i dodate=2023-05-25 time=14:59:31 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3090212418 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50746 direction=outbound dstip=70.109.162.90 remotename=owa.concordnh.gov dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://owa.concordnh.gov/ T T20gY f 3date=2024-04-09 time=07:02:10 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=3480272684 srcname=OneDrive.exe srcproduct="Microsoft OneDrive" srcip=166.239.12.171 srcport=53167 direction=outbound dstip=52.113.194.132 remotename=ecs.office.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ecs.office.com/rf] f !date=2024-04-09 time=07:01:52 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=3690573128 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=53157 direction=outbound dstip=13.107.213.40 remotename=edge-consumer-static.azureedge.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://edge-consumer-static.azureedge.net/ v v424] do_date=2023-05-25 time=15:00:46 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1940094486 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50916 direction=outbound dstip=34.149.20.76 remotename=ssc.33across.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ssc.33across.com/N3 do^date=2023-05-25 time=15:00:45 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1815953851 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50914 direction=outbound dstip=104.36.115.111 remotename=hbopenbid.pubmatic.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://hbopenbid.pubmatic.com/   |5 dodate=2023-05-25 time=14:58:57 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=370159026 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50744 direction=outbound dstip=199.127.204.163 remotename=tag.1rx.io dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://tag.1rx.io/"{= dodate=2023-05-25 time=14:58:56 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2220431780 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50739 direction=outbound dstip=63.251.86.51 remotename=ap.lijit.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ap.lijit.com/   4 fƞodate=2024-08-21 time=22:11:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=347 ephbemslast="2024-08-21 22:11:45" emshostname=ENDPOINT.onconcord.org 3 fƞ3date=2024-08-21 time=22:10:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=346 ephbemslast="2024-08-21 22:10:45" emshostname=ENDPOINT.onconcord.org 2 fƝdate=2024-08-21 time=22:09:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=345 ephbemslast="2024-08-21 22:09:45" emshostname=ENDPOINT.onconcord.org   1 fƝdate=2024-08-21 time=22:08:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=344 ephbemslast="2024-08-21 22:08:45" emshostname=ENDPOINT.onconcord.org 0 fƝdate=2024-08-21 time=22:07:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=343 ephbemslast="2024-08-21 22:07:45" emshostname=ENDPOINT.onconcord.org / fƝCdate=2024-08-21 time=22:06:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=342 ephbemslast="2024-08-21 22:06:45" emshostname=ENDPOINT.onconcord.org   L fƤdate=2024-08-21 time=22:35:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=371 ephbemslast="2024-08-21 22:35:44" emshostname=ENDPOINT.onconcord.org K fƣdate=2024-08-21 time=22:34:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=370 ephbemslast="2024-08-21 22:34:44" emshostname=ENDPOINT.onconcord.org J fƣdate=2024-08-21 time=22:33:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=369 ephbemslast="2024-08-21 22:33:44" emshostname=ENDPOINT.onconcord.org  $"p= dodate=2023-05-25 time=14:58:19 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=4225821440 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50709 direction=outbound dstip=3.217.97.145 remotename=1x1.a-mo.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://1x1.a-mo.net/2o] dodate=2023-05-25 time=14:58:19 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=698510221 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50705 direction=outbound dstip=52.85.151.129 remotename=live.primis.tech dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://live.primis.tech/ : 7:zx}i e$date=2024-02-29 time=19:42:52 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253772 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0G|e$date=2024-02-29 time=19:42:51 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\RMS\DiaGettr.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx{i e$date=2024-02-29 time=19:42:48 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253768 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 8 58zxDi e$Pdate=2024-02-29 time=19:41:51 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253711 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0IC e$Odate=2024-02-29 time=19:41:50 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\MPS\CfgSignon.Exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxBi e$Ndate=2024-02-29 time=19:41:49 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253709 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0   R fƥwdate=2024-08-21 time=22:41:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=377 ephbemslast="2024-08-21 22:41:44" emshostname=ENDPOINT.onconcord.org Q fƥ;date=2024-08-21 time=22:40:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=376 ephbemslast="2024-08-21 22:40:44" emshostname=ENDPOINT.onconcord.org P fƤdate=2024-08-21 time=22:39:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=375 ephbemslast="2024-08-21 22:39:44" emshostname=ENDPOINT.onconcord.org  &$hA dodate=2023-05-25 time=15:02:54 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3685254195 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51113 direction=outbound dstip=151.101.209.194 remotename=confiant-integrations.global.ssl.fastly.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://confiant-integrations.global.ssl.fastly.net/4ga dodate=2023-05-25 time=15:02:53 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=408097254 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51108 direction=outbound dstip=23.219.200.189 remotename=ads.pubmatic.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ads.pubmatic.com/ b bHFX dodate=2023-05-25 time=15:02:07 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=4041066625 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51009 direction=outbound dstip=18.67.67.228 remotename=c.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://c.amazon-adsystem.com/NW dodate=2023-05-25 time=15:02:07 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1815953851 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51024 direction=outbound dstip=104.36.115.111 remotename=hbopenbid.pubmatic.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://hbopenbid.pubmatic.com/  (&.E doMdate=2023-05-25 time=15:00:29 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1769155588 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50887 direction=outbound dstip=34.160.110.8 remotename=d.pub.network dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://d.pub.network/H- doMdate=2023-05-25 time=15:00:28 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2753850941 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50886 direction=outbound dstip=52.46.151.131 remotename=s.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://s.amazon-adsystem.com/ ~ ~,*NM dodate=2023-05-25 time=15:01:59 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3735089924 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51000 direction=outbound dstip=104.22.10.38 remotename=stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://stocktwits.com/NM dodate=2023-05-25 time=15:01:58 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1815953851 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51007 direction=outbound dstip=104.36.115.111 remotename=hbopenbid.pubmatic.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://hbopenbid.pubmatic.com/ L L^\1 do date=2023-05-25 time=14:59:20 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3566206084 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50751 direction=outbound dstip=8.43.72.115 remotename=fastlane.rubiconproject.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://fastlane.rubiconproject.com/N dodate=2023-05-25 time=14:59:14 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1815953851 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50772 direction=outbound dstip=104.36.115.111 remotename=hbopenbid.pubmatic.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://hbopenbid.pubmatic.com/  xvKe e% date=2024-02-29 time=19:44:56 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253895 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/Agent.8930!tr userinitiated=0 browsetime=07Jee%date=2024-02-29 time=19:44:54 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file="C:\\M2 Driver Pack V2\\USB Hub (Dock)\\TI_xHCI_Filter_Driver_1_0_0_5_B_Default.exe" virus=W32/Agent.8930!tr sigid=716352 vid=8143664 detectedby="AntiVirus scan" detectedin=filesystemvIe e$date=2024-02-29 time=19:44:46 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253886 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/Bicololo.A!tr userinitiated=0 browsetime=0 F F\Z- dodate=2023-05-25 time=14:59:35 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3690053795 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50800 direction=outbound dstip=34.120.195.249 remotename=o1011479.ingest.sentry.io dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://o1011479.ingest.sentry.io/V% dodate=2023-05-25 time=14:59:33 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3735089924 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50782 direction=outbound dstip=104.22.10.38 remotename=api-gw-prd.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://api-gw-prd.stocktwits.com/ b b:8ji dodate=2023-05-25 time=15:02:55 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3090212418 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51066 direction=outbound dstip=70.109.162.90 remotename=owa.concordnh.gov dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://owa.concordnh.gov/\i1 dodate=2023-05-25 time=15:02:55 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3566206084 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50986 direction=outbound dstip=8.43.72.115 remotename=fastlane.rubiconproject.