Edit tour

Windows Analysis Report
https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%

Overview

General Information

Sample URL:	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%25
Analysis ID:	1431966
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Misleading page title found

Phishing site detected (based on favicon image match)

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2012,i,13689327843227247037,18124641368038824989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6328 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Misleading page title found

Source: https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Page Title: mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085
Source: https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Page Title: mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085

Phishing site detected (based on favicon image match)

Source: https://mcas.ms	Matcher: Template: microsoft matched with high similarity
Source: https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Matcher: Template: microsoft matched with high similarity

Source: https://login.microsoftonline.com/258ac4e4-146a-411e-9dc8-79a9e12fd6da/oauth2/authorize?client_id=2793995e-0a7d-40d7-bd35-6968ba142197&redirect_uri=https%3A%2F%2Flauncher.myapps.microsoft.com%2Fapi%2Fsignin-oidc&response_type=code&scope=openid%20profile%20offline_access&code_challenge=L-dkjBZahopAZr0ySy1WWvGFT_GPGCmPjGwvjuX7M3Y&code_challenge_method=S256&response_mode=form_post&nonce=638496979481455478.YjU1ODBlM2QtOTg0ZS00MGM1LThiMDItOTIxNjBlOGM4ZmQxMTE3ODMzNDQtYTYyMy00OTVhLThhMTItZTU1YzAyNWM1YmQz&client_info=1&x-client-brkrver=IDWeb.2.17.1.0&client-request-id=8ac8d9fc-957a-44a1-89ce-df1ddb0b3f62&state=CfDJ8Jf7XhjzbihDvpJPccI4CQkLRdwmnKeCMRTL__Ae-6mIrzP9tY-ORjL_yY_8olE3xW9pjMHEji64ETVI2y4jdJ1SmOqWL0ZexoA33xE1Fq227vtBjQnyMame2ePfeW4f3YjCFnZ2nCrSVOF4HFLJUEmKaMxZysgo2QqCk-SiDBwtRvX-4RQ52WXqoEXn1iKpEZPXLhP2khPLMslkRaksElre0IBuegKQ6YEylTQ_9__1AHpHiEQSfJKklFBTb1ryznp5i3EyXTaTzKHgkM2jr_K8sHDjDgHgvu1nsIvDqKyZK7CQaKQJ4oznhZchWS5ygGEULUXyrZFt2Gpjzg_sT0g1W9hjydWIn2PLD_uM6fYLC2UxJLVeIGbO5LX0-F6FYt1-_r-WxFBBobjnPez2Q99Qcr...

HTTP Parser: Number of links: 0

Source: https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085

HTTP Parser: Base64 decoded: ks"> <a target="_blank" href="http://go.microsoft.com/fwlink/?LinkID=733268">{{ formatMessage (intlGet "translations.PROXYWEB_MONITORED_ACCESS_TERMS")}}</a> | <a target="_blank" href="http://go.microsoft.com...

HTTP Parser: Title: Redirecting does not match URL

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/258ac4e4-146a-411e-9dc8-79a9e12fd6da/oauth2/authorize?client_id=2793995e-0a7d-40d7-bd35-6968ba142197&redirect_uri=https%3A%2F%2Flauncher.myapps.microsoft.com%2Fapi%2Fsignin-oidc&response_type=code&scope=openid%20profile%20offline_access&code_challenge=L-dkjBZahopAZr0ySy1WWvGFT_GPGCmPjGwvjuX7M3Y&code_challenge_method=S256&response_mode=form_post&nonce=638496979481455478.YjU1ODBlM2QtOTg0ZS00MGM1LThiMDItOTIxNjBlOGM4ZmQxMTE3ODMzNDQtYTYyMy00OTVhLThhMTItZTU1YzAyNWM1YmQz&client_info=1&x-client-brkrver=IDWeb.2.17.1.0&client-request-id=8ac8d9fc-957a-44a1-89ce-df1ddb0b3f62&state=CfDJ8Jf7XhjzbihDvpJPccI4CQkLRdwmnKeCMRTL__Ae-6mIrzP9tY-ORjL_yY_8olE3xW9pjMHEji64ETVI2y4jdJ1SmOqWL0ZexoA33xE1Fq227vtBjQnyMame2ePfeW4f3YjCFnZ2nCrSVOF4HFLJUEmKaMxZysgo2QqCk-SiDBwtRvX-4RQ52WXqoEXn1iKpEZPXLhP2khPLMslkRaksElre0IBuegKQ6YEylTQ_9__1AHpHiEQSfJKklFBTb1ryznp5i3EyXTaTzKHgkM2jr_K8sHDjDgHgvu1nsIvDqKyZK7CQaKQJ4oznhZchWS5ygGEULUXyrZFt2Gpjzg_sT0g1W9hjydWIn2PLD_uM6fYLC2UxJLVeIGbO5LX0-F6FYt1-_r-WxFBBobjnPez2Q99Qcr	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/258ac4e4-146a-411e-9dc8-79a9e12fd6da/oauth2/authorize?client_id=2793995e-0a7d-40d7-bd35-6968ba142197&redirect_uri=https%3A%2F%2Flauncher.myapps.microsoft.com%2Fapi%2Fsignin-oidc&response_type=code&scope=openid%20profile%20offline_access&code_challenge=L-dkjBZahopAZr0ySy1WWvGFT_GPGCmPjGwvjuX7M3Y&code_challenge_method=S256&response_mode=form_post&nonce=638496979481455478.YjU1ODBlM2QtOTg0ZS00MGM1LThiMDItOTIxNjBlOGM4ZmQxMTE3ODMzNDQtYTYyMy00OTVhLThhMTItZTU1YzAyNWM1YmQz&client_info=1&x-client-brkrver=IDWeb.2.17.1.0&client-request-id=8ac8d9fc-957a-44a1-89ce-df1ddb0b3f62&state=CfDJ8Jf7XhjzbihDvpJPccI4CQkLRdwmnKeCMRTL__Ae-6mIrzP9tY-ORjL_yY_8olE3xW9pjMHEji64ETVI2y4jdJ1SmOqWL0ZexoA33xE1Fq227vtBjQnyMame2ePfeW4f3YjCFnZ2nCrSVOF4HFLJUEmKaMxZysgo2QqCk-SiDBwtRvX-4RQ52WXqoEXn1iKpEZPXLhP2khPLMslkRaksElre0IBuegKQ6YEylTQ_9__1AHpHiEQSfJKklFBTb1ryznp5i3EyXTaTzKHgkM2jr_K8sHDjDgHgvu1nsIvDqKyZK7CQaKQJ4oznhZchWS5ygGEULUXyrZFt2Gpjzg_sT0g1W9hjydWIn2PLD_uM6fYLC2UxJLVeIGbO5LX0-F6FYt1-_r-WxFBBobjnPez2Q99Qcr	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/258ac4e4-146a-411e-9dc8-79a9e12fd6da/oauth2/authorize?client_id=2793995e-0a7d-40d7-bd35-6968ba142197&redirect_uri=https%3A%2F%2Flauncher.myapps.microsoft.com%2Fapi%2Fsignin-oidc&response_type=code&scope=openid%20profile%20offline_access&code_challenge=L-dkjBZahopAZr0ySy1WWvGFT_GPGCmPjGwvjuX7M3Y&code_challenge_method=S256&response_mode=form_post&nonce=638496979481455478.YjU1ODBlM2QtOTg0ZS00MGM1LThiMDItOTIxNjBlOGM4ZmQxMTE3ODMzNDQtYTYyMy00OTVhLThhMTItZTU1YzAyNWM1YmQz&client_info=1&x-client-brkrver=IDWeb.2.17.1.0&client-request-id=8ac8d9fc-957a-44a1-89ce-df1ddb0b3f62&state=CfDJ8Jf7XhjzbihDvpJPccI4CQkLRdwmnKeCMRTL__Ae-6mIrzP9tY-ORjL_yY_8olE3xW9pjMHEji64ETVI2y4jdJ1SmOqWL0ZexoA33xE1Fq227vtBjQnyMame2ePfeW4f3YjCFnZ2nCrSVOF4HFLJUEmKaMxZysgo2QqCk-SiDBwtRvX-4RQ52WXqoEXn1iKpEZPXLhP2khPLMslkRaksElre0IBuegKQ6YEylTQ_9__1AHpHiEQSfJKklFBTb1ryznp5i3EyXTaTzKHgkM2jr_K8sHDjDgHgvu1nsIvDqKyZK7CQaKQJ4oznhZchWS5ygGEULUXyrZFt2Gpjzg_sT0g1W9hjydWIn2PLD_uM6fYLC2UxJLVeIGbO5LX0-F6FYt1-_r-WxFBBobjnPez2Q99Qcr	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/258ac4e4-146a-411e-9dc8-79a9e12fd6da/oauth2/authorize?client_id=2793995e-0a7d-40d7-bd35-6968ba142197&redirect_uri=https%3A%2F%2Flauncher.myapps.microsoft.com%2Fapi%2Fsignin-oidc&response_type=code&scope=openid%20profile%20offline_access&code_challenge=L-dkjBZahopAZr0ySy1WWvGFT_GPGCmPjGwvjuX7M3Y&code_challenge_method=S256&response_mode=form_post&nonce=638496979481455478.YjU1ODBlM2QtOTg0ZS00MGM1LThiMDItOTIxNjBlOGM4ZmQxMTE3ODMzNDQtYTYyMy00OTVhLThhMTItZTU1YzAyNWM1YmQz&client_info=1&x-client-brkrver=IDWeb.2.17.1.0&client-request-id=8ac8d9fc-957a-44a1-89ce-df1ddb0b3f62&state=CfDJ8Jf7XhjzbihDvpJPccI4CQkLRdwmnKeCMRTL__Ae-6mIrzP9tY-ORjL_yY_8olE3xW9pjMHEji64ETVI2y4jdJ1SmOqWL0ZexoA33xE1Fq227vtBjQnyMame2ePfeW4f3YjCFnZ2nCrSVOF4HFLJUEmKaMxZysgo2QqCk-SiDBwtRvX-4RQ52WXqoEXn1iKpEZPXLhP2khPLMslkRaksElre0IBuegKQ6YEylTQ_9__1AHpHiEQSfJKklFBTb1ryznp5i3EyXTaTzKHgkM2jr_K8sHDjDgHgvu1nsIvDqKyZK7CQaKQJ4oznhZchWS5ygGEULUXyrZFt2Gpjzg_sT0g1W9hjydWIn2PLD_uM6fYLC2UxJLVeIGbO5LX0-F6FYt1-_r-WxFBBobjnPez2Q99Qcr...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/258ac4e4-146a-411e-9dc8-79a9e12fd6da/oauth2/authorize?client_id=2793995e-0a7d-40d7-bd35-6968ba142197&redirect_uri=https%3A%2F%2Flauncher.myapps.microsoft.com%2Fapi%2Fsignin-oidc&response_type=code&scope=openid%20profile%20offline_access&code_challenge=L-dkjBZahopAZr0ySy1WWvGFT_GPGCmPjGwvjuX7M3Y&code_challenge_method=S256&response_mode=form_post&nonce=638496979481455478.YjU1ODBlM2QtOTg0ZS00MGM1LThiMDItOTIxNjBlOGM4ZmQxMTE3ODMzNDQtYTYyMy00OTVhLThhMTItZTU1YzAyNWM1YmQz&client_info=1&x-client-brkrver=IDWeb.2.17.1.0&client-request-id=8ac8d9fc-957a-44a1-89ce-df1ddb0b3f62&state=CfDJ8Jf7XhjzbihDvpJPccI4CQkLRdwmnKeCMRTL__Ae-6mIrzP9tY-ORjL_yY_8olE3xW9pjMHEji64ETVI2y4jdJ1SmOqWL0ZexoA33xE1Fq227vtBjQnyMame2ePfeW4f3YjCFnZ2nCrSVOF4HFLJUEmKaMxZysgo2QqCk-SiDBwtRvX-4RQ52WXqoEXn1iKpEZPXLhP2khPLMslkRaksElre0IBuegKQ6YEylTQ_9__1AHpHiEQSfJKklFBTb1ryznp5i3EyXTaTzKHgkM2jr_K8sHDjDgHgvu1nsIvDqKyZK7CQaKQJ4oznhZchWS5ygGEULUXyrZFt2Gpjzg_sT0g1W9hjydWIn2PLD_uM6fYLC2UxJLVeIGbO5LX0-F6FYt1-_r-WxFBBobjnPez2Q99Qcr...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/258ac4e4-146a-411e-9dc8-79a9e12fd6da/oauth2/authorize?client_id=2793995e-0a7d-40d7-bd35-6968ba142197&redirect_uri=https%3A%2F%2Flauncher.myapps.microsoft.com%2Fapi%2Fsignin-oidc&response_type=code&scope=openid%20profile%20offline_access&code_challenge=L-dkjBZahopAZr0ySy1WWvGFT_GPGCmPjGwvjuX7M3Y&code_challenge_method=S256&response_mode=form_post&nonce=638496979481455478.YjU1ODBlM2QtOTg0ZS00MGM1LThiMDItOTIxNjBlOGM4ZmQxMTE3ODMzNDQtYTYyMy00OTVhLThhMTItZTU1YzAyNWM1YmQz&client_info=1&x-client-brkrver=IDWeb.2.17.1.0&client-request-id=8ac8d9fc-957a-44a1-89ce-df1ddb0b3f62&state=CfDJ8Jf7XhjzbihDvpJPccI4CQkLRdwmnKeCMRTL__Ae-6mIrzP9tY-ORjL_yY_8olE3xW9pjMHEji64ETVI2y4jdJ1SmOqWL0ZexoA33xE1Fq227vtBjQnyMame2ePfeW4f3YjCFnZ2nCrSVOF4HFLJUEmKaMxZysgo2QqCk-SiDBwtRvX-4RQ52WXqoEXn1iKpEZPXLhP2khPLMslkRaksElre0IBuegKQ6YEylTQ_9__1AHpHiEQSfJKklFBTb1ryznp5i3EyXTaTzKHgkM2jr_K8sHDjDgHgvu1nsIvDqKyZK7CQaKQJ4oznhZchWS5ygGEULUXyrZFt2Gpjzg_sT0g1W9hjydWIn2PLD_uM6fYLC2UxJLVeIGbO5LX0-F6FYt1-_r-WxFBBobjnPez2Q99Qcr...	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.197.97.241:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.97.241:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.97.241
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /proxyweb/1.54.36-1-hf/css/proxyweb-all.min.css?cb=1.54.146-6 HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://mcas-proxyweb.mcas.ms/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxyweb/1.54.36-1-hf/js/handlebars.min.js HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mcas-proxyweb.mcas.ms/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxyweb/1.54.36-1-hf/js/lodash-core.min.js HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mcas-proxyweb.mcas.ms/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxyweb/1.54.36-1-hf/js/translate.js HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mcas-proxyweb.mcas.ms/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxyweb/1.54.36-1-hf/js/Handlebars/handlebars-intl.min.js HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mcas-proxyweb.mcas.ms/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxyweb/1.54.36-1-hf/images/favicon.ico?cb=1.54.146-6 HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mcas-proxyweb.mcas.ms/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i18n/0.274.5/proxyweb/en_us.json HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://mcas-proxyweb.mcas.msSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mcas-proxyweb.mcas.ms/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /proxyweb/1.54.36-1-hf/js/Handlebars/locale-data/en.js HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mcas-proxyweb.mcas.ms/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i18n/0.274.5/proxyweb/en_us.json HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxyweb/1.54.36-1-hf/images/favicon.ico?cb=1.54.146-6 HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxyweb/1.54.36-1-hf/images/continue.png HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/css/proxyweb-all.min.css?cb=1.54.146-6Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxyweb/1.54.36-1-hf/images/warning.png HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mcas-proxyweb.mcas.ms/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxyweb/1.54.36-1-hf/images/continue.png HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxyweb/1.54.36-1-hf/images/warning.png HTTP/1.1Host: mcasproxy.cdn.mcas.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Fmyapps.microsoft.com%2Fsignin%2F08558f59-9161-41fc-88b3-f0434087a79c%3FtenantId%3D258ac4e4-146a-411e-9dc8-79a9e12fd6da&data=05%7C01%7Cgary.fabrizio1%40Service.wipro.com%7C8a0e1c61209e469846ba08dbe05e2370%7C258ac4e4146a411e9dc879a9e12fd6da%7C0%7C0%7C638350467206547446%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=p0jrjFUb%2Fusi2RID%2FGIlCE82AM9dEDuVAB4PHdDC1%2F4%3D&reserved=0 HTTP/1.1Host: apc01.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/illustration?ts=636565365803385104 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/bannerlogo?ts=637617112422502334 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/bannerlogo?ts=637617112422502334 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/illustration?ts=636565365803385104 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: mcas-proxyweb.mcas.ms
Source: global traffic	DNS traffic detected: DNS query: mcasproxy.cdn.mcas.ms
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: c.s-microsoft.com
Source: global traffic	DNS traffic detected: DNS query: apc01.safelinks.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: account.activedirectory.windowsazure.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com