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://fastlane.rubiconproject.com/ Z ZPN do*date=2023-05-25 time=14:59:53 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1815953851 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50835 direction=outbound dstip=104.36.115.111 remotename=hbopenbid.pubmatic.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://hbopenbid.pubmatic.com/N do*date=2023-05-25 time=14:59:53 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1815953851 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50833 direction=outbound dstip=104.36.115.111 remotename=hbopenbid.pubmatic.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://hbopenbid.pubmatic.com/ d d:8`i dodate=2023-05-25 time=15:02:46 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3090212418 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51068 direction=outbound dstip=70.109.162.90 remotename=owa.concordnh.gov dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://owa.concordnh.gov/Z_- dodate=2023-05-25 time=15:02:40 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3690053795 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51078 direction=outbound dstip=34.120.195.249 remotename=o1011479.ingest.sentry.io dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://o1011479.ingest.sentry.io/ b b^\~1 dodate=2023-05-25 time=14:59:02 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3566206084 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50753 direction=outbound dstip=8.43.72.115 remotename=fastlane.rubiconproject.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://fastlane.rubiconproject.com/8}i dodate=2023-05-25 time=14:59:00 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3090212418 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50747 direction=outbound dstip=70.109.162.90 remotename=owa.concordnh.gov dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://owa.concordnh.gov/ p p42] dodate=2023-05-25 time=14:59:12 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2621358776 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50769 direction=outbound dstip=147.75.198.144 remotename=prebid.a-mo.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://prebid.a-mo.net/T! dodate=2023-05-25 time=14:59:11 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3736193907 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50765 direction=outbound dstip=44.205.27.255 remotename=websocket.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://websocket.stocktwits.com/ f fpn U do7date=2023-05-25 time=15:00:07 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=4127152925 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50855 direction=outbound dstip=142.251.35.162 remotename=securepubads.g.doubleclick.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://securepubads.g.doubleclick.net/"= do7date=2023-05-25 time=15:00:06 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2241557395 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50861 direction=outbound dstip=63.251.86.50 remotename=ap.lijit.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ap.lijit.com/ j j:8<i dowdate=2023-05-25 time=15:01:10 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3090212418 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50864 direction=outbound dstip=70.109.162.90 remotename=owa.concordnh.gov dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://owa.concordnh.gov/T;! doqdate=2023-05-25 time=15:01:04 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1184195646 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50938 direction=outbound dstip=3.211.118.178 remotename=websocket.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://websocket.stocktwits.com/ < 9<zxi e$date=2024-02-29 time=19:43:37 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253817 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0Ee$date=2024-02-29 time=19:43:36 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\RMS\REPORTS.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxi e$date=2024-02-29 time=19:43:34 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253814 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0  42t] dodate=2023-05-25 time=14:58:22 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=698510221 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50708 direction=outbound dstip=52.85.151.129 remotename=live.primis.tech dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://live.primis.tech/2s] dodate=2023-05-25 time=14:58:21 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=698510221 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50704 direction=outbound dstip=52.85.151.129 remotename=live.primis.tech dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://live.primis.tech/ r r86:e domdate=2023-05-25 time=15:01:00 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2355979253 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50935 direction=outbound dstip=99.84.191.11 remotename=video.primis.tech dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://video.primis.tech/N9 dokdate=2023-05-25 time=15:00:58 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1815953851 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50931 direction=outbound dstip=104.36.115.111 remotename=hbopenbid.pubmatic.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://hbopenbid.pubmatic.com/ z zVT\! dodate=2023-05-25 time=15:02:30 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2821423666 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51062 direction=outbound dstip=172.253.122.156 remotename=stats.g.doubleclick.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://stats.g.doubleclick.net/([I dodate=2023-05-25 time=15:02:30 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2225836821 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51060 direction=outbound dstip=104.18.21.206 remotename=a.pub.network dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://a.pub.network/  " $9 do:date=2023-05-25 time=15:00:10 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=949618923 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50867 direction=outbound dstip=104.26.7.139 remotename=btloader.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://btloader.com/8#i do:date=2023-05-25 time=15:00:09 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3090212418 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50865 direction=outbound dstip=70.109.162.90 remotename=owa.concordnh.gov dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://owa.concordnh.gov/  FzxBi e$date=2024-02-29 time=19:44:28 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253868 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=05Aae$date=2024-02-29 time=19:44:27 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\Install\REP.ZIP virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystem5@ae$date=2024-02-29 time=19:44:27 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\Install\QST.ZIP virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystem * *^\61 dofdate=2023-05-25 time=15:00:53 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3566206084 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50909 direction=outbound dstip=8.43.72.115 remotename=fastlane.rubiconproject.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://fastlane.rubiconproject.com/p5Y dobdate=2023-05-25 time=15:00:49 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1344912670 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50921 direction=outbound dstip=209.54.181.15 remotename=aax-us-east.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://aax-us-east.amazon-adsystem.com/ r rDBF} dodate=2023-05-25 time=15:01:37 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=25710908 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50967 direction=outbound dstip=151.101.66.133 remotename=jssdks.mparticle.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://jssdks.mparticle.com/BE} dodate=2023-05-25 time=15:01:37 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=25710908 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50968 direction=outbound dstip=151.101.66.133 remotename=jssdks.mparticle.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://jssdks.mparticle.com/ J JXV % do date=2023-05-25 time=14:59:23 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3735089924 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50783 direction=outbound dstip=104.22.10.38 remotename=api-gw-prd.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://api-gw-prd.stocktwits.com/V % do date=2023-05-25 time=14:59:21 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2633353251 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50780 direction=outbound dstip=54.208.206.168 remotename=websocket.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://websocket.stocktwits.com/ J GJzx6i e$date=2024-02-29 time=19:44:20 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253860 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=055ae$date=2024-02-29 time=19:44:19 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\Install\EMS.ZIP virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemz4m e$date=2024-02-29 time=19:44:18 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253858 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0   % fƚdate=2024-08-21 time=21:56:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=332 ephbemslast="2024-08-21 21:56:44" emshostname=ENDPOINT.onconcord.org $ fƚdate=2024-08-21 time=21:55:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=331 ephbemslast="2024-08-21 21:55:44" emshostname=ENDPOINT.onconcord.org # fƚsdate=2024-08-21 time=21:54:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=330 ephbemslast="2024-08-21 21:54:44" emshostname=ENDPOINT.onconcord.org    fƕdate=2024-08-21 time=21:35:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=311 ephbemslast="2024-08-21 21:35:44" emshostname=ENDPOINT.onconcord.org  fƕdate=2024-08-21 time=21:34:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=310 ephbemslast="2024-08-21 21:34:44" emshostname=ENDPOINT.onconcord.org  fƕdate=2024-08-21 time=21:33:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=309 ephbemslast="2024-08-21 21:33:44" emshostname=ENDPOINT.onconcord.org b b^\n1 dodate=2023-05-25 time=14:58:12 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3566206084 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50675 direction=outbound dstip=8.43.72.115 remotename=fastlane.rubiconproject.