Source: chromecache_72.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_72.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_81.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Proxy
Source: chromecache_81.2.dr	String found in binary or memory: https://formatjs.io/handlebars/
Source: chromecache_81.2.dr	String found in binary or memory: https://github.com/angular-translate/angular-translate/blob/master/src/service/translate.js
Source: chromecache_72.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_81.2.dr	String found in binary or memory: https://github.com/handlebars-lang/allow-prototype-access
Source: chromecache_70.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_70.2.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 23.197.97.241:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.97.241:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@18/65@30/8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2012,i,13689327843227247037,18124641368038824989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2012,i,13689327843227247037,18124641368038824989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
https://aadcdn.msauthimages.net/dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/illustration?ts=636565365803385104	0%	Avira URL Cloud	safe
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/translate.js	0%	Avira URL Cloud	safe
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/images/warning.png	0%	Avira URL Cloud	safe
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/lodash-core.min.js	0%	Avira URL Cloud	safe
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/css/proxyweb-all.min.css?cb=1.54.146-6	0%	Avira URL Cloud	safe
https://mcasproxy.cdn.mcas.ms/i18n/0.274.5/proxyweb/en_us.json	0%	Avira URL Cloud	safe
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/handlebars.min.js	0%	Avira URL Cloud	safe
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/Handlebars/locale-data/en.js	0%	Avira URL Cloud	safe
https://formatjs.io/handlebars/	0%	Avira URL Cloud	safe
https://aadcdn.msauthimages.net/dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/illustration?ts=636565365803385104	0%	Virustotal		Browse
https://aadcdn.msauthimages.net/dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/bannerlogo?ts=637617112422502334	0%	Avira URL Cloud	safe
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/Handlebars/handlebars-intl.min.js	0%	Avira URL Cloud	safe
https://formatjs.io/handlebars/	0%	Virustotal		Browse
https://aadcdn.msauthimages.net/dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/bannerlogo?ts=637617112422502334	0%	Virustotal		Browse
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/images/continue.png	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js	0%	Virustotal		Browse
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js	0%	Avira URL Cloud	safe
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/images/favicon.ico?cb=1.54.146-6	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	unknown
apc01.safelinks.protection.outlook.com	104.47.110.28	true	false	high
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
sni1gl.wpc.upsiloncdn.net	152.195.19.97	true	false	unknown
www.google.com	192.178.50.36	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
autologon.microsoftazuread-sso.com	40.126.28.14	true	false	unknown
account.activedirectory.windowsazure.com	unknown	unknown	false	high
aadcdn.msauthimages.net	unknown	unknown	false	unknown
c.s-microsoft.com	unknown	unknown	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
mcas-proxyweb.mcas.ms	unknown	unknown	true	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
mcasproxy.cdn.mcas.ms	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://aadcdn.msauthimages.net/dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/illustration?ts=636565365803385104	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/images/warning.png	false	Avira URL Cloud: safe	unknown
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/css/proxyweb-all.min.css?cb=1.54.146-6	false	Avira URL Cloud: safe	unknown
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/lodash-core.min.js	false	Avira URL Cloud: safe	unknown
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/translate.js	false	Avira URL Cloud: safe	unknown
https://mcasproxy.cdn.mcas.ms/i18n/0.274.5/proxyweb/en_us.json	false	Avira URL Cloud: safe	unknown
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/handlebars.min.js	false	Avira URL Cloud: safe	unknown
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/Handlebars/locale-data/en.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msauthimages.net/dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/bannerlogo?ts=637617112422502334	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/Handlebars/handlebars-intl.min.js	false	Avira URL Cloud: safe	unknown
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/images/continue.png	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/images/favicon.ico?cb=1.54.146-6	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/handlebars-lang/allow-prototype-access	chromecache_81.2.dr	false		high
https://login.microsoftonline.com	chromecache_70.2.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_72.2.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Proxy	chromecache_81.2.dr	false		high
http://knockoutjs.com/	chromecache_72.2.dr	false		high
https://formatjs.io/handlebars/	chromecache_81.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/douglascrockford/JSON-js	chromecache_72.2.dr	false		high
https://login.windows-ppe.net	chromecache_70.2.dr	false		high
https://github.com/angular-translate/angular-translate/blob/master/src/service/translate.js	chromecache_81.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.178.50.36	www.google.com	United States	15169	GOOGLEUS	false
104.47.110.28	apc01.safelinks.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
152.195.19.97	sni1gl.wpc.upsiloncdn.net	United States	15133	EDGECASTUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.107.213.41	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431966
Start date and time:	2024-04-26 05:11:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@18/65@30/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmyapps.microsoft.com%2Fsignin%2F08558f59-9161-41fc-88b3-f0434087a79c%3FtenantId%3D258ac4e4-146a-411e-9dc8-79a9e12fd6da&data=05%7C01%7Cgary.fabrizio1%40Service.wipro.com%7C8a0e1c61209e469846ba08dbe05e2370%7C258ac4e4146a411e9dc879a9e12fd6da%7C0%7C0%7C638350467206547446%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=p0jrjFUb%2Fusi2RID%2FGIlCE82AM9dEDuVAB4PHdDC1%2F4%3D&reserved=0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.178.50.67, 173.194.212.84, 142.250.189.142, 34.104.35.123, 20.168.249.164, 23.63.157.112, 40.68.123.157, 72.21.81.240, 192.229.211.108, 20.190.152.23, 20.190.152.144, 40.126.24.16, 40.126.24.145, 20.190.152.80, 13.85.23.206, 40.126.28.14, 40.126.28.12, 40.126.28.21, 40.126.28.13, 40.126.7.35, 40.126.7.32, 40.126.28.18, 40.126.28.20, 104.89.170.193, 104.89.170.175, 40.126.29.8, 20.190.157.11, 40.126.29.11, 40.126.29.5, 40.126.29.14, 40.126.29.15, 40.126.29.12, 40.126.29.9, 20.166.126.56, 142.250.217.170, 142.250.64.138, 172.217.3.74, 142.250.217.202, 142.250.64.202, 142.250.64.170, 142.250.217.234, 142.250.189.138, 172.217.2.202, 172.217.165.202, 172.217.15.202, 192.178.50.42, 192.178.50.74, 40.126.29.10, 40.126.29.13, 40.126.29.6, 13.69.116.104, 20.189.173.15, 172.217.3.67
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, na.privatelink.msidentity.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, ak.privatelink.msidentity.com, myapps.microsoft.com, clients2.google.com, mps-mda-ic-mcasproxy-prd-weu.azureedge.net, ocsp.digicert.com, login.live.com, aadcdn.ec.azureedge.net, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, onedscolprdweu06.westeurope.cloudapp.azure.com, fs.microsoft.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, www.tm.f.prd.aadg.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, aadcdn.msauth.net, c-s.cms.ms.akadns.net, edgedl.me.gvt1.com, nel.measure.office.net.edgesuite.net, aadcdnoriginwus2.afd.azureedge.net, c.s-microsoft.com-c.edgekey.net, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net, mps-mda-ic-mcasproxy-prd-weu.afd.azureedge.net, launcher.myapps.microsoft.com, a1894.dscb.akamai.net, wu.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.di
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 55071
Category:	downloaded
Size (bytes):	15799
Entropy (8bit):	7.985179973188672
Encrypted:	false
SSDEEP:	384:UwXl87i4naaFtPESJ2DWOq1IcQS0SL7EOONPk:UwXW7i4naTSOAszOG8
MD5:	978A6C1AA934E5B1C5320D515FD25662
SHA1:	64636EF3E1AD607F095DBA6CB01447AC133B483D
SHA-256:	D1963B1837F4087E988FD18BB4CF25B38D61D675C4B6A6FC01158BD39945F10A
SHA-512:	411A51CC19890DC5B27E4800E5BB4BFB4D0E3DC076010C6AB8B10396524F4C996D86420888AF3A1632D5FB281CEB4373C18B0EEFC9F8A84AA59D295450393DA7
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js
Preview:	...........}Ms#G.....uh.O=.>...4..p.O$...P.IF4.".K....1..5.......7.\|.....S6..w8?......9...B.AwUeeeeeefee..f.Oc/._..G.............{..._..%.q..q........j<.w..O.7..."pgbV.C..k.T`..X....'v....<p....I.'..k<j@Ai..NP.6<..j..N.....0.......=..ox/+...9.sB..p.q.ai...?.....qw.D.X..b..?.bOD.x.B1..X..`.N..b..E...%JWg..x8.ys..:...I.....b1...q.......[..a..7q..N........._..4....&.. ........m&6.F.\.@.e.B..`.'.....0............]/.........`..iZ6......./f8..BCz_...i....MQ>..E,/x>v......{.........._.........Z.rP+......e..R.\.Z.u..3@./.oJ7.'.......%.;.WP.9.b..z._..b....0......X...Ro^k.lI..t..K7~.ep.`.)......'."".."....../..S....M..B5nEc2..g..m..\|f.{...pbi(.0.@[_Lc.Z.....U`./!..@.....p.-..kQ@T..8...-...0.....AX.D.?...".....5.NE..\...VQa.....,......?..M.0......_<......C..fOq..bz'..z/BF.;&.K......%.....g........f!..^.:Z...g...j...7.._........S.2/.2.n.....>.<P!!.Bv..J........e!d....B.Ra$.......N........> f.C.....^.D.-.e.c+...............!....$.9x...{.....p~._.0.

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 62 x 62, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2769
Entropy (8bit):	7.906511905665657
Encrypted:	false
SSDEEP:	48:hk8aW7YtUhLzkvHc9K3eMiyvWsP6h8AGJessDJHYwUnyCZumfng+wk:xWfreM3WsPNJesOYwfC7PRwk
MD5:	CD42E93E9D1FD611E162BA4F564C4D2D
SHA1:	8F3218E707BEE17BE7D811622ACDBC537A9BB66E
SHA-256:	8B0175905D6E243143D465E9BD664FE9C9C16BFBDC75BC7B11EE3F8CBB3ABD42
SHA-512:	1C4B11201D5B0239419A32168F271009F39E16047DB63115C65F177CE2B15F1D07388214782B0FFCF3747D06451D51E29A9F4C819D4FBED0404583E725C07F28
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...>...>.....s..D....sBIT....\|.d.....pHYs.........C......tEXtSoftware.www.inkscape.org..<....NIDATh..{pT...?.K^..JvC....+"....h.je.jU...c...Fi;.u:..VEAHb...A%j..v.....T... ...I.ACBr......7..nrW...{......ws~.w~g.<..q......p.Q`<P.......;A.A?..O...]..o.m.\|.&~.,ol;...U.?Q8.0C4e....?PY...}...........[......+....COS).p...xL.....T~C.+.m`#........0d....3l.....v .).zE6.boB.-A.wn;`...0.e. .N...b.}U.m.-[=..s&.y.....?...0.K.&....77_?.3.Ibj"....6.+z-..&..EE={....c.r."'..['.c?7..R..D..b.......^.....T..S[..%.fM\|\|C.G64..Nce...yKU..l......3lK.@...].\.\.z=.[Y..X..%....G{...zx.}.+'.....*.........U...6..`f.%.m.~..,..n.x;0B....M...."..`.2`..%.......?`rQ..\|Uy..i.]R....4@....`Q...S.G....6$..h\|...x..X....Z:G.!^........I....FDop.]"..\..nXZ.-k%.I..G.5._...P.hc.C....`Q..t.i.W]....V.%....\|t.?.hsU.."x..=..K7....E.3..=.......4.w:.h.%?.6x..T.x..^u7.&..C.G.....\3....u..-......#..&u.h..H[.z......w..VW....s..N....q....i.._{.\|.......A.....#.L._..`.....

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113084
Category:	downloaded
Size (bytes):	20314
Entropy (8bit):	7.979540464295058
Encrypted:	false
SSDEEP:	384:ekqQ8rNFEhCgMyL2iww6oIR8mWG+Pu9Z5IM6mxqrghTvUty7T9Q:9CGEiL/w7R8DW9Z5B6AasTv37T9Q
MD5:	92A840DC3D177339DAE03FEDF22A22B5
SHA1:	C1C9A6E6442388D07A9D9D72C12DA25094D6920F
SHA-256:	4A986BA8875F22A0EABC356112A6790F90E114ADB72EAEC4632E03812EC1EDE4
SHA-512:	98C705395DD249501D8069A03E0068BC9CCF4F2D139BEC63A00564C69CD21C05CB25CF56BA7B40822963737989D5048AD310E20D6022E84346C982CFCEF79E11
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Preview:	...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.V5)/wE..Y...gy.0.(.-o.e.\|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....]..6(. ..D.....Y.......:.ve.?..!..\|t...].+.......a.......\|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u..z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~.....n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.\|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~\|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	27266
Entropy (8bit):	5.366385960506858
Encrypted:	false
SSDEEP:	384:rZL034FvL2lbBiq9pIinFZSGGItR6c3BKtQjsLe99e9pU8wjceAc/uM+Jjw:rZLf2l9iq9pvFZQ2RH3lsKBAtw
MD5:	89EA5E2F7371EAA822146F790BE59CBD
SHA1:	DC817D7568F963C50AB8A11F6D7BFFCFDF16E86A
SHA-256:	9B1118BBBB0BB2E70EEEE882C915AF42927A6255E80578202A5AF131B9DC4CAB
SHA-512:	AC085189132FF9329FBCA2C7F7D9DD241F55D57C3F716C69D902DEB9942424BC94BDEB35ACEF559546B94C40065F56E42E6CC6E7D6DF0B9793F964ABED1E6F1D
Malicious:	false
Reputation:	low
URL:	https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/Handlebars/handlebars-intl.min.js
Preview:	(function(){"use strict";function a(a){var b,c,d,e,f=Array.prototype.slice.call(arguments,1);for(b=0,c=f.length;c>b;b+=1)if(d=f[b])for(e in d)p.call(d,e)&&(a[e]=d[e]);return a}function b(a,b,c){this.locales=a,this.formats=b,this.pluralFn=c}function c(a){this.id=a}function d(a,b,c,d,e){this.id=a,this.useOrdinal=b,this.offset=c,this.options=d,this.pluralFn=e}function e(a,b,c,d){this.id=a,this.offset=b,this.numberFormat=c,this.string=d}function f(a,b){this.id=a,this.options=b}function g(a,b,c){var d="string"==typeof a?g.__parse(a):a;if(!d\|\|"messageFormatPattern"!==d.type)throw new TypeError("A message must be provided as a String or AST.");c=this._mergeFormats(g.formats,c),r(this,"_locale",{value:this._resolveLocale(b)});var e=this._findPluralRuleFunction(this._locale),f=this._compilePattern(d,b,c,e),h=this;this.format=function(a){return h._format(f,a)}}function h(a){return 400*a/146097}function i(a,b){b=b\|\|{},G(a)&&(a=a.concat()),D(this,"_locale",{value:this._resolveLocale(a)}),D(this,"_

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113657
Category:	downloaded
Size (bytes):	35813
Entropy (8bit):	7.9933603091137355
Encrypted:	true
SSDEEP:	768:GuwXn8kBZAqgpsnCq63v9K6eodOamRz3YkdBSqwSsg84Yk5RFB6:Jc8kBBnChQodOamRz3YQFSLk3q
MD5:	57911010756C90D58754C91EF1EE2765
SHA1:	BAA48FEF4866D7DAFD9F59417745EE838F0E63CA
SHA-256:	87C5385BA17F84CC25FB7BBE1EDB4169BC702842BD74B758ACDC130986D55BC2
SHA-512:	FF5A7B638CD9117C89C277F6846506D41768D3A30F81B63768379294160AEE89F0D60E853F938D28A654226E18FE3389808ECCDA7D106F76EBE95A53A00DD560
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js
Preview:	...........{..8.(.........,.-.......gglu.. .m..I....~..oRv......i.(....P(......k............o.6>.\|..d..........O...V..}.G..4......9.l..F.mDI.f.4...o,..EA.1...F1g..,...E..Gy...,No6.@..l....n..;....P.fQ...ty...b#I.(d.A2!j1$..m....6n.Q8.x..Y...b#c!....\|.p..w#..F..i..s.Gc..b..9U.k......&@pJ..'40J......e.$.k.L(b...F.n.+..nO..6@n...A.&.,LVa......Y......V..o..% ....,......:..e.-XR. <FE.w..b..P......r.b.["~..!.....y.......V...4.;M..Y.X.{.......0].N..,.r`=...Mv....;...k....w.1p.q...(.u.3....;).. }...s....'....c...o.d....Ax.W..._...?.9...........3..MWI..3.p3..u.m$~Vo:n.'.8..!5h....y...6=7...hz.......f.-.).......Nc..:...g...~.8..4.....0P......$.=.a....#._..3.t..7Q...-....6..j.\|....5-...B...}.VQ.&/...e.XeI.C../.y...{...1...Y..g..`'..F..h.o.]SHW...,..Ac_%y...M..u.O..U..`.&...Y.}....Tu..z..iv.....5..M.q.. .Bz.,..oSS.%..y.....gS1s.(.........%,fE.m.@~.4.........7.x.$0mQ..o....J.J^....~......u!.~Z.iw.b...Q~).=..Tq.:.7HH.E.&6.D`.(..Cxmf.(o...^y_.v.{..K<Y.5.

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	downloaded
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (649)
Category:	downloaded
Size (bytes):	12684
Entropy (8bit):	5.160531580954149
Encrypted:	false
SSDEEP:	192:AS20fqKbwdY08O0lNUpYsYprxYLsu+yHyYEFgY:D20fqKYkNUpD09EsuNHNXY
MD5:	305753FF93FBC439257153952C2CD20F
SHA1:	486BC31AAE005F9EFC69C701F407734FCBABD3A6
SHA-256:	DE1FAC0AD3A03174F4E49969F48D2E499D19AFCD076DB19431D7B1CD707832FA
SHA-512:	0A167997CF35348071F6CC5D0F2E601329EEA7A6C2E3E13C18F581CA5932458C302B57C702519AEFE0FD9B5A383848EA600FA7CA0C8C478F2F361E6499958F2E
Malicious:	false
Reputation:	low
URL:	https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/lodash-core.min.js
Preview:	/*. @license. * Lodash (Custom Build) lodash.com/license \| Underscore.js 1.8.3 underscorejs.org/LICENSE. * Build: `lodash core -o ./dist/lodash.core.js`. */.;(function(){function n(n){return H(n)&&pn.call(n,"callee")&&!yn.call(n,"callee")}function t(n,t){return n.push.apply(n,t),n}function r(n){return function(t){return null==t?Z:t[n]}}function e(n,t,r,e,u){return u(n,function(n,u,o){r=e?(e=false,n):t(r,n,u,o)}),r}function u(n,t){return j(t,function(t){return n[t]})}function o(n){return n instanceof i?n:new i(n)}function i(n,t){this.__wrapped__=n,this.__actions__=[],this.__chain__=!!t}function c(n,t,r){if(typeof n!="function")throw new TypeError("Expected a function");.return setTimeout(function(){n.apply(Z,r)},t)}function f(n,t){var r=true;return mn(n,function(n,e,u){return r=!!t(n,e,u)}),r}function a(n,t,r){for(var e=-1,u=n.length;++e<u;){var o=n[e],i=t(o);if(null!=i&&(c===Z?i===i:r(i,c)))var c=i,f=o}return f}function l(n,t){var r=[];return mn(n,function(n,e,u){t(n,e,u)&&r.push(n)

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45563)
Category:	downloaded
Size (bytes):	141339
Entropy (8bit):	5.431048966728945
Encrypted:	false
SSDEEP:	1536:5FZ5ELQbTPRUbx3jog/MhTJvRkmYWp0BSYmvIxdL/Bpns0Vgt2CTJm0wTxFojd9q:jEArg/M1Nn3vIPzDk80ZjT0qcePg3
MD5:	0A1A5BA009FB1F25E3F3D036D8CF26CE
SHA1:	8E9E6A11CED0807252C34DCA1D8C7C2390D1A5CA
SHA-256:	94153F2A6DAAE35DFCB61DC987E2D4310B7CA021E36375E87D8B8C641C0C6121
SHA-512:	018FA3AD6DCC5DD17258334C2AD5BD0CE4E6AC278A340EE9F0147EC3084B56D0BC5F7224DAF950E89B53828FF57737E1DB1539DCE2B3E7967FE40971677CDFB4
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,r,i=n[0],a=n[1],s=0,u=[];s<i.length;s++)

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15708
Category:	downloaded
Size (bytes):	5512
Entropy (8bit):	7.968035355108244
Encrypted:	false
SSDEEP:	96:G7tBbRd2YmPbYfuJeBaCkiw4vCM5257nrGunGwVHG0DW80tMBZX/m5nyZf:GDz2Rxiwd7nrGuGeG0DvBdyyZf
MD5:	98421BE6893CF3AA929C5F6C4A0C5C67
SHA1:	2BB411BB6B6C31AE02B81F199C90219717F718AF
SHA-256:	019D26044CCF18F979DFBB8677828FA36BF5CBFC529CECD942644CFE86D90D04
SHA-512:	3142C929754027BA755A6633B51C87C52F1C27B14686C70A22CAB66BD859840F6E7847E0ECA61F4E1B399EEABECA6D28B8A9487CED42D976A9F9397F7C0F6230
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js
Preview:	...........[}w.F....Bh..i3.M....>./.......&9...P,$U#......HH..N..I...s...~...h.............{.ij.x.....u....M.........#.........8.c'.B..o.9.6...L.....>L..{".....f.].j.N.,..i.?.6o..X=....O.-..o.5'p%6.....,py..'.p.]z.8..(.b>..=6.3.on.4'...6..d...A.X..F.($8...\ .../..Db4.iM....@....I...."........M...st ....k...D..k!.cM2K...... ..6...X.m..s.1.S.$...r.`.y....1..$."...J.sOp+..M."....Eh....G'....L55I.H...^2...a8=v...w.H...p.....G_.Zp.xU.g.P.5....^.E.w6...q.....B7.~..7...A.q..1....4.......Ev..r..iE311>~...=~W{]..!...,`.\|.wpY.0^.,.G.d1>NL.....5..........g3;.~..x.MbH...r.RA....2. ...E..Z..Lq...O..C]....~.w..4.P..\...$NL..;....[R0.8..[A.t ......\|.Ln..3H......g.q"n...\|g..4..g....w....l..[........q...llW..]....L.'....$..m....-...svg'......]..cl..N.`7.......7f=..F....2.....f.<.oyB..f)w.0<.N.y..T......Y.p].\......7.....Vo./e...K..3....:d.......g..H...}=..l.<.{..".s .g.Q..\|v..O#HM.r.b...7..`a.c..i..j..Zm.=..@w.%..q..-yBV91.4.z..Y.....

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (27214), with no line terminators
Category:	downloaded
Size (bytes):	27214
Entropy (8bit):	5.013337001667674
Encrypted:	false
SSDEEP:	192:yaRL7VbgFUx+xIhEJ9HTB1GS+DLrkBUSHG0M9Bufgew2Iv33EcTSfSGs0HZgqAmc:yaV7dXA9VsX6VK3GFtDwakIw
MD5:	205853C337B996A55947F9FA3110D048
SHA1:	B5363DF7613D8016033F6EEBCB33C98F2CB03598
SHA-256:	822015D800FF9A8EB76E60087907344761C19298F1CDFA5AF03A547F7C42B7EE
SHA-512:	A732A8C2388DB3505931E9D91995517FB4962A4A8526314A6419F19B5DBC3132D4AC10DA1AAA83C8A22BF1CCBECA3BE28E915303D59000A3E82C546A4510082D
Malicious:	false
Reputation:	low
URL:	https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/css/proxyweb-all.min.css?cb=1.54.146-6
Preview:	@font-face{font-family:Segoe UI;src:url(https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.eot);src:url(https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.eot?#iefix) format('embedded-opentype'),url(https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2) format('woff2'),url(https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.ttf) format('truetype'),url(https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.svg#web) format('svg');font-weight:400;font-style:normal}@font-face{font-family:Segoe UI;src:url(https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/bold/latest.eot);src:url(https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/bold/latest.eot?#iefix) format('embedded-opentype'),url(https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/bold/latest.woff2) format('woff2'),url(https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/bol

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2399
Entropy (8bit):	7.582093843474393
Encrypted:	false
SSDEEP:	48:o6vn3sQmLJ3Mhahuxc9IsP0QDoftFv6FlmgSv4VpGmHCGD+K6Fe:h3tm3h9IsZo1FAUvQABo
MD5:	8EB07BD506AF4569CB2BD79DBB7BCCEE
SHA1:	A49244132828DAC2293D618F74BE5BC5598B6627
SHA-256:	590AEBABF7ADDB892DE99B9928F2F040AEFDB283C3371DA563411D4EA3AB119A
SHA-512:	9E391CA07F788EBB39C3DB5B93B9F713E7F3F155FB5C79D82997428C44DE8D74FC7D954D8EB67469B0F309D4AEDE79A68230DB5FBDC3D8E8D5FBB45924888E5B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:7C588D13FF6811E78F2784A059709C7F" xmpMM:InstanceID="xmp.iid:7C588D12FF6811E78F2784A059709C7F" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7562995BC2FD11E7A68EBFDE393B0FE9" stRef:documentID="xmp.did:7562995CC2FD11E7A68EBFDE393B0FE9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..~.....IDATx..ZklTU...w..K[ZJ............W..hT....&.F...R...........~..!...h0..........A..R...9...R.iK.>h.....7.sg.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 444227
Category:	downloaded
Size (bytes):	121212
Entropy (8bit):	7.9972852524966695
Encrypted:	true
SSDEEP:	1536:iD6XUiMe8qYwKDImT4zkhRc8JbmxMwGysvrO/Q0wjsFUUXbBHfy18nZIH9JxhmTK:wHHDZT33eAvrn0wjsm8Z0otE
MD5:	0868DA2DD5EFFED92904047439E49D48
SHA1:	D760173E5E6B25461B0D2A0B32D384FE659B2338
SHA-256:	8C41E973CB5EE0194EBF3BAA0716EEEB57EED53552F042E200190E3C37F08CFD
SHA-512:	9F430A42D5380D12C553255A324E347A37337E659D623F50314CF47FE52889FD4120F8DD2895DE3327ED97B65DE4E78C982DA966A3F5253286AB0DE0260817CB
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js
Preview:	...........m{.8....~.......%..J....Te;.3q..wS.<.D;..W..2.......e......X$H. .. .~.i....T........MexZ..\|v}\.....\.o.N...l.....O.?`..;v..U.....?t.x..N.....}'.L.hVI.Xe.G.27M...Ph..R..b.r...k..V.....O..J....~?..0J}.U.......VY...+....P...8J.IZ....'h$Y@z........2....Q...R.P3.....'..'.Q..:.G..\|...2Q....$...."..4..F..}..?.V.n......:@.[.i....O.b.T"..+D..q...9.$.ke.;!.\6...Lc.f,Lu .....?..".3..4..Y.cK.?...K6.T.L..Q.3.T....7...Y.Y.i:O....~.....h......I.u..:.}....r...8.W.1`P9.f....T....%.?..K....4?N.........."t...-..JX..+..O.._....o.;=.?....w...Q=`.4}8H..j...&w.p......F.....d...I.......W....:....[./..~@+5....."...V..wU..)TYe....?5......;........Vk..Jt.^.t.^6Z..:...!..I...j1K.qX..u.S......1.^.V.....Lk.Z..B.....,..z.;..G`..y..T`.tz...[5..q.*...E}K.[.b.&........Z...t..s..RO....m....s.IQ...+...Re....T...ag.0.F...T.}<].<Nt........ ..k..5..X....El_..w..\|..VC=...H$F..~r%..'U..!.k1=.e.)y!`)....Y.c%.....{.Kx.........s...dZ....^:3V..H..\|Sz.1%C..G..a2:v

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 280 x 60, 8-bit/color RGBA, interlaced
Category:	downloaded
Size (bytes):	3874
Entropy (8bit):	7.918823525451331
Encrypted:	false
SSDEEP:	48:f4VsLc7P5sHoK5RLzYzlPIqbYh94YqRASnPfM3Ww68bGDRq1s/QxT7qEMpqdpw04:f4yAP5sr8B5bYjO+68qsj17qEMpoS07c
MD5:	73EB2306878DF8F2080F3DACB61AB1E3
SHA1:	AF94E10FAEBB3D93105C6CF59AF94411CB11DAFD
SHA-256:	7B4DBD3BB6D17F0830940401F46EB3CD5E4A560F9C9878DCBFBC1D7E90065D8A
SHA-512:	3A84705C0750CF2183D374A7147332DCFE749D0732BC82F3DD2EA016595D549B2864EC024664B649DCB53F8FB34522F8A971FA111C57DD5D9A8A320AEE93B881
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauthimages.net/dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/bannerlogo?ts=637617112422502334
Preview:	.PNG........IHDR.......<............tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b`...k.4.......C.we.gXUz..6.X<_..aP...m..B...c...F.q...52w.... ..D....?(..O-k?.H...4t.O.......O....U..g6.._n..A...... .....g..}....O;]r.#6...=./<.l..pt%..eA.......;.~.k..~`.6..3.W.......+A1.@.9.....@..`U)F..6w..X`D.G..~h...Z67......9...{...&..qI.... ...7..E ....... ^.,.......-...E..P.>..f..9.X:....U..@.n.../.?.S.F.yP.?..MF`...}.T...../oy._].K.....B..g..G\|9.............4.F..........C.v..!.i..`i.....H.....P...r$}:Ff..[..H.f=4`.C..=..;........@...\|..~.@#% zX7..j..l.@.J1.HJ...&....,.$..A]..@........a.&...)..@.G...r..>..7E...r....<...r.-.FDvB)?..k..S.JXo\.../...I@\0....5.~....;..,`.......A...0.....L5..3...0j.`..6.R.8...F`4DF......$.Eao4D....@`-.4...li22h..l..E..\...l..!...(".......hq+Z4..._.{../1Z,R...w.{.;x?.=?...`.q.T..7..L.2......m.#.Pn.C...q.G...Eo.'..G..f.bN=......l.o.Z..%.LS./..5..54....>....S.X..t.)..(......m.}...........g.L..@.....R..,&I.-..:V.2.E....}...R...qDj.....9I....