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://fastlane.rubiconproject.com/8mi dodate=2023-05-25 time=14:58:11 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3090212418 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50691 direction=outbound dstip=70.109.162.90 remotename=owa.concordnh.gov dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://owa.concordnh.gov/  PN do,date=2023-05-25 time=14:59:55 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3857185398 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50841 direction=outbound dstip=18.160.1.134 remotename=aax.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://aax.amazon-adsystem.com/&E do*date=2023-05-25 time=14:59:54 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1769155588 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50839 direction=outbound dstip=34.160.110.8 remotename=d.pub.network dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://d.pub.network/   l5 dodate=2023-05-25 time=15:02:57 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=1365698408 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51119 direction=outbound dstip=35.244.159.8 remotename=u.openx.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://u.openx.net/Hk dodate=2023-05-25 time=15:02:56 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3871937200 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51104 direction=outbound dstip=52.55.204.172 remotename=btlr.sharethrough.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://btlr.sharethrough.com/ ^ ^,*LM dodate=2023-05-25 time=15:01:56 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3735089924 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51001 direction=outbound dstip=104.22.10.38 remotename=stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://stocktwits.com/nKU dodate=2023-05-25 time=15:01:53 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=4127152925 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50993 direction=outbound dstip=142.251.35.162 remotename=securepubads.g.doubleclick.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://securepubads.g.doubleclick.net/ @ @pnnU dodate=2023-05-25 time=15:02:58 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=800978887 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51112 direction=outbound dstip=142.250.176.194 remotename=securepubads.g.doubleclick.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://securepubads.g.doubleclick.net/Hm dodate=2023-05-25 time=15:02:58 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3871937200 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51103 direction=outbound dstip=52.55.204.172 remotename=btlr.sharethrough.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://btlr.sharethrough.com/ L FILzx0i e$date=2024-02-29 time=19:43:58 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253838 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0x/i e$date=2024-02-29 time=19:43:58 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253838 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=05.ae$date=2024-02-29 time=19:43:57 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\Install\AMS.ZIP virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystem  *(I dodate=2023-05-25 time=14:59:42 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2225836821 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50805 direction=outbound dstip=104.18.21.206 remotename=a.pub.network dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://a.pub.network/(I dodate=2023-05-25 time=14:59:41 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2225836821 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50806 direction=outbound dstip=104.18.21.206 remotename=a.pub.network dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://a.pub.network/ ^ ^pnPU dodate=2023-05-25 time=15:02:00 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2493298618 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51010 direction=outbound dstip=193.122.130.38 remotename=insticator.technoratimedia.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://insticator.technoratimedia.com/*OM dodate=2023-05-25 time=15:02:00 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3735089924 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50996 direction=outbound dstip=104.22.10.38 remotename=stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://stocktwits.com/ 2 /2zx*i e$date=2024-02-29 time=19:43:52 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253832 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0O)e$date=2024-02-29 time=19:43:51 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\RMS\SqlDbCreator.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx(i e$date=2024-02-29 time=19:43:50 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253830 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 L LPN dodate=2023-05-25 time=14:59:03 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=880911742 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50758 direction=outbound dstip=18.165.97.179 remotename=aax.amazon-adsystem.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://aax.amazon-adsystem.com/\1 dodate=2023-05-25 time=14:59:03 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3566206084 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=50754 direction=outbound dstip=8.43.72.115 remotename=fastlane.rubiconproject.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://fastlane.rubiconproject.com/ f fpn^U dodate=2023-05-25 time=15:02:35 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=800978887 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51071 direction=outbound dstip=142.250.176.194 remotename=securepubads.g.doubleclick.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://securepubads.g.doubleclick.net/"]= dodate=2023-05-25 time=15:02:35 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2241557395 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51033 direction=outbound dstip=63.251.86.50 remotename=ap.lijit.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ap.lijit.com/   = fƠdate=2024-08-21 time=22:20:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=356 ephbemslast="2024-08-21 22:20:44" emshostname=ENDPOINT.onconcord.org < fƠOdate=2024-08-21 time=22:19:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=355 ephbemslast="2024-08-21 22:19:44" emshostname=ENDPOINT.onconcord.org ; fƠdate=2024-08-21 time=22:18:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=354 ephbemslast="2024-08-21 22:18:44" emshostname=ENDPOINT.onconcord.org | |&$pA dodate=2023-05-25 time=15:03:00 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=2895140344 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51122 direction=outbound dstip=172.67.70.134 remotename=btloader.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://btloader.com/Vo% dodate=2023-05-25 time=15:02:59 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy="City_Workstations - With AV" os="Microsoft Windows 10 , 64-bit (build 19041)" user=garrahaj@ONCONCORD msg="Traffic log" sessionid=3735089924 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=51116 direction=outbound dstip=104.22.10.38 remotename=api-gw-prd.stocktwits.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://api-gw-prd.stocktwits.com/   fs date=2024-08-31 time=15:46:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=159 ephbemslast="2024-08-31 15:45:42" emshostname=ENDPOINT.onconcord.org frdate=2024-08-31 time=15:45:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=158 ephbemslast="2024-08-31 15:44:43" emshostname=ENDPOINT.onconcord.org frdate=2024-08-31 time=15:44:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=157 ephbemslast="2024-08-31 15:43:43" emshostname=ENDPOINT.onconcord.org  |z5m e$5date=2024-02-29 time=19:41:24 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253684 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=04e$4date=2024-02-29 time=19:41:23 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\CMN\DotNet\ZetronServer\TriTech.Imc.ZetronServer.exe virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemz3m e$.date=2024-02-29 time=19:41:17 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253677 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0 ( (]- f date=2024-04-09 time=07:01:35 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=53103221 srcname=SpeechRuntime.exe srcproduct="Microsoft Windows Operating System" srcip=166.239.12.171 srcport=53143 direction=outbound dstip=20.106.86.13 remotename=settings-win.data.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://settings-win.data.microsoft.com/4\a f date=2024-04-09 time=07:01:33 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=4059381447 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=53140 direction=outbound dstip=204.79.197.239 remotename=edge.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://edge.microsoft.com/  |z/m e$*date=2024-02-29 time=19:41:13 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253673 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0y.ie$)date=2024-02-29 time=19:41:12 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\CMN\DotNet\ShellManager\ShellManager.exe virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemz-m e$ date=2024-02-29 time=19:41:03 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253663 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  <:Um f date=2024-04-09 time=07:01:28 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=3686553512 srcname=Microsoft.Management.Services.IntuneWindowsAgent.exe srcproduct="Microsoft Intune"!" srcip=166.239.12.171 srcport=53126 direction=outbound dstip=20.42.1.0 remotename=fef.msua08.manage.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://fef.msua08.manage.microsoft.com/NT f date=2024-04-09 time=07:01:27 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=1752591394 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=53125 direction=outbound dstip=40.126.24.146 remotename=login.microsoftonline.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://login.microsoftonline.com/ 2 /2zxbi e$rdate=2024-02-29 time=19:42:25 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253745 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0Oae$qdate=2024-02-29 time=19:42:24 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\MPS\SqlDbCreator.