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2399
Entropy (8bit):	7.582093843474393
Encrypted:	false
SSDEEP:	48:o6vn3sQmLJ3Mhahuxc9IsP0QDoftFv6FlmgSv4VpGmHCGD+K6Fe:h3tm3h9IsZo1FAUvQABo
MD5:	8EB07BD506AF4569CB2BD79DBB7BCCEE
SHA1:	A49244132828DAC2293D618F74BE5BC5598B6627
SHA-256:	590AEBABF7ADDB892DE99B9928F2F040AEFDB283C3371DA563411D4EA3AB119A
SHA-512:	9E391CA07F788EBB39C3DB5B93B9F713E7F3F155FB5C79D82997428C44DE8D74FC7D954D8EB67469B0F309D4AEDE79A68230DB5FBDC3D8E8D5FBB45924888E5B
Malicious:	false
Reputation:	low
URL:	https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/images/warning.png
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:7C588D13FF6811E78F2784A059709C7F" xmpMM:InstanceID="xmp.iid:7C588D12FF6811E78F2784A059709C7F" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7562995BC2FD11E7A68EBFDE393B0FE9" stRef:documentID="xmp.did:7562995CC2FD11E7A68EBFDE393B0FE9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..~.....IDATx..ZklTU...w..K[ZJ............W..hT....&.F...R...........~..!...h0..........A..R...9...R.iK.>h.....7.sg.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	7673
Entropy (8bit):	4.5740201842215935
Encrypted:	false
SSDEEP:	192:FhNDLqYgKCKWQtKjXcF7aO7cgulLfvPIfAKayL2W1javtQDjy:rNDL+k8LHYAK5u
MD5:	E79D3B42FC5C5682F3B763982C8DAB68
SHA1:	C8846AF83D6CE75BE41B41C7D701AF2BF59C586F
SHA-256:	EFBD4ECC6D62A8807DB41A859C613B402C7F1092ADA7B5B75D5A795B71CADFB2
SHA-512:	FCE550B1800BEF83F2A0C335A027A6E78139DF81E4D7C86FD310A8D927559649483057BFF38D10CE9EC34748112B98EF7A0272E6C9A2A4E2F5D9739EA6620122
Malicious:	false
Reputation:	low
URL:	https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/translate.js
Preview:	((root, factory) => {. 'use strict';. //If translate is loaded inside an amd environment it will define a module. Otherwise it will create the module from vanilla javascript (exposing to window).. if (typeof define === 'function' && define.amd) {. define(['./proxy-presence/node_modules/handlebars/dist/handlebars.min', './proxy-presence/node_modules/lodash/core.min'], factory);. } else {. root.Translate = factory(root.Handlebars, root._);. }.})(this, (Handlebars, _) => {. 'use strict';. let DEFAULT_LOCALE = 'en-US';. let casActiveLocale = null;. let casTranslations = null;.. let SUPPORTED_LOCALES = [. 'bg-bg',. 'ca-es',. 'cs-CZ',. 'da-dk',. 'de-DE',. 'el-gr',. 'en-US',. 'es-ES',. 'et-ee',. 'eu-es',. 'fi-fi',. 'fr-FR',. 'gl-es',. 'hi-in',. 'hr-hr',. 'hu-HU',. 'id-id',. 'it-IT',. 'ja-jp',. 'kk-kz',. '

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.503258334775644
Encrypted:	false
SSDEEP:	3:Eq62iczBr9ks:EqdiczBys
MD5:	06B313E93DD76909460FBFC0CD98CB6B
SHA1:	C4F9B2BBD840A4328F85F54873C434336A193888
SHA-256:	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
SHA-512:	EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChgKDQ3RW1FSGgQIVhgCIAEKBw1Xevf9GgA=

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 280 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	3874
Entropy (8bit):	7.918823525451331
Encrypted:	false
SSDEEP:	48:f4VsLc7P5sHoK5RLzYzlPIqbYh94YqRASnPfM3Ww68bGDRq1s/QxT7qEMpqdpw04:f4yAP5sr8B5bYjO+68qsj17qEMpoS07c
MD5:	73EB2306878DF8F2080F3DACB61AB1E3
SHA1:	AF94E10FAEBB3D93105C6CF59AF94411CB11DAFD
SHA-256:	7B4DBD3BB6D17F0830940401F46EB3CD5E4A560F9C9878DCBFBC1D7E90065D8A
SHA-512:	3A84705C0750CF2183D374A7147332DCFE749D0732BC82F3DD2EA016595D549B2864EC024664B649DCB53F8FB34522F8A971FA111C57DD5D9A8A320AEE93B881
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......<............tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b`...k.4.......C.we.gXUz..6.X<_..aP...m..B...c...F.q...52w.... ..D....?(..O-k?.H...4t.O.......O....U..g6.._n..A...... .....g..}....O;]r.#6...=./<.l..pt%..eA.......;.~.k..~`.6..3.W.......+A1.@.9.....@..`U)F..6w..X`D.G..~h...Z67......9...{...&..qI.... ...7..E ....... ^.,.......-...E..P.>..f..9.X:....U..@.n.../.?.S.F.yP.?..MF`...}.T...../oy._].K.....B..g..G\|9.............4.F..........C.v..!.i..`i.....H.....P...r$}:Ff..[..H.f=4`.C..=..;........@...\|..~.@#% zX7..j..l.@.J1.HJ...&....,.$..A]..@........a.&...)..@.G...r..>..7E...r....<...r.-.FDvB)?..k..S.JXo\.../...I@\0....5.~....;..,`.......A...0.....L5..3...0j.`..6.R.8...F`4DF......$.Eao4D....@`-.4...li22h..l..E..\...l..!...(".......hq+Z4..._.{../1Z,R...w.{.;x?.=?...`.q.T..7..L.2......m.#.Pn.C...q.G...Eo.'..G..f.bN=......l.o.Z..%.LS./..5..54....>....S.X..t.)..(......m.}...........g.L..@.....R..,&I.-..:V.2.E....}...R...qDj.....9I....

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20577
Entropy (8bit):	5.379538595032803
Encrypted:	false
SSDEEP:	384:W2tleEgHiS7wZpri6g56rVnoHqHN4gWSyuhuWa9qd2zaK9Wbsd:W9rzr6rdomCkyuhja9qd2zaK9Wbsd
MD5:	1B38CA46B5416C0AE3DE8BD225AC5772
SHA1:	7DADBDE6289231BD492B47D3E97055D6BF1D7341
SHA-256:	4C6DC5401FE6C5E2C64F0E7D60045EC97D287AABD47C7FD9E6A86E2DC4C4A040
SHA-512:	DE1E9644001A653495E28F8131048AAF8F385079E41DC02CB49302C379FFEB6D82224717A7AE9E2EF7A0DC626C887E12739D5C3646EEFF7F2D33B1FD86B27026
Malicious:	false
Reputation:	low
Preview:	{. "PROXYWEB_ACTION_BLOCKED_DESCRIPTION": "This action is blocked by your organization's security policy.",. "PROXYWEB_ACTION_BLOCKED_PAGETITLE": "Action blocked",. "PROXYWEB_ACTION_BLOCKED_RETURN_TO_SESSION": "Go back",. "PROXYWEB_ADMIN_VIEW_BYPASS_EXPERIENCE": "Bypass experience",. "PROXYWEB_ADMIN_VIEW_BYPASS_PROXY": "Bypass",. "PROXYWEB_ADMIN_VIEW_DISMISS_CANCEL": "Cancel",. "PROXYWEB_ADMIN_VIEW_DISMISS_DESCRIPTION": "You will not be able to provide feedback for the remainder of this session.",. "PROXYWEB_ADMIN_VIEW_DISMISS_REMOVE": "Disable",. "PROXYWEB_ADMIN_VIEW_DISMISS_TITLE": "Temporarily disable feedback view?",. "PROXYWEB_ADMIN_VIEW_DOMAINS_MANAGEMENT": "Discovered domains",. "PROXYWEB_ADMIN_VIEW_END_FEATURES_PREVIEW": "End Test Mode",. "PROXYWEB_ADMIN_VIEW_END_PREVIEW": "End Preview",. "PROXYWEB_ADMIN_VIEW_FEATURES_PREVIEW": "Test Mode",. "PROXYWEB_ADMIN_VIEW_PREVIEW": "Preview",. "PROXYWEB_ADMIN_VIEW_PRIVACY_STATEMENT": "Privacy statement",. "PROXYWEB_ADMIN_

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 223759
Category:	downloaded
Size (bytes):	54325
Entropy (8bit):	7.996017457525811
Encrypted:	true
SSDEEP:	768:MBOXdNQNgHZp9Ga0EqoitKVFF9dMVtakANyFeDpz3ZSgaDpk4JGUISrX+pk7RU/P:bDQNg5pFneONYu9ZpfUv7+m7aITS2Du
MD5:	799F880143F17E47C4EFDBB3FF35A54C
SHA1:	8CECC74EB422322F78EDE1111F175A28725CCA9F
SHA-256:	EA70CC2977F4DEB5236041A7A0628FA671FB8AD20A5E9E3FD6885A11359EF2FE
SHA-512:	46E811AA3D03023596B47DB39B6FABCC1A4B7388C7F0A187A4C23B024695593702A70227F5B770174A258A265A48D4F87EF01281210229E51022E9BC6948214B
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js
Preview:	...........k{.F.0.}...gF.L."..eR..v.y.O....g...............~...@....f<...F./...u...;............x.y.C...y...sx.....^=}.....N.W.I.Y$.....".w....$..\|..a...+.7O.eg.gW..2...8..2)J..<^f.:.4..;....<}.....ZK.......5..,;iV&Q...9......;U:....$....DyVd....Q...N......N..".;.,//.8...X..ZP7......&shpA...a.I.C\U0i.&K..}m..1..9.N.u....^.'I/:......r...a^Ee.f..oq..e'..y..U..;...T(...<L..;X.."..8-}.^L.._w.....f.w..V.x.kK..K../.A..[....oE....G..ao0...\........Qv.7..eX..70.....\|.s.}.#...:..t...$.}=....s..g.}Q..........SO.....p.%..v..\|.Fo.. ..,e.......=;;..7....J#......{7o....;.........<..?.....G._..}..(..k?....2.......J.E.z.^.O.....}...XWe.....O...,C...+......O.r..he.............$Y.;..?).y....&.$..u..m.~.Z...2./..\|9..(.m....W.8.?QO}.....]....Y..z..=..2........>..8...87.&..ajn.m.E.,.<...n.t..`......\|..s7..v.w.z....d{...m.^..Y..AA...,C^...:0.~A.]....,...........6xR..8.p,./?..~v.+../c..Z...$.....Ysg....U....H....._q....o..acC...fpv.fb.....\|.?.-V

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32031)
Category:	downloaded
Size (bytes):	88426
Entropy (8bit):	5.555956698485644
Encrypted:	false
SSDEEP:	768:Y816Ge+J4C9z9FiMwvqO4iqWog2dvOBoiWV/xo6hSrdv4UZ3I0mN5ptoCRMeEiAW:Yu6ot9h1WojaMVZSr4tvMiA+78q
MD5:	23A22FFCC70E2746BEADCC16682C2389
SHA1:	146D1FA623A731ACC8B53F07FF0A931BB4FA1213
SHA-256:	0E5416F145E7BF16C58504356C732FE7E99671F4696194C5B140A252DB02F0AF
SHA-512:	13575217183EC2C7C9E072A3BAD93F59A0B32BB4B6C2FD4F3A7D5144F1A1F192BE6A0F65DB8E15AB18E2DEBEB0833F5805FEBEBE14046096694A3A9614F83D82
Malicious:	false
Reputation:	low
URL:	https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/handlebars.min.js
Preview:	/**!.. @license. handlebars v4.7.8..Copyright (C) 2011-2019 by Yehuda Katz..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARI

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	299928
Entropy (8bit):	7.922599738148114
Encrypted:	false
SSDEEP:	6144:EH85OPQF9a51owtAUHXcXDuCMiYQ3cBV9UChc514qoe2WGw6R89Q2W:Ecn+5GUHXcOiY47514JpbS9C
MD5:	29896A71F2D8AB4CC95976D0381DB960
SHA1:	5F82D5332C64800870CD70A4DBB9C0EEEC8A208F
SHA-256:	33F0607D7365E8663BF0580805E1EF9CFC8059C98AFF8050346C0BA35967DC27
SHA-512:	30D8418628058522A31BDB5061D3A2108BC0BB645226FA7213CC3CDFDF3B0B4D27F216AF9EEB14673DBCF16ECCAEC3A041665BFD6B4ED0BB4404CC09CF23EC14
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......<.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:92DF1CE2C8C4E511BBB5E20D8624F9AC" xmpMM:DocumentID="xmp.did:005C29541E3911E88F9F8B0304A35DBD" xmpMM:InstanceID="xmp.iid:005C29531E3911E88F9F8B0304A35DBD" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:40AC92E91E1811E88F9F8B0304A35DBD" stRef:documentID="xmp.did:40AC92EA1E1811E88F9F8B0304A35DBD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sR

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	299928
Entropy (8bit):	7.922599738148114
Encrypted:	false
SSDEEP:	6144:EH85OPQF9a51owtAUHXcXDuCMiYQ3cBV9UChc514qoe2WGw6R89Q2W:Ecn+5GUHXcOiY47514JpbS9C
MD5:	29896A71F2D8AB4CC95976D0381DB960
SHA1:	5F82D5332C64800870CD70A4DBB9C0EEEC8A208F
SHA-256:	33F0607D7365E8663BF0580805E1EF9CFC8059C98AFF8050346C0BA35967DC27
SHA-512:	30D8418628058522A31BDB5061D3A2108BC0BB645226FA7213CC3CDFDF3B0B4D27F216AF9EEB14673DBCF16ECCAEC3A041665BFD6B4ED0BB4404CC09CF23EC14
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauthimages.net/dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/illustration?ts=636565365803385104
Preview:	......Exif..II*.................Ducky.......<.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:92DF1CE2C8C4E511BBB5E20D8624F9AC" xmpMM:DocumentID="xmp.did:005C29541E3911E88F9F8B0304A35DBD" xmpMM:InstanceID="xmp.iid:005C29531E3911E88F9F8B0304A35DBD" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:40AC92E91E1811E88F9F8B0304A35DBD" stRef:documentID="xmp.did:40AC92EA1E1811E88F9F8B0304A35DBD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sR

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34052, version 0.0
Category:	downloaded
Size (bytes):	34052
Entropy (8bit):	7.994131533337155
Encrypted:	true
SSDEEP:	768:WHH8jjaseVFXnmQ8njOkV5c4d7DOgx1J89JzHNBbFOlsy0kQ6lhe:kH8jj3uWxKe5c4xz69hNalP0kQ6lhe
MD5:	36397A3BC139C6E9F81D383F060F080A
SHA1:	3F4F86C10920D4ED345F4858B6CDE9F93E1AEB81
SHA-256:	4F7F4AFE26E71FA9CA1DAC4A43B557A554A46F53251D849F07ED08A04829D74B
SHA-512:	7FFF4870E9142E6E1921F8DD78E3B049547EC1D540EFE573C2938F8B855DB61BA908FA9D3C8DA1BB2AAE6D95217A586D256B9EA2BD8A8F706B1DB75BC21F2CB9
Malicious:	false
Reputation:	low
URL:	https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
Preview:	wOF2.............................................`....."..\.....D..D.6.$........ .. . ..@.S.5x.q..m.5.7Q..2......6..R....v.j.......".c..@.Z.B..G.Y.\S.AtT.iTJt.....l.>..=+z...1.pP..[.+.S..`...c.1.u1...)......`............9.8.......+..4...;..[W.v..p0..qg..=..+...1...\|R..qM..\|/...%..!C.....G:.;7...Z..^P...o..q.B'....a....M.l3k....=&.'.'..8.....K..k........}.?w.i[..q.,...,.0,.....?...o.y..@..U5.:T..E..B..%......YU.....Z..4T..5....m/..,.$.w..`O.s.c.{...;a;..T...9../.......,....BDf.S).ola._e../..z%.:....r..d;.t.....7....jI!-.....{..l.T..H%8.p.*=!.z8.7.k..L...WUW...0.0.....7Q.0.J..Q.\|~P..'Q... m.a..(..p..q...B.:.....e.B...g..<O(..z..o.G...U.x.Tw...^t.._.t..}....q....*K....".UP...Te...<.....f.....{.....I..V...p.+...-<..%.+..?M.A!.ob.9p...7..B. ..R....."4..%M.6..'...!.S.........?.`w.....l@..R.AJ&@..h/H{.(n..I.8..6.4 ..i{..5.I....l...rJ.....N{.^..6..^.V.&..)?Bc.&.u.......fd.H..X.5Fq(c....6...w(O..K...F.......ohh.....Gk...l.2q.t.h..........U9%.n....%...

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	20577
Entropy (8bit):	5.379538595032803
Encrypted:	false
SSDEEP:	384:W2tleEgHiS7wZpri6g56rVnoHqHN4gWSyuhuWa9qd2zaK9Wbsd:W9rzr6rdomCkyuhja9qd2zaK9Wbsd
MD5:	1B38CA46B5416C0AE3DE8BD225AC5772
SHA1:	7DADBDE6289231BD492B47D3E97055D6BF1D7341
SHA-256:	4C6DC5401FE6C5E2C64F0E7D60045EC97D287AABD47C7FD9E6A86E2DC4C4A040
SHA-512:	DE1E9644001A653495E28F8131048AAF8F385079E41DC02CB49302C379FFEB6D82224717A7AE9E2EF7A0DC626C887E12739D5C3646EEFF7F2D33B1FD86B27026
Malicious:	false
Reputation:	low
URL:	https://mcasproxy.cdn.mcas.ms/i18n/0.274.5/proxyweb/en_us.json
Preview:	{. "PROXYWEB_ACTION_BLOCKED_DESCRIPTION": "This action is blocked by your organization's security policy.",. "PROXYWEB_ACTION_BLOCKED_PAGETITLE": "Action blocked",. "PROXYWEB_ACTION_BLOCKED_RETURN_TO_SESSION": "Go back",. "PROXYWEB_ADMIN_VIEW_BYPASS_EXPERIENCE": "Bypass experience",. "PROXYWEB_ADMIN_VIEW_BYPASS_PROXY": "Bypass",. "PROXYWEB_ADMIN_VIEW_DISMISS_CANCEL": "Cancel",. "PROXYWEB_ADMIN_VIEW_DISMISS_DESCRIPTION": "You will not be able to provide feedback for the remainder of this session.",. "PROXYWEB_ADMIN_VIEW_DISMISS_REMOVE": "Disable",. "PROXYWEB_ADMIN_VIEW_DISMISS_TITLE": "Temporarily disable feedback view?",. "PROXYWEB_ADMIN_VIEW_DOMAINS_MANAGEMENT": "Discovered domains",. "PROXYWEB_ADMIN_VIEW_END_FEATURES_PREVIEW": "End Test Mode",. "PROXYWEB_ADMIN_VIEW_END_PREVIEW": "End Preview",. "PROXYWEB_ADMIN_VIEW_FEATURES_PREVIEW": "Test Mode",. "PROXYWEB_ADMIN_VIEW_PREVIEW": "Preview",. "PROXYWEB_ADMIN_VIEW_PRIVACY_STATEMENT": "Privacy statement",. "PROXYWEB_ADMIN_

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1482)
Category:	downloaded
Size (bytes):	10710
Entropy (8bit):	4.850433361836286
Encrypted:	false
SSDEEP:	96:fYjZYx03xCcwK13oFY2a9l4R03xCcwK1E3hDvMeRMykPLLOjYnN3mXD8fghdn+jj:YExKVlExKY8IhCj
MD5:	5C3EB2F22B0FAA0DE97830425054A081
SHA1:	8F3D0A40E1235B823171BE7EED9E1B0D4FBC56CA
SHA-256:	ABF0F186A9CCBACCF9AF905894E5A323B20B0808961403549903F637A7708686
SHA-512:	7AF310C86D5010B4BA28F7A218E44AD41E6DFE2AF6A05FE2380A6EC235279A319BAD9FD81BEBB7B8F2717BF21C48185276B0A9CE688ADD0517BDC6270EC47D47
Malicious:	false
Reputation:	low
URL:	https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/js/Handlebars/locale-data/en.js
Preview:	HandlebarsIntl.__addLocaleData({"locale":"en","pluralRuleFunction":function (n,ord){var s=String(n).split("."),v0=!s[1],t0=Number(s[0])==n,n10=t0&&s[0].slice(-1),n100=t0&&s[0].slice(-2);if(ord)return n10==1&&n100!=11?"one":n10==2&&n100!=12?"two":n10==3&&n100!=13?"few":"other";return n==1&&v0?"one":"other"},"fields":{"year":{"displayName":"Year","relative":{"0":"this year","1":"next year","-1":"last year"},"relativeTime":{"future":{"one":"in {0} year","other":"in {0} years"},"past":{"one":"{0} year ago","other":"{0} years ago"}}},"month":{"displayName":"Month","relative":{"0":"this month","1":"next month","-1":"last month"},"relativeTime":{"future":{"one":"in {0} month","other":"in {0} months"},"past":{"one":"{0} month ago","other":"{0} months ago"}}},"day":{"displayName":"Day","relative":{"0":"today","1":"tomorrow","-1":"yesterday"},"relativeTime":{"future":{"one":"in {0} day","other":"in {0} days"},"past":{"one":"{0} day ago","other":"{0} days ago"}}},"hour":{"displayName":"Hour","rel

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/images/favicon.ico?cb=1.54.146-6
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 62 x 62, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2769
Entropy (8bit):	7.906511905665657
Encrypted:	false
SSDEEP:	48:hk8aW7YtUhLzkvHc9K3eMiyvWsP6h8AGJessDJHYwUnyCZumfng+wk:xWfreM3WsPNJesOYwfC7PRwk
MD5:	CD42E93E9D1FD611E162BA4F564C4D2D
SHA1:	8F3218E707BEE17BE7D811622ACDBC537A9BB66E
SHA-256:	8B0175905D6E243143D465E9BD664FE9C9C16BFBDC75BC7B11EE3F8CBB3ABD42
SHA-512:	1C4B11201D5B0239419A32168F271009F39E16047DB63115C65F177CE2B15F1D07388214782B0FFCF3747D06451D51E29A9F4C819D4FBED0404583E725C07F28
Malicious:	false
Reputation:	low
URL:	https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/images/continue.png
Preview:	.PNG........IHDR...>...>.....s..D....sBIT....\|.d.....pHYs.........C......tEXtSoftware.www.inkscape.org..<....NIDATh..{pT...?.K^..JvC....+"....h.je.jU...c...Fi;.u:..VEAHb...A%j..v.....T... ...I.ACBr......7..nrW...{......ws~.w~g.<..q......p.Q`<P.......;A.A?..O...]..o.m.\|.&~.,ol;...U.?Q8.0C4e....?PY...}...........[......+....COS).p...xL.....T~C.+.m`#........0d....3l.....v .).zE6.boB.-A.wn;`...0.e. .N...b.}U.m.-[=..s&.y.....?...0.K.&....77_?.3.Ibj"....6.+z-..&..EE={....c.r."'..['.c?7..R..D..b.......^.....T..S[..%.fM\|\|C.G64..Nce...yKU..l......3lK.@...].\.\.z=.[Y..X..%....G{...zx.}.+'.....*.........U...6..`f.%.m.~..,..n.x;0B....M...."..`.2`..%.......?`rQ..\|Uy..i.]R....4@....`Q...S.G....6$..h\|...x..X....Z:G.!^........I....FDop.]"..\..nXZ.-k%.I..G.5._...P.hc.C....`Q..t.i.W]....V.%....\|t.?.hsU.."x..=..K7....E.3..=.......4.w:.h.%?.6x..T.x..^u7.&..C.G.....\3....u..-......#..&u.h..H[.z......w..VW....s..N....q....i.._{.\|.......A.....#.L._..`.....