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx`i e$odate=2024-02-29 time=19:42:22 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253742 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0   frldate=2024-08-31 time=15:43:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=156 ephbemslast="2024-08-31 15:42:43" emshostname=ENDPOINT.onconcord.org fr0date=2024-08-31 time=15:42:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=155 ephbemslast="2024-08-31 15:41:43" emshostname=ENDPOINT.onconcord.org fqdate=2024-08-31 time=15:41:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=154 ephbemslast="2024-08-31 15:40:43" emshostname=ENDPOINT.onconcord.org  |z)m e$date=2024-02-29 time=19:40:59 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253659 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0(1e$date=2024-02-29 time=19:40:58 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\CMN\DotNet\MobileDeviceInterface\MobileDeviceInterface.exe virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemz'm e$date=2024-02-29 time=19:40:58 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253658 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  Nfdate=2024-04-13 time=10:12:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1138 ephbemslast="2024-04-13 10:11:36" emshostname=ENDPOINT.onconcord.org Mf}date=2024-04-13 time=10:11:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1137 ephbemslast="2024-04-13 10:10:36" emshostname=ENDPOINT.onconcord.org LfAdate=2024-04-13 time=10:10:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1136 ephbemslast="2024-04-13 10:09:36" emshostname=ENDPOINT.onconcord.org  |z#m e$date=2024-02-29 time=19:40:49 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253649 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0#"=e$date=2024-02-29 time=19:40:48 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file="C:\\IMC-OLD\\CMN\\DotNet\\InformIQ Historical\\InformIQ Historical.exe" virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemz!m e$ date=2024-02-29 time=19:40:40 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253640 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0 f fJHo f 5date=2024-04-09 time=07:02:13 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=160859381 srcname=SearchApp.exe srcproduct="Microsoft Windows Operating System" srcip=166.239.12.171 srcport=53177 direction=outbound dstip=23.194.131.171 remotename=th.bing.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://th.bing.com/Hn f 5date=2024-04-09 time=07:02:13 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=160859381 srcname=SearchApp.exe srcproduct="Microsoft Windows Operating System" srcip=166.239.12.171 srcport=53175 direction=outbound dstip=23.194.131.171 remotename=th.bing.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://th.bing.com/ n nFDc f date=2024-04-09 time=07:01:38 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=2671167465 srcname=OneDrive.exe srcproduct="Microsoft OneDrive" srcip=166.239.12.171 srcport=53149 direction=outbound dstip=20.190.161.152 remotename=graph.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://graph.microsoft.com/Db f date=2024-04-09 time=07:01:38 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=2671167465 srcname=OneDrive.exe srcproduct="Microsoft OneDrive" srcip=166.239.12.171 srcport=53150 direction=outbound dstip=20.190.161.152 remotename=graph.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://graph.microsoft.com/  |zm e#date=2024-02-29 time=19:40:14 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253614 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0e#date=2024-02-29 time=19:40:13 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC-OLD\CMN\DotNet\CadExServer\TriTech.Imc.CadEx.Server.exe virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemzm e#date=2024-02-29 time=19:40:09 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253609 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0   fsdate=2024-08-31 time=15:49:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=162 ephbemslast="2024-08-31 15:48:42" emshostname=ENDPOINT.onconcord.org fsdate=2024-08-31 time=15:48:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=161 ephbemslast="2024-08-31 15:47:42" emshostname=ENDPOINT.onconcord.org fs\date=2024-08-31 time=15:47:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=160 ephbemslast="2024-08-31 15:46:42" emshostname=ENDPOINT.onconcord.org D ADzxi e#date=2024-02-29 time=19:40:01 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253601 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0=qe#date=2024-02-29 time=19:40:00 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\Traffic.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxi e#date=2024-02-29 time=19:39:58 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253597 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 6 i60.WU f date=2024-04-09 time=07:01:31 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=3729421897 srcname=OneDrive.exe srcproduct="Microsoft OneDrive" srcip=166.239.12.171 srcport=53129 direction=outbound dstip=52.123.251.45 remotename=ecs.office.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://ecs.office.com/V f date=2024-04-09 time=07:01:29 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=1828393104 srcname=backgroundTaskHost.exe srcproduct="Microsoft Windows Operating System" srcip=166.239.12.171 srcport=53127 direction=outbound dstip=40.126.24.148 remotename=login.microsoftonline.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://login.microsoftonline.com/ 2 /2zxi e#date=2024-02-29 time=19:39:54 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253594 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0O e#date=2024-02-29 time=19:39:54 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\SqlDbCreator.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx i e#date=2024-02-29 time=19:39:53 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253593 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 * i*<:Om f date=2024-04-09 time=07:01:24 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=797187985 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=53120 direction=outbound dstip=13.107.42.16 remotename=config.edge.skype.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://config.edge.skype.com/N f date=2024-04-09 time=07:01:21 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=1828393104 srcname=backgroundTaskHost.exe srcproduct="Microsoft Windows Operating System" srcip=166.239.12.171 srcport=53119 direction=outbound dstip=40.126.24.148 remotename=login.microsoftonline.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://login.microsoftonline.com/ B ?Bzxi e#date=2024-02-29 time=19:39:48 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253588 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0?ue#date=2024-02-29 time=19:39:47 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\Schedule.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxi e#date=2024-02-29 time=19:39:47 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253587 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0  64Qa f date=2024-04-09 time=07:01:26 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=4059381447 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=53122 direction=outbound dstip=204.79.197.239 remotename=edge.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://edge.microsoft.com/4Pa f date=2024-04-09 time=07:01:26 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=4059381447 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=53121 direction=outbound dstip=204.79.197.239 remotename=edge.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://edge.microsoft.com/ : 7:zxi e#date=2024-02-29 time=19:39:41 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253581 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0Ge#date=2024-02-29 time=19:39:40 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\RMsignon.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxi e#date=2024-02-29 time=19:39:40 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253580 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 2 a2,*_M f date=2024-04-09 time=07:01:35 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=785070493 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=53145 direction=outbound dstip=13.107.6.158 remotename=business.bing.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://business.bing.com/^- f date=2024-04-09 time=07:01:35 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=53103221 srcname=SpeechRuntime.exe srcproduct="Microsoft Windows Operating System" srcip=166.239.12.171 srcport=53144 direction=outbound dstip=20.106.86.13 remotename=settings-win.data.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://settings-win.data.microsoft.com/  Y1 f date=2024-04-09 time=07:01:31 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=3369899258 srcname=OneDrive.exe srcproduct="Microsoft OneDrive" srcip=166.239.12.171 srcport=53131 direction=outbound dstip=20.22.207.36 remotename=g.live.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://g.live.com/LX f date=2024-04-09 time=07:01:31 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=3660960172 srcname=OneDrive.exe srcproduct="Microsoft OneDrive" srcip=166.239.12.171 srcport=53130 direction=outbound dstip=52.109.4.7 remotename=odc.officeapps.live.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://odc.officeapps.live.com/ / /A?yue#date=2024-02-29 time=19:39:33 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\RmsEntry.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxxi e#date=2024-02-29 time=19:39:31 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253571 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 w e#date=2024-02-29 time=19:39:30 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=21 ephbemslast="2024-02-29 19:38:41" emshostname=ENDPOINT.onconcord.org P P86[e f date=2024-04-09 time=07:01:32 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=1565107228 srcname=OneDrive.exe srcproduct="Microsoft OneDrive" srcip=166.239.12.171 srcport=53136 direction=outbound dstip=23.219.201.22 remotename=oneclient.sfx.ms dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://oneclient.sfx.ms/pZY f date=2024-04-09 time=07:01:32 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=1913999005 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=53135 direction=outbound dstip=20.72.146.34 remotename=prod.rewardsplatform.