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 05:11:59.334201097 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 05:12:10.086797953 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.086879015 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.086957932 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.087093115 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.087131977 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.087189913 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.087301970 CEST	49741	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.087327957 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.087378979 CEST	49741	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.087568998 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.087598085 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.087641001 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.087852001 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.087879896 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.088028908 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.088043928 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.088205099 CEST	49741	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.088217020 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.088397026 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.088413000 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.552794933 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.553479910 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.553751945 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.553989887 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.560508013 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.560532093 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.560625076 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.560653925 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.561026096 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.561053038 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.561645985 CEST	49741	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.561659098 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.562138081 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.562175035 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.562201023 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.562243938 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.562580109 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.562644005 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.563199043 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.563266039 CEST	49741	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.567781925 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.568068981 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.570099115 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.570395947 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.571872950 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.571881056 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.572045088 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.572062016 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.573421955 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.573748112 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.574235916 CEST	49741	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.574583054 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.574779987 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.574816942 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.574985981 CEST	49741	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.574995041 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.613766909 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.613939047 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.615401983 CEST	49741	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.615427971 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.884691954 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.884768009 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.884798050 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.884835958 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.884850979 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.884907007 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.884968042 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.884968042 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.884990931 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.885086060 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.885138988 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.892065048 CEST	49739	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.892090082 CEST	443	49739	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.990537882 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.990592003 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.990611076 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.990647078 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.990652084 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.990677118 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.990683079 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.990700006 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.990700960 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.990719080 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.990740061 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.990921974 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.990972042 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.990986109 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.990998030 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.991014957 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.991193056 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.991235971 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.991278887 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.991334915 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.991355896 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.991391897 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.991405010 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.991435051 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.991452932 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.991466045 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.991491079 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.991506100 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.991985083 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.992028952 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.992063046 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.992072105 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:10.992108107 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:10.992116928 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.002132893 CEST	49742	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.002149105 CEST	443	49742	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.140064001 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.140137911 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.140147924 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.140182018 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.140207052 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.140218973 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.140818119 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.140866041 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.140883923 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.140894890 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.140918016 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.140948057 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.141596079 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.141654968 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.141670942 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.141679049 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.141705990 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.141722918 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.179119110 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.179198980 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.179209948 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.179302931 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.179349899 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.180450916 CEST	49740	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.180468082 CEST	443	49740	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.923605919 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.923675060 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.923696995 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.923783064 CEST	49741	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.923783064 CEST	49741	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.923799992 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.923886061 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.924113035 CEST	49741	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.925090075 CEST	49741	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.925105095 CEST	443	49741	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.968029022 CEST	49743	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:12:11.968118906 CEST	443	49743	192.178.50.36	192.168.2.4
Apr 26, 2024 05:12:11.968403101 CEST	49743	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:12:11.969918013 CEST	49743	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:12:11.969954014 CEST	443	49743	192.178.50.36	192.168.2.4
Apr 26, 2024 05:12:11.976870060 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.976892948 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:11.977099895 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.982800961 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:11.982829094 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.351242065 CEST	443	49743	192.178.50.36	192.168.2.4
Apr 26, 2024 05:12:12.353163958 CEST	49743	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:12:12.353210926 CEST	443	49743	192.178.50.36	192.168.2.4
Apr 26, 2024 05:12:12.354752064 CEST	443	49743	192.178.50.36	192.168.2.4
Apr 26, 2024 05:12:12.355022907 CEST	49743	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:12:12.363771915 CEST	49743	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:12:12.364025116 CEST	443	49743	192.178.50.36	192.168.2.4
Apr 26, 2024 05:12:12.408927917 CEST	49743	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:12:12.408950090 CEST	443	49743	192.178.50.36	192.168.2.4
Apr 26, 2024 05:12:12.441927910 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.442363024 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.442384958 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.443876982 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.445398092 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.445494890 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.445651054 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.457191944 CEST	49743	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:12:12.492127895 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.557226896 CEST	49745	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:12.557271957 CEST	443	49745	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:12.561619997 CEST	49745	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:12.564152956 CEST	49745	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:12.564167023 CEST	443	49745	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:12.887470961 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.887531996 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.887576103 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.887610912 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.887662888 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.887713909 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.887738943 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.887984991 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.888045073 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.888057947 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.888075113 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.888120890 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.888190985 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.888242960 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.890224934 CEST	49744	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.890254974 CEST	443	49744	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.897723913 CEST	443	49745	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:12.897787094 CEST	49745	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:12.939601898 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.939651966 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.939743042 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.940155983 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.940171003 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.940700054 CEST	49747	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.940740108 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.940797091 CEST	49747	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.941054106 CEST	49747	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:12.941070080 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:12.950242043 CEST	49745	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:12.950263977 CEST	443	49745	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:12.950839996 CEST	443	49745	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.005192995 CEST	49745	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.027587891 CEST	49745	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.068164110 CEST	443	49745	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.215081930 CEST	443	49745	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.215158939 CEST	443	49745	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.215209007 CEST	49745	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.215467930 CEST	49745	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.215483904 CEST	443	49745	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.248718977 CEST	49748	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.248754025 CEST	443	49748	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.248866081 CEST	49748	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.249283075 CEST	49748	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.249294996 CEST	443	49748	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.394696951 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.395101070 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.398283958 CEST	49747	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.398305893 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.398612976 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.398624897 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.398920059 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.400039911 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.400054932 CEST	49747	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.400124073 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.400172949 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.402719975 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.402960062 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.403382063 CEST	49747	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.404124022 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.404129982 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.444153070 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.444597960 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.575233936 CEST	443	49748	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.575313091 CEST	49748	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.692173958 CEST	49748	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.692190886 CEST	443	49748	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.692502975 CEST	443	49748	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.696244955 CEST	49748	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.740139008 CEST	443	49748	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.849901915 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.849960089 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.849980116 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.850020885 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.850056887 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.850056887 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.850092888 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.850140095 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.850153923 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.850157976 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.850178003 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.850214958 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.850214958 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.850223064 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.850275993 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.850289106 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.850342989 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.850421906 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.883090973 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.883151054 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.883196115 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.883224010 CEST	49747	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.883249044 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.883269072 CEST	49747	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.883295059 CEST	49747	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.883295059 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.883326054 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.883373976 CEST	49747	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.883380890 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.883491993 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.883688927 CEST	49747	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.894798994 CEST	443	49748	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.894864082 CEST	443	49748	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.894942045 CEST	49748	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.946827888 CEST	49748	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.946827888 CEST	49748	443	192.168.2.4	23.197.97.241
Apr 26, 2024 05:12:13.946846962 CEST	443	49748	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.946857929 CEST	443	49748	23.197.97.241	192.168.2.4
Apr 26, 2024 05:12:13.953003883 CEST	49746	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.953010082 CEST	443	49746	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.959544897 CEST	49747	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.959568977 CEST	443	49747	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.965075016 CEST	49749	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.965156078 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:13.965250969 CEST	49749	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.965859890 CEST	49749	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:13.965895891 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.424401999 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.424839020 CEST	49749	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.424920082 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.426358938 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.427510977 CEST	49749	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.428013086 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.428138971 CEST	49749	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.455208063 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.455286980 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.455367088 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.455718994 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.455765963 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.455821037 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.456734896 CEST	49752	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.456760883 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.456845045 CEST	49752	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.457405090 CEST	49752	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.457420111 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.458055019 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.458072901 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.458481073 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.458558083 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.472157955 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.473587036 CEST	49749	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.764899015 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.765007973 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.765029907 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.765089989 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.765095949 CEST	49749	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.765162945 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.765203953 CEST	49749	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.765203953 CEST	49749	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.765230894 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.765322924 CEST	49749	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.765892982 CEST	49749	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.765922070 CEST	443	49749	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.907155037 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.907428980 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.907486916 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.908494949 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.908550024 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.909105062 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.909178972 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.909209967 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.916249990 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.916410923 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.916441917 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.916465044 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.916542053 CEST	49752	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.916552067 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.917892933 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.917947054 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.918198109 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.918210030 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.918267965 CEST	49752	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.918279886 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.918313980 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.918607950 CEST	49752	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.918694973 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.957973957 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.957986116 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.957993984 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.958050013 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.967144966 CEST	49752	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.967154980 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.978152037 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.978193998 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.978252888 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.979643106 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:14.979656935 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:14.997721910 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.006154060 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.007348061 CEST	49752	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.022898912 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.022977114 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.023070097 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.024802923 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.024837017 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.350472927 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.350497007 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.350502968 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.350569010 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.350616932 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.350642920 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.350819111 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.350857973 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.350881100 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.350923061 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.350939989 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.361270905 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.361329079 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.361349106 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.361390114 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.361406088 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.361430883 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.361444950 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.361444950 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.361450911 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.361473083 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.361502886 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.361512899 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.361529112 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.361588001 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.361725092 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.361773014 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.436228991 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.462763071 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.462779045 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.464131117 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.464762926 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.464972973 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.465152979 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.465857029 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.465873003 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.467273951 CEST	49750	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.467330933 CEST	443	49750	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.481967926 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.482530117 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.482573986 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.483709097 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.484040976 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.484205008 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.484253883 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.508157015 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.536391020 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.732356071 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.732412100 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.732506037 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.732527018 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.732553959 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.732609987 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.770925045 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.770941973 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.777786016 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.777846098 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.777981997 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.778064013 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.794070005 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.794105053 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.801794052 CEST	49752	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.805913925 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.805990934 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.806071043 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.806348085 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.806400061 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.844110966 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.952389956 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.952464104 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.952596903 CEST	49752	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:15.952608109 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.952640057 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:15.952846050 CEST	49752	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:16.169684887 CEST	49752	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:16.169707060 CEST	443	49752	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:16.263144016 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:16.263550043 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:16.263641119 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:16.265252113 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:16.266132116 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:16.266261101 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:16.266416073 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:16.308157921 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:16.318447113 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:16.559437990 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:16.559518099 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:16.559601068 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:16.559659004 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:16.559699059 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:16.559758902 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:16.561667919 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:16.561697960 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:22.328522921 CEST	443	49743	192.178.50.36	192.168.2.4
Apr 26, 2024 05:12:22.328680992 CEST	443	49743	192.178.50.36	192.168.2.4
Apr 26, 2024 05:12:22.331124067 CEST	49743	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:12:22.438749075 CEST	49758	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:22.438833952 CEST	443	49758	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:22.439136982 CEST	49743	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:12:22.439141035 CEST	49758	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:22.439165115 CEST	443	49743	192.178.50.36	192.168.2.4
Apr 26, 2024 05:12:22.439882040 CEST	49759	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:22.439918041 CEST	443	49759	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:22.440164089 CEST	49759	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:22.440601110 CEST	49759	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:22.440613031 CEST	443	49759	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:22.440684080 CEST	49758	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:22.440758944 CEST	443	49758	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:23.380009890 CEST	443	49759	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:23.382895947 CEST	49759	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:23.382916927 CEST	443	49759	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:23.384174109 CEST	443	49758	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:23.384366989 CEST	443	49759	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:23.384427071 CEST	49759	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:23.384860039 CEST	49758	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:23.384939909 CEST	443	49758	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:23.386531115 CEST	443	49758	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:23.386718035 CEST	49758	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:23.389805079 CEST	49759	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:23.389954090 CEST	443	49759	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:23.390476942 CEST	49759	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:23.390484095 CEST	443	49759	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:23.391176939 CEST	49758	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:23.391510963 CEST	443	49758	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:23.441777945 CEST	49758	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:23.441804886 CEST	443	49758	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:23.442065954 CEST	49759	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:23.487377882 CEST	49758	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:24.300452948 CEST	443	49759	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:24.300587893 CEST	443	49759	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:24.304840088 CEST	49759	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:24.362958908 CEST	49759	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:12:24.362979889 CEST	443	49759	104.47.110.28	192.168.2.4
Apr 26, 2024 05:12:29.720155001 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:29.720185995 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:29.720262051 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:29.720470905 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:29.720475912 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.183768034 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.184055090 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.184118986 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.185655117 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.185730934 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.186738968 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.186826944 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.187016964 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.187024117 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.239073038 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.481178999 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.481839895 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.481869936 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.481918097 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.481935978 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.481949091 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.481957912 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.481987953 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.481992006 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.481998920 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.482033968 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.482039928 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.482075930 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.483243942 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.483295918 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.483319044 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.483325958 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.483376026 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.630312920 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.630382061 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.630409002 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.630428076 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.630449057 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.630464077 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.631536961 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.631593943 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.631614923 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.631639957 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.631659031 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.631776094 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.633230925 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.633275986 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.633299112 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.633306026 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.633332968 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.633348942 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.633380890 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.679527044 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.700604916 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.700670004 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.700711966 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.700726032 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.700754881 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.700902939 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.781474113 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.781541109 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.781584024 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.781600952 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.781615019 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.781671047 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.782931089 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.782974005 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.783010006 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.783015966 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.783041954 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.783699989 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.784415960 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.784507036 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.784543037 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.784550905 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.784679890 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.784713984 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.784807920 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.785121918 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.785139084 CEST	443	49768	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:30.785160065 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:30.785301924 CEST	49768	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:31.029375076 CEST	49772	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:31.029453039 CEST	443	49772	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:31.029617071 CEST	49772	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:31.029710054 CEST	49772	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:31.029732943 CEST	443	49772	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:31.482075930 CEST	443	49772	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:31.482356071 CEST	49772	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:31.482413054 CEST	443	49772	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:31.483861923 CEST	443	49772	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:31.483984947 CEST	49772	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:31.484324932 CEST	49772	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:31.484406948 CEST	443	49772	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:31.541088104 CEST	49772	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:31.541146040 CEST	443	49772	152.199.4.44	192.168.2.4
Apr 26, 2024 05:12:31.591248035 CEST	49772	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:12:32.025810003 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.025846004 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.026139021 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.026437998 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.026456118 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.265770912 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.265809059 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.265993118 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.269772053 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.269798994 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.269859076 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.275696993 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.275717020 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.276257038 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.276269913 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.491529942 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.491905928 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.491921902 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.493550062 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.493616104 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.494837046 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.494921923 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.494997025 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.495003939 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.538134098 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.723885059 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.724232912 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.724252939 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.725270987 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.725354910 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.725863934 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.725863934 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.725876093 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.725920916 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.729039907 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.729264021 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.729274988 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.733150005 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.733233929 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.733541012 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.733659029 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.733664036 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.733725071 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.774735928 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.774736881 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.774744987 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.774745941 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.821289062 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.821290970 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.933046103 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.933078051 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.933089018 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.933109999 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.933140993 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.933233023 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.933233023 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.933259010 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.933321953 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.933420897 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.933492899 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:32.933522940 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.934880018 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.940113068 CEST	49776	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:32.940131903 CEST	443	49776	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.170927048 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.170947075 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.170954943 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.170989037 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.171003103 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.171016932 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.171025991 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.171041012 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.171065092 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.171065092 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.171159983 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.171268940 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.171282053 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.171391010 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.171396017 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.171531916 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.174834013 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.174864054 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.174876928 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.174891949 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.174911976 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.174912930 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.174933910 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.174947977 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.174978018 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.174978018 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.175080061 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.175120115 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.175338030 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.177083015 CEST	49778	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.177102089 CEST	443	49778	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.318537951 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.318557024 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.318628073 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.318649054 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.318802118 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.319186926 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.319200039 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.319533110 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.319538116 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.319685936 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.319736004 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.319749117 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.319888115 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.319891930 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.319972992 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.466949940 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.466973066 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.467066050 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.467066050 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.467082977 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.467156887 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.467701912 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.467717886 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.468002081 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.468008041 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.468112946 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.468137026 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.468141079 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.468164921 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.468195915 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.468208075 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.468286991 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.469005108 CEST	49777	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.469017982 CEST	443	49777	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.481085062 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.481156111 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.481262922 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.481978893 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.482011080 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.929176092 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.955446005 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.955492020 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.956835985 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.956921101 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.957474947 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.957551956 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:33.958488941 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:33.958506107 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.006371021 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.371340990 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.371362925 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.371370077 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.371404886 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.371424913 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.371434927 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.371443033 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.371500015 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.371546984 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.371572971 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.372657061 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.372672081 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.372714996 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.372735977 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.372760057 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.374823093 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.519937038 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.519958973 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.520045042 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.520124912 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.520170927 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.520893097 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.520925999 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.520968914 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.520971060 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.521034002 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.521034002 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.541877985 CEST	49781	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.541937113 CEST	443	49781	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.598414898 CEST	49782	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.598494053 CEST	443	49782	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.598582029 CEST	49782	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.602231979 CEST	49782	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.602267981 CEST	443	49782	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.637819052 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.637861013 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:34.637917042 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.638410091 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:34.638426065 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.056931973 CEST	443	49782	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.057225943 CEST	49782	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.057286978 CEST	443	49782	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.057637930 CEST	443	49782	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.058024883 CEST	49782	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.058100939 CEST	443	49782	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.058208942 CEST	49782	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.090137005 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.090373039 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.090389013 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.091053009 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.091502905 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.091590881 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.091653109 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.100147963 CEST	443	49782	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.136111975 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.146228075 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.502757072 CEST	443	49782	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.502777100 CEST	443	49782	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.502815008 CEST	443	49782	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.502994061 CEST	49782	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.502995014 CEST	49782	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.503062010 CEST	443	49782	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.503127098 CEST	49782	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.504178047 CEST	49782	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.504239082 CEST	443	49782	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.539339066 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.539412975 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.539436102 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.539458036 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.539467096 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.539482117 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.539501905 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.539510012 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.539539099 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.539563894 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.539572954 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.539587975 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.539758921 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.539809942 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.539825916 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.539844990 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.539877892 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.590931892 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.657869101 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:35.657908916 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:35.657989025 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:35.658236027 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:35.658250093 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:35.686199903 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.686218023 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.686269045 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.686295986 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.686306953 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.686348915 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.686369896 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.686398029 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.686870098 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.690807104 CEST	49783	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.690821886 CEST	443	49783	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.722296953 CEST	49785	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.722320080 CEST	443	49785	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.722470999 CEST	49785	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.722933054 CEST	49785	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.722945929 CEST	443	49785	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.745481014 CEST	49786	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.745529890 CEST	443	49786	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.745667934 CEST	49786	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.746376991 CEST	49786	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.746393919 CEST	443	49786	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.747946024 CEST	49787	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.747982025 CEST	443	49787	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:35.751094103 CEST	49787	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.755928993 CEST	49787	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:35.755940914 CEST	443	49787	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.106734991 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.107184887 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.107203007 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.111057997 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.111217022 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.111892939 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.111892939 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.112067938 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.161923885 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.161933899 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.179012060 CEST	443	49785	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.180259943 CEST	49785	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.180269003 CEST	443	49785	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.181600094 CEST	443	49785	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.183546066 CEST	49785	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.183831930 CEST	49785	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.183846951 CEST	443	49785	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.203552961 CEST	443	49787	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.203913927 CEST	49787	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.203948975 CEST	443	49787	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.205029964 CEST	443	49787	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.205158949 CEST	49787	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.205734968 CEST	49787	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.205827951 CEST	443	49787	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.205979109 CEST	49787	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.207391977 CEST	443	49786	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.209495068 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.214807987 CEST	49786	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.214824915 CEST	443	49786	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.215116978 CEST	443	49786	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.215953112 CEST	49786	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.215953112 CEST	49786	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.215969086 CEST	443	49786	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.216177940 CEST	443	49786	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.224116087 CEST	443	49785	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.225111961 CEST	49785	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.248121977 CEST	443	49787	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.256036043 CEST	49786	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.256045103 CEST	49787	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.256068945 CEST	443	49787	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.301424980 CEST	49787	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.480319977 CEST	443	49785	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.480384111 CEST	443	49785	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.480521917 CEST	443	49785	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.480560064 CEST	49785	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.482912064 CEST	49785	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.490808964 CEST	49785	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.490834951 CEST	443	49785	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.498446941 CEST	443	49787	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.498464108 CEST	443	49787	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.498511076 CEST	443	49787	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.498544931 CEST	49787	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.498627901 CEST	49787	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.551618099 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.551676989 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.551696062 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.551778078 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.551778078 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.551791906 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.551806927 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.551829100 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.551840067 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.551856995 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.551875114 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.551883936 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.551883936 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.551904917 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.552032948 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.555046082 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.622812033 CEST	49787	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.622836113 CEST	443	49787	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.631356001 CEST	49784	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:36.631372929 CEST	443	49784	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:36.654838085 CEST	443	49786	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.654905081 CEST	443	49786	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.655045986 CEST	443	49786	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.655060053 CEST	49786	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.655379057 CEST	49786	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.699728012 CEST	49786	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:36.699749947 CEST	443	49786	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:36.751517057 CEST	49788	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:36.751548052 CEST	443	49788	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:36.751617908 CEST	49788	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:36.751681089 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:36.751708031 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:36.751759052 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:36.751983881 CEST	49788	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:36.752005100 CEST	443	49788	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:36.752160072 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:36.752170086 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.074974060 CEST	49790	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.075057030 CEST	443	49790	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.075138092 CEST	49790	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.075592995 CEST	49790	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.075628996 CEST	443	49790	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.091566086 CEST	49791	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.091645002 CEST	443	49791	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.091716051 CEST	49791	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.092767000 CEST	49791	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.092878103 CEST	443	49791	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.207381964 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.211596012 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.211610079 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.212678909 CEST	443	49788	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.213193893 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.213253021 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.214162111 CEST	49788	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.214171886 CEST	443	49788	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.215843916 CEST	443	49788	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.215908051 CEST	49788	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.216830969 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.216984987 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.217827082 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.217835903 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.219005108 CEST	49788	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.219091892 CEST	443	49788	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.219899893 CEST	49788	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.219906092 CEST	443	49788	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.258182049 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.273369074 CEST	49788	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.497860909 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.498586893 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.498596907 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.498615026 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.498646021 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.498665094 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.498676062 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.498697042 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.498718977 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.499330044 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.499352932 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.499383926 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.499392033 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.499440908 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.501384974 CEST	443	49788	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.501504898 CEST	443	49788	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.501559019 CEST	49788	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.501571894 CEST	443	49788	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.501612902 CEST	49788	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.501648903 CEST	443	49788	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.501714945 CEST	49788	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.529612064 CEST	443	49790	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.541548967 CEST	443	49791	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.545145988 CEST	49790	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.545203924 CEST	443	49790	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.545510054 CEST	49791	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.545568943 CEST	443	49791	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.545936108 CEST	443	49791	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.546695948 CEST	443	49790	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.565054893 CEST	49791	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.565170050 CEST	443	49791	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.566802025 CEST	49790	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.567193985 CEST	443	49790	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.570902109 CEST	49791	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.571237087 CEST	49790	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.612127066 CEST	443	49791	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.612215042 CEST	443	49790	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.624104977 CEST	49788	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.624124050 CEST	443	49788	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.646716118 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.646775007 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.646790981 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.646807909 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.646832943 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.646848917 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.647330046 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.647387028 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.647399902 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.647418022 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.647430897 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.647454023 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.647464037 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.647499084 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.648439884 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.648492098 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.648497105 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.648520947 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.648567915 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.649333954 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.649379969 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.649403095 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.649411917 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.649444103 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.689558983 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.796391010 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.796421051 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.796516895 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.796516895 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.796529055 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.797444105 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.797470093 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.797554016 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.797554016 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.797563076 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.798218966 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.798238993 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.798278093 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.798288107 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.798337936 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.798337936 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.799215078 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.799241066 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.799313068 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.799314022 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.799320936 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.799401999 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.800154924 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.800175905 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.800246000 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.800256014 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.800323009 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.801054955 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.801074028 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.801381111 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.801390886 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.801661968 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.801877975 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.801898003 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.801990986 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.801990986 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.801999092 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.802865028 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.802895069 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.802922964 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.802994967 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.802994967 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.803003073 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.803055048 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.873409033 CEST	443	49791	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.873426914 CEST	443	49791	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.873488903 CEST	443	49791	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.873528957 CEST	49791	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.873615980 CEST	49791	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.904269934 CEST	49791	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:37.904313087 CEST	443	49791	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:37.941248894 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.941293001 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.941349983 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.941364050 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.941416025 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.941464901 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.942962885 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.943011045 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.943078041 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.943078041 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.943088055 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.943265915 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.943723917 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.943766117 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.943814993 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.943821907 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.943864107 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.944227934 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.944274902 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.944329977 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.944336891 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.944401979 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.944420099 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.944571972 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.944627047 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.947185040 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.974020004 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.978811026 CEST	49789	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.978827953 CEST	443	49789	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.988641024 CEST	49793	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.988718987 CEST	443	49793	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:37.988888979 CEST	49793	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.989767075 CEST	49793	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:37.989804029 CEST	443	49793	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:38.261949062 CEST	443	49790	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:38.261996984 CEST	443	49790	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:38.262113094 CEST	443	49790	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:38.262171030 CEST	49790	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:38.262238979 CEST	49790	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:38.268259048 CEST	49790	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:38.268318892 CEST	443	49790	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:38.442886114 CEST	443	49793	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:38.443212986 CEST	49793	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:38.443274975 CEST	443	49793	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:38.446530104 CEST	443	49793	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:38.446600914 CEST	49793	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:38.447086096 CEST	49793	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:38.447177887 CEST	443	49793	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:38.447293043 CEST	49793	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:38.447310925 CEST	443	49793	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:38.499301910 CEST	49793	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:38.735975981 CEST	443	49793	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:38.736124039 CEST	443	49793	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:38.736191034 CEST	49793	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:38.736232042 CEST	443	49793	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:38.736274004 CEST	49793	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:38.736306906 CEST	443	49793	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:38.736361980 CEST	49793	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:38.737102985 CEST	49793	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:38.737131119 CEST	443	49793	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:38.948571920 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:38.948652029 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:38.948734045 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:38.949250937 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:38.949285030 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.340070963 CEST	49797	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.340107918 CEST	443	49797	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.340166092 CEST	49797	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.341063023 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.341139078 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.341213942 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.343447924 CEST	49797	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.343471050 CEST	443	49797	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.343991041 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.344019890 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.400994062 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.444210052 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.464948893 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.464998960 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.466573954 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.468535900 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.468739033 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.469377041 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.516115904 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.716844082 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.717489958 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.717582941 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.717585087 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.717597008 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.717624903 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.717674017 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.717725039 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.717740059 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.718300104 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.718350887 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.718379974 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.718393087 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.718430042 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.718517065 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.836189985 CEST	443	49797	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.836383104 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.836745977 CEST	49797	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.836762905 CEST	443	49797	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.837425947 CEST	443	49797	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.837476015 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.837496996 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.837938070 CEST	49797	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.838028908 CEST	443	49797	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.838094950 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.838324070 CEST	49797	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.839087963 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.839087963 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.839122057 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.839199066 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.878040075 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.878093958 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.878215075 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.878215075 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.878236055 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.878864050 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.878884077 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.878895998 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.878928900 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.878966093 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.878966093 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.878982067 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.879028082 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.879820108 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:39.879878044 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.879911900 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.879954100 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.879997015 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.880008936 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.880047083 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.880112886 CEST	443	49797	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:39.880145073 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.938478947 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.938559055 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.938618898 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.938682079 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.938715935 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.938827038 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:39.938841105 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:39.989208937 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.026247025 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.026320934 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.026366949 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.026386023 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.026418924 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.026472092 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.027261972 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.027307987 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.027357101 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.027369976 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.027415037 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.027757883 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.028156996 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.028199911 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.028245926 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.028258085 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.028297901 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.029088974 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.029146910 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.029187918 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.029201031 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.029241085 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.029858112 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.029912949 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.029962063 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.029975891 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.030008078 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.030276060 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.031128883 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.031177044 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.031239986 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.031250000 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.031286955 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.031500101 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.031550884 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.031606913 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.031619072 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.031658888 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.032347918 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.032388926 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.032440901 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.032469034 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.032540083 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.032584906 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.032598972 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.032634020 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.084676027 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.085144997 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.085216999 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.085263968 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.085278988 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.085319042 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.087125063 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.132860899 CEST	443	49797	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.133172989 CEST	443	49797	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.135057926 CEST	49797	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.138803005 CEST	49797	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.138816118 CEST	443	49797	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.172848940 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.172913074 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.172972918 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.173053980 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.173094988 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.173146963 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.177951097 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.178020954 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.178071022 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.178085089 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.178129911 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.178504944 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.178973913 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.179025888 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.179070950 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.179083109 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.179117918 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.179306984 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.179385900 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.179398060 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.179462910 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.179564953 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.180624008 CEST	49795	443	192.168.2.4	152.195.19.97
Apr 26, 2024 05:12:40.180650949 CEST	443	49795	152.195.19.97	192.168.2.4
Apr 26, 2024 05:12:40.280910015 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.280939102 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.280947924 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.281018019 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.281035900 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.281101942 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.281130075 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.281169891 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.281169891 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.281404018 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.281698942 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.281723022 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.281820059 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.281820059 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.281837940 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.281941891 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.328217983 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.328294039 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.328291893 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.328521013 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.328547955 CEST	443	49798	13.107.213.41	192.168.2.4
Apr 26, 2024 05:12:40.328582048 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.328689098 CEST	49798	443	192.168.2.4	13.107.213.41
Apr 26, 2024 05:12:40.530087948 CEST	49800	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:40.530124903 CEST	443	49800	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:40.530193090 CEST	49800	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:40.530682087 CEST	49800	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:40.530695915 CEST	443	49800	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:40.986071110 CEST	443	49800	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:41.010344028 CEST	49800	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:41.010360956 CEST	443	49800	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:41.011529922 CEST	443	49800	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:41.012058973 CEST	49800	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:41.012279987 CEST	443	49800	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:41.012466908 CEST	49800	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:41.056147099 CEST	443	49800	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:41.288070917 CEST	443	49800	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:41.288296938 CEST	443	49800	13.107.246.41	192.168.2.4
Apr 26, 2024 05:12:41.288347960 CEST	49800	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:41.289285898 CEST	49800	443	192.168.2.4	13.107.246.41
Apr 26, 2024 05:12:41.289299011 CEST	443	49800	13.107.246.41	192.168.2.4
Apr 26, 2024 05:13:08.442104101 CEST	49758	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:13:08.442135096 CEST	443	49758	104.47.110.28	192.168.2.4
Apr 26, 2024 05:13:11.522305012 CEST	49807	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:13:11.522388935 CEST	443	49807	192.178.50.36	192.168.2.4
Apr 26, 2024 05:13:11.522691965 CEST	49807	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:13:11.522799015 CEST	49807	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:13:11.522830009 CEST	443	49807	192.178.50.36	192.168.2.4
Apr 26, 2024 05:13:11.965603113 CEST	443	49807	192.178.50.36	192.168.2.4
Apr 26, 2024 05:13:11.965903044 CEST	49807	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:13:11.965929985 CEST	443	49807	192.178.50.36	192.168.2.4
Apr 26, 2024 05:13:11.966223001 CEST	443	49807	192.178.50.36	192.168.2.4
Apr 26, 2024 05:13:11.966640949 CEST	49807	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:13:11.966712952 CEST	443	49807	192.178.50.36	192.168.2.4
Apr 26, 2024 05:13:12.020201921 CEST	49807	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:13:16.552047968 CEST	49772	443	192.168.2.4	152.199.4.44
Apr 26, 2024 05:13:16.552117109 CEST	443	49772	152.199.4.44	192.168.2.4
Apr 26, 2024 05:13:21.957365990 CEST	443	49807	192.178.50.36	192.168.2.4
Apr 26, 2024 05:13:21.957487106 CEST	443	49807	192.178.50.36	192.168.2.4
Apr 26, 2024 05:13:21.958178997 CEST	49807	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:13:23.884207010 CEST	49758	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:13:23.884279013 CEST	49807	443	192.168.2.4	192.178.50.36
Apr 26, 2024 05:13:23.884299040 CEST	443	49807	192.178.50.36	192.168.2.4
Apr 26, 2024 05:13:23.884396076 CEST	443	49758	104.47.110.28	192.168.2.4
Apr 26, 2024 05:13:23.884475946 CEST	49758	443	192.168.2.4	104.47.110.28
Apr 26, 2024 05:13:32.101627111 CEST	443	49772	152.199.4.44	192.168.2.4
Apr 26, 2024 05:13:32.101712942 CEST	443	49772	152.199.4.44	192.168.2.4
Apr 26, 2024 05:13:32.101778984 CEST	49772	443	192.168.2.4	152.199.4.44

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 05:12:07.663113117 CEST	53	51557	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:07.670689106 CEST	53	62703	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:08.640249014 CEST	54407	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:08.641839027 CEST	50423	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:08.740747929 CEST	53	62389	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:08.827660084 CEST	53	50423	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:09.843527079 CEST	58848	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:09.843709946 CEST	60048	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:11.467068911 CEST	61012	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:11.467335939 CEST	53926	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:11.615895987 CEST	53	61012	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:11.616074085 CEST	53	53926	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:14.204920053 CEST	50723	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:14.205257893 CEST	62222	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:15.026988983 CEST	50865	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:15.027220964 CEST	51655	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:22.251704931 CEST	63777	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:22.251943111 CEST	54124	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:22.431160927 CEST	53	54124	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:22.437381983 CEST	53	63777	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:25.921053886 CEST	53	54548	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:26.322254896 CEST	53399	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:26.322424889 CEST	52667	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:27.137506008 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 05:12:28.254229069 CEST	49733	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:28.254431963 CEST	63486	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:29.570427895 CEST	53980	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:29.570427895 CEST	62389	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:29.719340086 CEST	53	53980	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:29.719403982 CEST	53	62389	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:30.840856075 CEST	63948	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:30.841447115 CEST	64268	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:31.813045025 CEST	61816	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:31.813246012 CEST	61066	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:36.600598097 CEST	63722	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:36.601345062 CEST	60746	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:37.063165903 CEST	53566	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:37.063363075 CEST	49163	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:37.210633039 CEST	53	53566	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:37.211735010 CEST	53	49163	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:37.839469910 CEST	56679	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:37.839469910 CEST	54973	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:39.498439074 CEST	53	55915	1.1.1.1	192.168.2.4
Apr 26, 2024 05:12:40.517404079 CEST	53821	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:40.517826080 CEST	53617	53	192.168.2.4	1.1.1.1
Apr 26, 2024 05:12:44.922334909 CEST	53	51863	1.1.1.1	192.168.2.4
Apr 26, 2024 05:13:07.386499882 CEST	53	56884	1.1.1.1	192.168.2.4
Apr 26, 2024 05:13:07.759989977 CEST	53	61488	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 26, 2024 05:12:08.827728033 CEST	192.168.2.4	1.1.1.1	c265	(Port unreachable)	Destination Unreachable
Apr 26, 2024 05:12:10.142510891 CEST	192.168.2.4	1.1.1.1	c2f2	(Port unreachable)	Destination Unreachable
Apr 26, 2024 05:12:26.609364033 CEST	192.168.2.4	1.1.1.1	c2a7	(Port unreachable)	Destination Unreachable
Apr 26, 2024 05:12:27.538924932 CEST	192.168.2.4	1.1.1.1	c29c	(Port unreachable)	Destination Unreachable
Apr 26, 2024 05:12:31.124772072 CEST	192.168.2.4	1.1.1.1	c2a7	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 05:12:08.640249014 CEST	192.168.2.4	1.1.1.1	0x42ab	Standard query (0)	mcas-proxyweb.mcas.ms	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:08.641839027 CEST	192.168.2.4	1.1.1.1	0xa279	Standard query (0)	mcas-proxyweb.mcas.ms	65	IN (0x0001)	false
Apr 26, 2024 05:12:09.843527079 CEST	192.168.2.4	1.1.1.1	0xe463	Standard query (0)	mcasproxy.cdn.mcas.ms	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:09.843709946 CEST	192.168.2.4	1.1.1.1	0x73d9	Standard query (0)	mcasproxy.cdn.mcas.ms	65	IN (0x0001)	false
Apr 26, 2024 05:12:11.467068911 CEST	192.168.2.4	1.1.1.1	0xcc58	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:11.467335939 CEST	192.168.2.4	1.1.1.1	0x1daf	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 05:12:14.204920053 CEST	192.168.2.4	1.1.1.1	0x265e	Standard query (0)	mcasproxy.cdn.mcas.ms	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:14.205257893 CEST	192.168.2.4	1.1.1.1	0x5f45	Standard query (0)	mcasproxy.cdn.mcas.ms	65	IN (0x0001)	false
Apr 26, 2024 05:12:15.026988983 CEST	192.168.2.4	1.1.1.1	0x70e0	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:15.027220964 CEST	192.168.2.4	1.1.1.1	0xdfa0	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false
Apr 26, 2024 05:12:22.251704931 CEST	192.168.2.4	1.1.1.1	0xcd4d	Standard query (0)	apc01.safelinks.protection.outlook.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:22.251943111 CEST	192.168.2.4	1.1.1.1	0x60e	Standard query (0)	apc01.safelinks.protection.outlook.com	65	IN (0x0001)	false
Apr 26, 2024 05:12:26.322254896 CEST	192.168.2.4	1.1.1.1	0xc7ac	Standard query (0)	account.activedirectory.windowsazure.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:26.322424889 CEST	192.168.2.4	1.1.1.1	0x5523	Standard query (0)	account.activedirectory.windowsazure.com	65	IN (0x0001)	false
Apr 26, 2024 05:12:28.254229069 CEST	192.168.2.4	1.1.1.1	0x7e31	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:28.254431963 CEST	192.168.2.4	1.1.1.1	0x6259	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Apr 26, 2024 05:12:29.570427895 CEST	192.168.2.4	1.1.1.1	0xf7e6	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:29.570427895 CEST	192.168.2.4	1.1.1.1	0x7da0	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Apr 26, 2024 05:12:30.840856075 CEST	192.168.2.4	1.1.1.1	0x2b3f	Standard query (0)	account.activedirectory.windowsazure.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:30.841447115 CEST	192.168.2.4	1.1.1.1	0x5ebc	Standard query (0)	account.activedirectory.windowsazure.com	65	IN (0x0001)	false
Apr 26, 2024 05:12:31.813045025 CEST	192.168.2.4	1.1.1.1	0x1f1b	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:31.813246012 CEST	192.168.2.4	1.1.1.1	0x9318	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Apr 26, 2024 05:12:36.600598097 CEST	192.168.2.4	1.1.1.1	0x38e3	Standard query (0)	aadcdn.msauthimages.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:36.601345062 CEST	192.168.2.4	1.1.1.1	0x5be3	Standard query (0)	aadcdn.msauthimages.net	65	IN (0x0001)	false
Apr 26, 2024 05:12:37.063165903 CEST	192.168.2.4	1.1.1.1	0xf231	Standard query (0)	autologon.microsoftazuread-sso.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:37.063363075 CEST	192.168.2.4	1.1.1.1	0x7fc4	Standard query (0)	autologon.microsoftazuread-sso.com	65	IN (0x0001)	false
Apr 26, 2024 05:12:37.839469910 CEST	192.168.2.4	1.1.1.1	0x1392	Standard query (0)	aadcdn.msauthimages.net	65	IN (0x0001)	false
Apr 26, 2024 05:12:37.839469910 CEST	192.168.2.4	1.1.1.1	0x4144	Standard query (0)	aadcdn.msauthimages.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:40.517404079 CEST	192.168.2.4	1.1.1.1	0x6a6	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:40.517826080 CEST	192.168.2.4	1.1.1.1	0x21e7	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 05:12:08.787879944 CEST	1.1.1.1	192.168.2.4	0x42ab	No error (0)	mcas-proxyweb.mcas.ms	mps-mda-ic-openresty-prd-weu.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:08.827660084 CEST	1.1.1.1	192.168.2.4	0xa279	No error (0)	mcas-proxyweb.mcas.ms	mps-mda-ic-openresty-prd-weu.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:10.036437035 CEST	1.1.1.1	192.168.2.4	0xe463	No error (0)	mcasproxy.cdn.mcas.ms	mps-mda-ic-mcasproxy-prd-weu.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:10.036437035 CEST	1.1.1.1	192.168.2.4	0xe463	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:10.036437035 CEST	1.1.1.1	192.168.2.4	0xe463	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:10.036437035 CEST	1.1.1.1	192.168.2.4	0xe463	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:10.142431974 CEST	1.1.1.1	192.168.2.4	0x73d9	No error (0)	mcasproxy.cdn.mcas.ms	mps-mda-ic-mcasproxy-prd-weu.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:11.615895987 CEST	1.1.1.1	192.168.2.4	0xcc58	No error (0)	www.google.com		192.178.50.36	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:11.616074085 CEST	1.1.1.1	192.168.2.4	0x1daf	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 05:12:14.394716978 CEST	1.1.1.1	192.168.2.4	0x5f45	No error (0)	mcasproxy.cdn.mcas.ms	mps-mda-ic-mcasproxy-prd-weu.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:14.454176903 CEST	1.1.1.1	192.168.2.4	0x265e	No error (0)	mcasproxy.cdn.mcas.ms	mps-mda-ic-mcasproxy-prd-weu.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:14.454176903 CEST	1.1.1.1	192.168.2.4	0x265e	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:14.454176903 CEST	1.1.1.1	192.168.2.4	0x265e	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:14.454176903 CEST	1.1.1.1	192.168.2.4	0x265e	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:15.175455093 CEST	1.1.1.1	192.168.2.4	0x70e0	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:15.175595045 CEST	1.1.1.1	192.168.2.4	0xdfa0	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:22.437381983 CEST	1.1.1.1	192.168.2.4	0xcd4d	No error (0)	apc01.safelinks.protection.outlook.com		104.47.110.28	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:24.286554098 CEST	1.1.1.1	192.168.2.4	0x7f8f	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:24.286554098 CEST	1.1.1.1	192.168.2.4	0x7f8f	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:26.470396042 CEST	1.1.1.1	192.168.2.4	0xc7ac	No error (0)	account.activedirectory.windowsazure.com	na.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:26.609276056 CEST	1.1.1.1	192.168.2.4	0x5523	No error (0)	account.activedirectory.windowsazure.com	na.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:28.401987076 CEST	1.1.1.1	192.168.2.4	0x7e31	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:28.402771950 CEST	1.1.1.1	192.168.2.4	0x6259	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:29.719340086 CEST	1.1.1.1	192.168.2.4	0xf7e6	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:29.719340086 CEST	1.1.1.1	192.168.2.4	0xf7e6	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:29.719403982 CEST	1.1.1.1	192.168.2.4	0x7da0	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:30.989249945 CEST	1.1.1.1	192.168.2.4	0x2b3f	No error (0)	account.activedirectory.windowsazure.com	na.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:31.124669075 CEST	1.1.1.1	192.168.2.4	0x5ebc	No error (0)	account.activedirectory.windowsazure.com	na.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:31.961011887 CEST	1.1.1.1	192.168.2.4	0x1f1b	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:31.961596012 CEST	1.1.1.1	192.168.2.4	0x9318	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:32.023547888 CEST	1.1.1.1	192.168.2.4	0xe894	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:32.023547888 CEST	1.1.1.1	192.168.2.4	0xe894	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:32.023547888 CEST	1.1.1.1	192.168.2.4	0xe894	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:35.657099962 CEST	1.1.1.1	192.168.2.4	0x4a53	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:35.657099962 CEST	1.1.1.1	192.168.2.4	0x4a53	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:35.657099962 CEST	1.1.1.1	192.168.2.4	0x4a53	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:36.749545097 CEST	1.1.1.1	192.168.2.4	0x38e3	No error (0)	aadcdn.msauthimages.net	aadcdn.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:36.749545097 CEST	1.1.1.1	192.168.2.4	0x38e3	No error (0)	scdn3514c.wpc.9e730.upsiloncdn.net	sni1gl.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:36.749545097 CEST	1.1.1.1	192.168.2.4	0x38e3	No error (0)	sni1gl.wpc.upsiloncdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:36.751045942 CEST	1.1.1.1	192.168.2.4	0x5be3	No error (0)	aadcdn.msauthimages.net	aadcdn.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:36.751045942 CEST	1.1.1.1	192.168.2.4	0x5be3	No error (0)	scdn3514c.wpc.9e730.upsiloncdn.net	sni1gl.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:37.044615984 CEST	1.1.1.1	192.168.2.4	0x2602	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:37.044615984 CEST	1.1.1.1	192.168.2.4	0x2602	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:37.210633039 CEST	1.1.1.1	192.168.2.4	0xf231	No error (0)	autologon.microsoftazuread-sso.com		40.126.28.14	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:37.210633039 CEST	1.1.1.1	192.168.2.4	0xf231	No error (0)	autologon.microsoftazuread-sso.com		40.126.7.32	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:37.210633039 CEST	1.1.1.1	192.168.2.4	0xf231	No error (0)	autologon.microsoftazuread-sso.com		40.126.28.21	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:37.210633039 CEST	1.1.1.1	192.168.2.4	0xf231	No error (0)	autologon.microsoftazuread-sso.com		40.126.28.20	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:37.210633039 CEST	1.1.1.1	192.168.2.4	0xf231	No error (0)	autologon.microsoftazuread-sso.com		40.126.28.19	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:37.210633039 CEST	1.1.1.1	192.168.2.4	0xf231	No error (0)	autologon.microsoftazuread-sso.com		40.126.28.13	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:37.210633039 CEST	1.1.1.1	192.168.2.4	0xf231	No error (0)	autologon.microsoftazuread-sso.com		40.126.28.18	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:37.210633039 CEST	1.1.1.1	192.168.2.4	0xf231	No error (0)	autologon.microsoftazuread-sso.com		40.126.28.12	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:37.987129927 CEST	1.1.1.1	192.168.2.4	0x1392	No error (0)	aadcdn.msauthimages.net	aadcdn.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:37.987129927 CEST	1.1.1.1	192.168.2.4	0x1392	No error (0)	scdn3514c.wpc.9e730.upsiloncdn.net	sni1gl.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:37.987489939 CEST	1.1.1.1	192.168.2.4	0x4144	No error (0)	aadcdn.msauthimages.net	aadcdn.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:37.987489939 CEST	1.1.1.1	192.168.2.4	0x4144	No error (0)	scdn3514c.wpc.9e730.upsiloncdn.net	sni1gl.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:37.987489939 CEST	1.1.1.1	192.168.2.4	0x4144	No error (0)	sni1gl.wpc.upsiloncdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:12:40.665118933 CEST	1.1.1.1	192.168.2.4	0x6a6	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:40.666270018 CEST	1.1.1.1	192.168.2.4	0x21e7	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:59.998734951 CEST	1.1.1.1	192.168.2.4	0xdbfc	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:12:59.998734951 CEST	1.1.1.1	192.168.2.4	0xdbfc	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 05:13:20.373276949 CEST	1.1.1.1	192.168.2.4	0x9e1e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 05:13:20.373276949 CEST	1.1.1.1	192.168.2.4	0x9e1e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