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://prod.rewardsplatform.microsoft.com/ < 9<zxsi e#date=2024-02-29 time=19:39:27 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253567 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0Ere#date=2024-02-29 time=19:39:26 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\RecRpts.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxqi e#date=2024-02-29 time=19:39:24 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253564 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 L LljSM f date=2024-04-09 time=07:01:27 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=1769909656 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=53124 direction=outbound dstip=13.107.246.40 remotename=edge-mobile-static.azureedge.net dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://edge-mobile-static.azureedge.net/@Ry f date=2024-04-09 time=07:01:27 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=1350212947 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=53123 direction=outbound dstip=142.250.81.227 remotename=update.googleapis.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://update.googleapis.com/ D ADzxmi e#date=2024-02-29 time=19:39:20 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253560 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0=lqe#date=2024-02-29 time=19:39:19 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\Recover.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxki e#date=2024-02-29 time=19:39:19 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253559 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0  HfQdate=2024-04-13 time=10:06:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1132 ephbemslast="2024-04-13 10:05:36" emshostname=ENDPOINT.onconcord.org Gfdate=2024-04-13 time=10:05:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1131 ephbemslast="2024-04-13 10:04:36" emshostname=ENDPOINT.onconcord.org Ffdate=2024-04-13 time=10:04:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1130 ephbemslast="2024-04-13 10:03:36" emshostname=ENDPOINT.onconcord.org : 7:zxgi e#date=2024-02-29 time=19:39:10 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253550 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0Gfe#date=2024-02-29 time=19:39:10 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\NMSMAINT.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxei e#date=2024-02-29 time=19:39:09 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253549 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0  ?f5date=2024-04-13 time=09:57:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1123 ephbemslast="2024-04-13 09:56:36" emshostname=ENDPOINT.onconcord.org >fdate=2024-04-13 time=09:56:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1122 ephbemslast="2024-04-13 09:55:36" emshostname=ENDPOINT.onconcord.org =fdate=2024-04-13 time=09:55:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1121 ephbemslast="2024-04-13 09:54:36" emshostname=ENDPOINT.onconcord.org F CFzxai e#date=2024-02-29 time=19:39:06 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253546 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0;`me#date=2024-02-29 time=19:39:05 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\Morpho.EXE virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx_i e#date=2024-02-29 time=19:39:03 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253543 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0   fqdate=2024-08-31 time=15:40:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=153 ephbemslast="2024-08-31 15:39:43" emshostname=ENDPOINT.onconcord.org fq|date=2024-08-31 time=15:39:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=152 ephbemslast="2024-08-31 15:38:43" emshostname=ENDPOINT.onconcord.org fq@date=2024-08-31 time=15:38:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=151 ephbemslast="2024-08-31 15:37:42" emshostname=ENDPOINT.onconcord.org  I75<ae$date=2024-02-29 time=19:44:24 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\Install\Mod.ZIP virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystem5;ae$date=2024-02-29 time=19:44:24 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\Install\JMS.ZIP virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx:i e$date=2024-02-29 time=19:44:22 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253862 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0  Kfdate=2024-04-13 time=10:09:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1135 ephbemslast="2024-04-13 10:08:36" emshostname=ENDPOINT.onconcord.org Jfdate=2024-04-13 time=10:08:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1134 ephbemslast="2024-04-13 10:07:36" emshostname=ENDPOINT.onconcord.org Ifdate=2024-04-13 time=10:07:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1133 ephbemslast="2024-04-13 10:06:36" emshostname=ENDPOINT.onconcord.org > ;>zx[i e#date=2024-02-29 time=19:38:58 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253538 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0CZ}e#date=2024-02-29 time=19:38:58 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\IMCMap.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxYi e#date=2024-02-29 time=19:38:57 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253537 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0  Efdate=2024-04-13 time=10:03:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1129 ephbemslast="2024-04-13 10:02:36" emshostname=ENDPOINT.onconcord.org Dfadate=2024-04-13 time=10:02:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1128 ephbemslast="2024-04-13 10:01:36" emshostname=ENDPOINT.onconcord.org Cf%date=2024-04-13 time=10:01:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1127 ephbemslast="2024-04-13 10:00:36" emshostname=ENDPOINT.onconcord.org F CFzxUi e#date=2024-02-29 time=19:38:51 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253530 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0;Tme#date=2024-02-29 time=19:38:50 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\IdxImc.EXE virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxSi e#date=2024-02-29 time=19:38:49 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253529 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0  Qfmdate=2024-04-13 time=10:15:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1141 ephbemslast="2024-04-13 10:14:36" emshostname=ENDPOINT.onconcord.org Pf1date=2024-04-13 time=10:14:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1140 ephbemslast="2024-04-13 10:13:36" emshostname=ENDPOINT.onconcord.org Ofdate=2024-04-13 time=10:13:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1139 ephbemslast="2024-04-13 10:12:36" emshostname=ENDPOINT.onconcord.org < 9<zxOi e#date=2024-02-29 time=19:38:47 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253527 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0ENe#date=2024-02-29 time=19:38:46 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\IDBIint.Exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxMi e#date=2024-02-29 time=19:38:45 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253525 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 N "NQOBjGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=6291 vulnname="FortiClient CVE-2025-47761 Access Control Bypass Vulnerability" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/6291 detectedpath="C:\\Program Files\\Fortinet\\FortiClient\\FortiClient.exe"YA)jGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=6290 vulnname="FortiClient CVE-2025-46373 Heap-based Buffer Overflow Vulnerability" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/6290 detectedpath="C:\\Program Files\\Fortinet\\FortiClient\\FortiClient.exe" D ADzxIi e#date=2024-02-29 time=19:38:42 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253522 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0=Hqe#date=2024-02-29 time=19:38:42 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\IComInt.EXE virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxGi e#date=2024-02-29 time=19:38:41 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253521 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0  Wfdate=2024-04-13 time=10:21:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1147 ephbemslast="2024-04-13 10:20:36" emshostname=ENDPOINT.onconcord.org Vfdate=2024-04-13 time=10:20:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1146 ephbemslast="2024-04-13 10:19:36" emshostname=ENDPOINT.onconcord.org Uf]date=2024-04-13 time=10:19:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1145 ephbemslast="2024-04-13 10:18:36" emshostname=ENDPOINT.onconcord.org < 9<zxCi e#date=2024-02-29 time=19:38:38 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253518 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0EBe#date=2024-02-29 time=19:38:37 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\IBRView.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxAi e#date=2024-02-29 time=19:38:35 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253515 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0    fƖdate=2024-08-21 time=21:38:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=314 ephbemslast="2024-08-21 21:38:44" emshostname=ENDPOINT.onconcord.org  fƖvdate=2024-08-21 time=21:37:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=313 ephbemslast="2024-08-21 21:37:44" emshostname=ENDPOINT.onconcord.org  fƖ:date=2024-08-21 time=21:36:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=312 ephbemslast="2024-08-21 21:36:44" emshostname=ENDPOINT.onconcord.org  64aa f date=2024-04-09 time=07:01:36 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=4059381447 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=53147 direction=outbound dstip=204.79.197.239 remotename=edge.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://edge.microsoft.com/>`u f date=2024-04-09 time=07:01:35 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=creggb@ONCONCORD msg="Traffic log" sessionid=602812637 srcname=msedge.exe srcproduct="Microsoft Edge" srcip=166.239.12.171 srcport=53146 direction=outbound dstip=23.194.131.147 remotename=copilot.microsoft.com dstport=443 proto=6 rcvdbyte=0 sentbyte=0 utmaction=passthrough utmevent=webfilter threat=excluded service=http userinitiated=0 browsetime=0 url=http://copilot.microsoft.com/ 1 1?=:qe#date=2024-02-29 time=19:38:31 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\Geo.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystem 9 e#date=2024-02-29 time=19:38:30 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=20 ephbemslast="2024-02-29 19:37:41" emshostname=ENDPOINT.onconcord.org x8i e#date=2024-02-29 time=19:38:30 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253510 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0   P e%date=2024-02-29 time=19:47:30 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=29 ephbemslast="2024-02-29 19:46:41" emshostname=ENDPOINT.onconcord.org zOm e%date=2024-02-29 time=19:47:29 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709254049 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0   fqdate=2024-08-31 time=15:37:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=150 ephbemslast="2024-08-31 15:36:42" emshostname=ENDPOINT.onconcord.org fpdate=2024-08-31 time=15:36:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=149 ephbemslast="2024-08-31 15:35:42" emshostname=ENDPOINT.onconcord.org fpdate=2024-08-31 time=15:35:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=148 ephbemslast="2024-08-31 15:34:42" emshostname=ENDPOINT.onconcord.org    fƕJdate=2024-08-21 time=21:32:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=308 ephbemslast="2024-08-21 21:32:44" emshostname=ENDPOINT.onconcord.org  fƕdate=2024-08-21 time=21:31:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=307 ephbemslast="2024-08-21 21:31:44" emshostname=ENDPOINT.onconcord.org  fƔdate=2024-08-21 time=21:30:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=306 ephbemslast="2024-08-21 21:30:44" emshostname=ENDPOINT.onconcord.org B ?Bzx4i e#date=2024-02-29 time=19:38:28 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253508 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0?3ue#date=2024-02-29 time=19:38:27 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\DiaGettr.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx2i e#date=2024-02-29 time=19:38:24 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253504 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0   " fƚ6date=2024-08-21 time=21:53:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=329 ephbemslast="2024-08-21 21:53:44" emshostname=ENDPOINT.onconcord.org ! fƙdate=2024-08-21 time=21:52:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=328 ephbemslast="2024-08-21 21:52:44" emshostname=ENDPOINT.onconcord.org  fƙdate=2024-08-21 time=21:51:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=327 ephbemslast="2024-08-21 21:51:44" emshostname=ENDPOINT.onconcord.org 6 36zx.i e#date=2024-02-29 time=19:38:22 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253502 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0K- e#~date=2024-02-29 time=19:38:21 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\ConfigUtil.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx,i e#|date=2024-02-29 time=19:38:19 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253499 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0    fƔdate=2024-08-21 time=21:29:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=305 ephbemslast="2024-08-21 21:29:45" emshostname=ENDPOINT.onconcord.org  fƔZdate=2024-08-21 time=21:28:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=304 ephbemslast="2024-08-21 21:28:45" emshostname=ENDPOINT.onconcord.org  fƔdate=2024-08-21 time=21:27:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=303 ephbemslast="2024-08-21 21:27:45" emshostname=ENDPOINT.onconcord.org F CFzx(i e#zdate=2024-02-29 time=19:38:17 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253497 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0;'me#ydate=2024-02-29 time=19:38:17 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\ComInt.EXE virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx&i e#ydate=2024-02-29 time=19:38:16 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253496 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0    fƗfdate=2024-08-21 time=21:41:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=317 ephbemslast="2024-08-21 21:41:44" emshostname=ENDPOINT.onconcord.org  fƗ*date=2024-08-21 time=21:40:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=316 ephbemslast="2024-08-21 21:40:44" emshostname=ENDPOINT.onconcord.org  fƖdate=2024-08-21 time=21:39:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=315 ephbemslast="2024-08-21 21:39:44" emshostname=ENDPOINT.onconcord.org > ;>zx"i e#vdate=2024-02-29 time=19:38:13 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253493 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0C!}e#udate=2024-02-29 time=19:38:13 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\CmtImc.Exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx i e#udate=2024-02-29 time=19:38:12 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253492 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0  Tf!date=2024-04-13 time=10:18:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1144 ephbemslast="2024-04-13 10:17:36" emshostname=ENDPOINT.onconcord.org Sfdate=2024-04-13 time=10:17:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1143 ephbemslast="2024-04-13 10:16:36" emshostname=ENDPOINT.onconcord.org Rfdate=2024-04-13 time=10:16:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1142 ephbemslast="2024-04-13 10:15:36" emshostname=ENDPOINT.onconcord.org  1e"d!e"date=2zm e"date=2024-02-29 time=19:35:09 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253309 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0zm e"date=2024-02-29 time=19:35:07 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253307 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0e"dazm e"date=2024-02-29 time=19:35:08 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253308 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  |zm e"date=2024-02-29 time=19:35:12 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253312 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  e"date=2024-02-29 time=19:35:11 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file="C:\\IMC\\CMN\\DotNet\\NJDEx Interface\\NJDEx Interface.exe" virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemzm e"date=2024-02-29 time=19:35:09 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253309 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0   ! e"date=2024-02-29 time=19:35:30 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=17 ephbemslast="2024-02-29 19:34:41" emshostname=ENDPOINT.onconcord.org  ie"date=2024-02-29 time=19:35:30 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\CMN\DotNet\ShellManager\ShellManager.exe.old virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemzm e"date=2024-02-29 time=19:35:30 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253329 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  '%'Ae"date=2z*m e"date=2024-02-29 time=19:35:39 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253339 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=03)Qe"date=2024-02-29 tiz,m e"date=2024-02-29 time=19:35:51 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253351 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0z(m e"date=2024-02-29 time=19:35:37 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253337 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0 ! !OM<e#date=2024-02-29 time=19:36:31 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\CADExchange.Exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystem ; e#date=2024-02-29 time=19:36:30 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=18 ephbemslast="2024-02-29 19:35:41" emshostname=ENDPOINT.onconcord.org x:i e#date=2024-02-29 time=19:36:30 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253390 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0   O fƤdate=2024-08-21 time=22:38:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=374 ephbemslast="2024-08-21 22:38:44" emshostname=ENDPOINT.onconcord.org N fƤdate=2024-08-21 time=22:37:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=373 ephbemslast="2024-08-21 22:37:44" emshostname=ENDPOINT.onconcord.org M fƤKdate=2024-08-21 time=22:36:58 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=372 ephbemslast="2024-08-21 22:36:44" emshostname=ENDPOINT.onconcord.org B ?Bzx6i e# date=2024-02-29 time=19:36:27 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253387 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0?5ue# date=2024-02-29 time=19:36:26 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\AddIndex.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx4i e#date=2024-02-29 time=19:36:20 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253380 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0   fvdate=2024-08-31 time=16:01:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=174 ephbemslast="2024-08-31 16:00:42" emshostname=ENDPOINT.onconcord.org fvhdate=2024-08-31 time=16:00:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=173 ephbemslast="2024-08-31 15:59:42" emshostname=ENDPOINT.onconcord.org fv,date=2024-08-31 time=15:59:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=172 ephbemslast="2024-08-31 15:58:42" emshostname=ENDPOINT.onconcord.org 8 58zx0i e"date=2024-02-29 time=19:36:08 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253368 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0G/e"date=2024-02-29 time=19:36:07 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\CMN\IMCMsgC3.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemz.m e"date=2024-02-29 time=19:35:52 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253352 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  Zfdate=2024-04-13 time=10:24:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1150 ephbemslast="2024-04-13 10:23:37" emshostname=ENDPOINT.onconcord.org YfMdate=2024-04-13 time=10:23:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1149 ephbemslast="2024-04-13 10:22:37" emshostname=ENDPOINT.onconcord.org Xfdate=2024-04-13 time=10:22:08 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=mccarthn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1148 ephbemslast="2024-04-13 10:21:36" emshostname=ENDPOINT.onconcord.org > ;>zxci e#|?=Cqjv date=2026-08-08 time=00:01:16 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=5546 vulnname="Apache OpenOffice CVE-2023-47804 Arbitrary Code Execution Vulnerability" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/5546 detectedpath="C:\\Program Files (x86)\\OpenOffice 4\\"=Bqjv date=2026-08-08 time=00:01:16 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=4901 vulnname="Apache OpenOffice CVE-2022-47502 Arbitrary Code Execution Vulnerability" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/4901 detectedpath="C:\\Program Files (x86)\\OpenOffice 4\\" 6 36zxQi e#%date=2024-02-29 time=19:36:52 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253412 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0KP e#$date=2024-02-29 time=19:36:52 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\ConfigUtil.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxOi e#$date=2024-02-29 time=19:36:51 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253411 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0   fu ;>zx]i e#4date=2024-02-29 time=19:37:07 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253427 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0C\}e#3date=2024-02-29 time=19:37:07 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\GoLive.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx[i e#3date=2024-02-29 time=19:37:06 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253426 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 F CFzxKi e#!date=2024-02-29 time=19:36:48 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253408 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0;Jme# date=2024-02-29 time=19:36:47 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\Checks.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxIi e#date=2024-02-29 time=19:36:45 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253405 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 6 $6ki@IjGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=6250 vulnname="FortiClient CVE-2025-57716 Uncontrolled Search Path Element Vulnerability" vulnseverity=Medium vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/6250 detectedpath="C:\\Program Files\\Fortinet\\FortiClient\\FortiClient.exe"W?%jGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=6191 vulnname="FortiClient CVE-2024-40586 Improper Access Control Vulnerability" vulnseverity=Medium vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/6191 detectedpath="C:\\Program Files\\Fortinet\\FortiClient\\FortiClient.exe"  |z*m e"date=2024-02-29 time=19:35:39 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253339 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0-)Qe"date=2024-02-29 time=19:35:39 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\CMN\DotNet\StateGeneric\TriTech.Imc.State.Generic.ReportViewer.exe.old virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemz(m e"date=2024-02-29 time=19:35:37 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253337 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0 | >|?=qjdate=2026-08-15 time=21:42:33 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=5546 vulnname="Apache OpenOffice CVE-2023-47804 Arbitrary Code Execution Vulnerability" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/5546 detectedpath="C:\\Program Files (x86)\\OpenOffice 4\\"=qjdate=2026-08-15 time=21:42:33 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=4901 vulnname="Apache OpenOffice CVE-2022-47502 Arbitrary Code Execution Vulnerability" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/4901 detectedpath="C:\\Program Files (x86)\\OpenOffice 4\\" @ =@zxEi e#date=2024-02-29 time=19:36:42 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253402 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0ADye#date=2024-02-29 time=19:36:41 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\Cayce.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxCi e#date=2024-02-29 time=19:36:39 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253399 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 L ILzxWi e#0date=2024-02-29 time=19:37:03 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253423 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=05Vae#/date=2024-02-29 time=19:37:02 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\Geo.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxUi e#,date=2024-02-29 time=19:36:59 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253419 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0   ezm e"date=2024-02-29 time=19:34:56 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253296 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0zm e"date=2024-02-29 time=19:34:54 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253294 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0!!e"date=2zm e"date=2024-02-29 time=19:34:58 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253297 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  |zm e"date=2024-02-29 time=19:35:07 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253307 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0 e"date=2024-02-29 time=19:35:06 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\CMN\DotNet\MobileUpdater\UpdateServer\UpdateServer.exe virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemzm e"date=2024-02-29 time=19:34:58 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253297 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  |z m e"date=2024-02-29 time=19:34:45 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253284 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0 ez m e"date=2024-02-29 time=19:34:53 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253293 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0z m e"date=2024-02-29 time=19:34:46 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253286 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  |zm e"date=2024-02-29 time=19:34:54 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253294 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0-e"date=2024-02-29 time=19:34:54 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\CMN\DotNet\MailConversion\TriTech.Imc.Mail.Conversion.exe.old virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemz m e"date=2024-02-29 time=19:34:53 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253293 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  !9e"date  e"date=2024-02-29 time=19:34:30 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=16 ephbemslast="2024-02-29 19:33:41" emshostname=ENDPOINT.onconcord.org zm e"date=2024-02-29 time=19:34:17 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253257 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0)e"date=202zm e"date=2024-02-29 time=19:34:18 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253258 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  |zqm e"Ldate=2024-02-29 time=19:33:15 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253195 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0 zsm e"Udate=2024-02-29 time=19:33:24 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253204 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0 rezum e"Vdate=2024-02-29 time=19:33:25 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253205 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  y-e"ldate=2024-02-29 time=19:33:47 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file="C:\\IMC\\CMN\\DotNet\\Coplink Interface\\Coplink Interface.exe.old" virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemzxm e"ldate=2024-02-29 time=19:33:47 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253227 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0 v e"[date=2024-02-29 time=19:33:30 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=15 ephbemslast="2024-02-29 19:32:41" emshostname=ENDPOINT.onconcord.org  %#=e"date=20e"date=2024-02-29 time=19:34:43 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file="C:\\IMC\\CMN\\DotNet\\Linx Interface\\LInX Interface.exe" virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemzm e"date=2024-02-29 time=19:34:35 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253275 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0!-e"date=2024zm e"date=2024-02-29 time=19:34:36 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253276 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  |zzm e"mdate=2024-02-29 time=19:33:48 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253228 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0y-e"ldate=2024-02-29 time=19:33:47 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file="C:\\IMC\\CMN\\DotNet\\Coplink Interface\\Coplink Interface.exe.old" virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemzxm e"ldate=2024-02-29 time=19:33:47 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253227 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  !5e"datee"date=2024-qYe"date=2024-02-29 time=19:35:28 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\CMN\DotNet\ShellManager\ShellManager.exe virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemzm e"date=2024-02-29 time=19:35:12 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253312 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0 e"dzm e"date=2024-02-29 time=19:35:13 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253313 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  |zm e"date=2024-02-29 time=19:34:17 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253257 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0)e"date=2024-02-29 time=19:34:16 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\CMN\DotNet\Hub2Hub\TriTech.Imc.Messaging.Brokers.Hub2Hub.exe virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemz~m e"date=2024-02-29 time=19:34:12 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253252 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  |z m e"date=2024-02-29 time=19:34:45 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253284 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0e"date=2024-02-29 time=19:34:43 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file="C:\\IMC\\CMN\\DotNet\\Linx Interface\\LInX Interface.exe" virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystemzm e"date=2024-02-29 time=19:34:36 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253276 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0  we"kdate=2024-02-29 time=19:33:46 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file="C:\\IMC\\CMN\\DotNet\\Coplink Interface\\Coplink Interface.exe" virus=MSIL/Kryptik.MXF!tr sigid=690581 vid=7647749 detectedby="AntiVirus scan" detectedin=filesystem v e"[date=2024-02-29 time=19:33:30 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=15 ephbemslast="2024-02-29 19:32:41" emshostname=ENDPOINT.onconcord.org zum e"Vdate=2024-02-29 time=19:33:25 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253205 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=MSIL/Kryptik.MXF!tr userinitiated=0 browsetime=0 R &RQO>jGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=6072 vulnname="FortiClient CVE-2024-50564 Information Disclosure Vulnerability" vulnseverity=Low vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/6072 detectedpath="C:\\Program Files\\Fortinet\\FortiClient\\FortiClient.exe"U=!jGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=6022 vulnname="FortiClient CVE-2024-50570 Information Disclosure Vulnerability" vulnseverity=Medium vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/6022 detectedpath="C:\\Program Files\\Fortinet\\FortiClient\\FortiClient.exe" 8 58zxii e#Cdate=2024-02-29 time=19:37:22 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253442 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0Ih e#Bdate=2024-02-29 time=19:37:21 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\MDBSignon.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxgi e#Bdate=2024-02-29 time=19:37:21 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253441 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0   ftdate=2024-08-31 time=15:52:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=165 ephbemslast="2024-08-31 15:51:42" emshostname=ENDPOINT.onconcord.org ftLdate=2024-08-31 time=15:51:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=164 ephbemslast="2024-08-31 15:50:42" emshostname=ENDPOINT.onconcord.org ftdate=2024-08-31 time=15:50:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=163 ephbemslast="2024-08-31 15:49:42" emshostname=ENDPOINT.onconcord.org N KNzxoi e#Jdate=2024-02-29 time=19:37:29 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253449 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=03n]e#Idate=2024-02-29 time=19:37:28 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\Pl.Exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxmi e#Gdate=2024-02-29 time=19:37:26 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253446 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0  X?=8qjGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=4898 vulnname="Apache OpenOffice CVE-2022-38745 Arbitrary Code Execution Vulnerability" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/4898 detectedpath="C:\\Program Files (x86)\\OpenOffice 4\\"#7=jGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=4461 vulnname="Security Vulnerabilities fixed in Apache OpenOffice 4.1.13" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/4461 detectedpath="C:\\Program Files (x86)\\OpenOffice 4\\" | >|?=:qjGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=5546 vulnname="Apache OpenOffice CVE-2023-47804 Arbitrary Code Execution Vulnerability" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/5546 detectedpath="C:\\Program Files (x86)\\OpenOffice 4\\"=9qjGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=4901 vulnname="Apache OpenOffice CVE-2022-47502 Arbitrary Code Execution Vulnerability" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/4901 detectedpath="C:\\Program Files (x86)\\OpenOffice 4\\" D ADzxxi e#Odate=2024-02-29 time=19:37:34 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253454 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0=wqe#Ndate=2024-02-29 time=19:37:34 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\Recover.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxvi e#Ndate=2024-02-29 time=19:37:33 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253453 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 p @0p=;>mf.date=2024-09-28 time=06:23:41 logver=2 id=96958 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn msg="User social media information" social_srvc=os = f date=2024-09-28 time=06:23:04 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=1575 ephbemslast="2024-09-28 06:22:39" emshostname=ENDPOINT.onconcord.org ;<mfdate=2024-09-28 time=06:22:41 logver=2 id=96958 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn msg="User social media information" social_srvc=os : 7:zx~i e#Vdate=2024-02-29 time=19:37:41 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253461 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0G}e#Udate=2024-02-29 time=19:37:40 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\Schedule.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemx|i e#Sdate=2024-02-29 time=19:37:38 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253458 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0   fudate=2024-08-31 time=15:58:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=171 ephbemslast="2024-08-31 15:57:42" emshostname=ENDPOINT.onconcord.org fudate=2024-08-31 time=15:57:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=170 ephbemslast="2024-08-31 15:56:42" emshostname=ENDPOINT.onconcord.org fuxdate=2024-08-31 time=15:56:39 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=hawkinst@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=169 ephbemslast="2024-08-31 15:55:42" emshostname=ENDPOINT.onconcord.org 8 58zxi e#Zdate=2024-02-29 time=19:37:45 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253465 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0I e#Ydate=2024-02-29 time=19:37:45 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\SysConfigUtil.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxi e#Ydate=2024-02-29 time=19:37:44 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253464 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0 > .>mkFMjGdate=2026-08-16 time=07:04:38 logver=2 id=96520 type=securityevent subtype=vulnerabilityscan eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="The vulnerability scan status has changed" status="patching finished"MEjGdate=2026-08-16 time=07:04:38 logver=2 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=7.0.13.0577 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19045)" msg="A vulnerability scan result has been logged" vulnid=6368 vulnname="FortiClient CVE-2025-62676 Privilege Escalation Vulnerability" vulnseverity=High vulncat=Applications vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/6368 detectedpath="C:\\Program Files\\Fortinet\\FortiClient\\FortiClient.exe" < 9<zx i e#adate=2024-02-29 time=19:37:52 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253472 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0E e#`date=2024-02-29 time=19:37:51 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\MPS\Utility.Exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxi e#_date=2024-02-29 time=19:37:49 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253469 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0    fƘdate=2024-08-21 time=21:47:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=323 ephbemslast="2024-08-21 21:47:44" emshostname=ENDPOINT.onconcord.org  fƘdate=2024-08-21 time=21:46:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=322 ephbemslast="2024-08-21 21:46:44" emshostname=ENDPOINT.onconcord.org  fƘVdate=2024-08-21 time=21:45:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=321 ephbemslast="2024-08-21 21:45:44" emshostname=ENDPOINT.onconcord.org B ?Bzxi e#hdate=2024-02-29 time=19:37:59 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253479 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0?ue#gdate=2024-02-29 time=19:37:58 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\CaseMgmt.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxi e#edate=2024-02-29 time=19:37:56 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253476 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0    fƘdate=2024-08-21 time=21:44:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=320 ephbemslast="2024-08-21 21:44:44" emshostname=ENDPOINT.onconcord.org  fƗdate=2024-08-21 time=21:43:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=319 ephbemslast="2024-08-21 21:43:44" emshostname=ENDPOINT.onconcord.org  fƗdate=2024-08-21 time=21:42:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=318 ephbemslast="2024-08-21 21:42:44" emshostname=ENDPOINT.onconcord.org @ =@zxi e#mdate=2024-02-29 time=19:38:04 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253484 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0Aye#ldate=2024-02-29 time=19:38:03 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\Cayce.exe.old virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxi e#ldate=2024-02-29 time=19:38:03 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253483 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0    fƙdate=2024-08-21 time=21:50:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=326 ephbemslast="2024-08-21 21:50:44" emshostname=ENDPOINT.onconcord.org  fƙFdate=2024-08-21 time=21:49:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=325 ephbemslast="2024-08-21 21:49:44" emshostname=ENDPOINT.onconcord.org  fƙ date=2024-08-21 time=21:48:57 logver=2 id=96957 type=systemevent subtype=endpoint eventtype=status level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=careyn@ONCONCORD msg="Endpoint Ext Log to FAZ" epfeatures=av,firewall,webfilter,vpn,vuln,ssoma,sndbox epenfeatures=av,firewall,vpn,vuln ephbemsduration=324 ephbemslast="2024-08-21 21:48:44" emshostname=ENDPOINT.onconcord.org F CFzxi e#rdate=2024-02-29 time=19:38:09 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253489 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0;me#qdate=2024-02-29 time=19:38:08 logver=2 id=96530 type=securityevent subtype=av eventtype=action level=warning uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@onconcord.org msg="Found virus" action=quarantined file=C:\IMC\RMS\Checks.exe virus=W32/VB.RHU!tr.dldr sigid=693209 vid=7990330 detectedby="AntiVirus scan" detectedin=filesystemxi e#odate=2024-02-29 time=19:38:06 logver=2 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=4EF5549DB1674A63BE848553987D4AEE devid=FCT8000515779876 hostname=MBL-C pcdomain=N/A deviceip=166.239.12.171 devicemac=90-81-9d-51-48-5d site=default fctver=6.4.7.1713 fgtserial=N/A emsserial=FCTEMS8821002497 usingpolicy=City_Workstation_Policy_AV os="Microsoft Windows 10 , 64-bit (build 19041)" user=lambertr@ONCONCORD msg="Traffic log" sessionid=1709253486 srcport=0 direction=inbound dstport=0 proto=6 rcvdbyte=0 sentbyte=0 utmaction=quarantined utmevent=antivirus threat=W32/VB.RHU!tr.dldr userinitiated=0 browsetime=0