mcasproxy.cdn.mcas.ms

aadcdn.msftauth.net

aadcdn.msauth.net

aadcdn.msauthimages.net

fs.microsoft.com

apc01.safelinks.protection.outlook.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49742	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:10 UTC	599	OUT	GET /proxyweb/1.54.36-1-hf/css/proxyweb-all.min.css?cb=1.54.146-6 HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://mcas-proxyweb.mcas.ms/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:10 UTC	847	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:10 GMT Content-Type: text/css Content-Length: 27214 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=31536000 Last-Modified: Mon, 25 Mar 2024 12:17:45 GMT ETag: 0x8DC4CC59431E3E0 x-ms-request-id: 2a674103-301e-003d-1582-97ad36000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031210Z-17644f8887fckxfx1qh4sb6v6n000000075g0000000088c3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 03:12:10 UTC	15537	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 53 65 67 6f 65 20 55 49 3b 73 72 63 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 63 2e 73 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 66 6f 6e 74 73 2f 73 65 67 6f 65 2d 75 69 2f 77 65 73 74 2d 65 75 72 6f 70 65 61 6e 2f 6e 6f 72 6d 61 6c 2f 6c 61 74 65 73 74 2e 65 6f 74 29 3b 73 72 63 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 63 2e 73 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 66 6f 6e 74 73 2f 73 65 67 6f 65 2d 75 69 2f 77 65 73 74 2d 65 75 72 6f 70 65 61 6e 2f 6e 6f 72 6d 61 6c 2f 6c 61 74 65 73 74 2e 65 6f 74 3f 23 69 65 66 69 78 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 75 72 6c 28 68 74 74 70 73 3a Data Ascii: @font-face{font-family:Segoe UI;src:url(https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.eot);src:url(https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.eot?#iefix) format('embedded-opentype'),url(https:
2024-04-26 03:12:10 UTC	11677	IN	Data Raw: 77 65 62 2d 75 6e 6d 61 70 70 65 64 2d 64 6f 6d 61 69 6e 73 2d 70 61 6e 65 6c 20 23 70 72 6f 78 79 77 65 62 2d 75 6e 6d 61 70 70 65 64 2d 64 6f 6d 61 69 6e 73 2d 70 61 6e 65 6c 2d 63 6c 6f 73 65 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f 70 3a 32 38 70 78 3b 72 69 67 68 74 3a 32 37 70 78 3b 66 6c 6f 61 74 3a 72 69 67 68 74 7d 2e 70 72 6f 78 79 77 65 62 2d 75 6e 6d 61 70 70 65 64 2d 64 6f 6d 61 69 6e 73 2d 70 61 6e 65 6c 20 23 70 72 6f 78 79 77 65 62 2d 70 61 6e 65 6c 2d 63 6c 6f 73 65 2d 62 74 6e 7b 77 69 64 74 68 3a 31 32 70 78 3b 68 65 69 67 68 74 3a 31 36 70 78 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 70 72 6f 78 79 77 65 62 2d 75 6e 6d 61 70 70 65 64 2d 64 6f 6d 61 69 6e 73 2d 70 61 6e 65 6c 20 23 70 72 6f 78 79 77 65 62 Data Ascii: web-unmapped-domains-panel #proxyweb-unmapped-domains-panel-close{position:relative;top:28px;right:27px;float:right}.proxyweb-unmapped-domains-panel #proxyweb-panel-close-btn{width:12px;height:16px;cursor:pointer}.proxyweb-unmapped-domains-panel #proxyweb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:10 UTC	567	OUT	GET /proxyweb/1.54.36-1-hf/js/handlebars.min.js HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://mcas-proxyweb.mcas.ms/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:10 UTC	861	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:10 GMT Content-Type: application/javascript Content-Length: 88426 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=31536000 Last-Modified: Mon, 25 Mar 2024 12:17:28 GMT ETag: 0x8DC4CC58A214183 x-ms-request-id: 95cc327a-801e-003e-4d82-97d030000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031210Z-1865489d5f47qbmbt8czrx60cn0000000az0000000005ub0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 03:12:10 UTC	15523	IN	Data Raw: 2f 2a 2a 21 0a 0a 20 40 6c 69 63 65 6e 73 65 0a 20 68 61 6e 64 6c 65 62 61 72 73 20 76 34 2e 37 2e 38 0a 0a 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 32 30 31 31 2d 32 30 31 39 20 62 79 20 59 65 68 75 64 61 20 4b 61 74 7a 0a 0a 50 65 72 6d 69 73 73 69 6f 6e 20 69 73 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 2c 20 66 72 65 65 20 6f 66 20 63 68 61 72 67 65 2c 20 74 6f 20 61 6e 79 20 70 65 72 73 6f 6e 20 6f 62 74 61 69 6e 69 6e 67 20 61 20 63 6f 70 79 0a 6f 66 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 61 6e 64 20 61 73 73 6f 63 69 61 74 65 64 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 20 66 69 6c 65 73 20 28 74 68 65 20 22 53 6f 66 74 77 61 72 65 22 29 2c 20 74 6f 20 64 65 61 6c 0a 69 6e 20 74 68 65 20 53 6f 66 74 77 61 72 65 20 77 69 74 68 6f 75 74 20 Data Ascii: /**! @license handlebars v4.7.8Copyright (C) 2011-2019 by Yehuda KatzPermission is hereby granted, free of charge, to any person obtaining a copyof this software and associated documentation files (the "Software"), to dealin the Software without
2024-04-26 03:12:10 UTC	16384	IN	Data Raw: 65 6e 67 74 68 2c 7b 76 61 6c 75 65 3a 61 2c 64 6f 6e 65 3a 21 31 7d 29 7d 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 3d 63 28 34 37 29 2c 65 3d 63 28 33 35 29 3b 61 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 66 2c 67 2c 68 3d 53 74 72 69 6e 67 28 65 28 62 29 29 2c 69 3d 64 28 63 29 2c 6a 3d 68 2e 6c 65 6e 67 74 68 3b 72 65 74 75 72 6e 20 69 3c 30 7c 7c 69 3e 3d 6a 3f 61 3f 22 22 3a 76 6f 69 64 20 30 3a 28 66 3d 68 2e 63 68 61 72 43 6f 64 65 41 74 28 69 29 2c 66 3c 35 35 32 39 36 7c 7c 66 3e 35 36 33 31 39 7c 7c 69 2b 31 3d 3d 3d 6a 7c 7c 28 67 3d 68 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 31 29 29 3c 35 36 33 32 30 7c 7c 67 3e 35 Data Ascii: ength,{value:a,done:!1})})},function(a,b,c){var d=c(47),e=c(35);a.exports=function(a){return function(b,c){var f,g,h=String(e(b)),i=d(c),j=h.length;return i<0\|\|i>=j?a?"":void 0:(f=h.charCodeAt(i),f<55296\|\|f>56319\|\|i+1===j\|\|(g=h.charCodeAt(i+1))<56320\|\|g>5
2024-04-26 03:12:11 UTC	16384	IN	Data Raw: 54 22 2c 31 35 3a 22 43 4f 4e 54 45 4e 54 22 2c 31 38 3a 22 45 4e 44 5f 52 41 57 5f 42 4c 4f 43 4b 22 2c 31 39 3a 22 4f 50 45 4e 5f 52 41 57 5f 42 4c 4f 43 4b 22 2c 32 33 3a 22 43 4c 4f 53 45 5f 52 41 57 5f 42 4c 4f 43 4b 22 2c 32 39 3a 22 4f 50 45 4e 5f 42 4c 4f 43 4b 22 2c 33 33 3a 22 43 4c 4f 53 45 22 2c 33 34 3a 22 4f 50 45 4e 5f 49 4e 56 45 52 53 45 22 2c 33 39 3a 22 4f 50 45 4e 5f 49 4e 56 45 52 53 45 5f 43 48 41 49 4e 22 2c 34 34 3a 22 49 4e 56 45 52 53 45 22 2c 34 37 3a 22 4f 50 45 4e 5f 45 4e 44 42 4c 4f 43 4b 22 2c 34 38 3a 22 4f 50 45 4e 22 2c 35 31 3a 22 4f 50 45 4e 5f 55 4e 45 53 43 41 50 45 44 22 2c 35 34 3a 22 43 4c 4f 53 45 5f 55 4e 45 53 43 41 50 45 44 22 2c 35 35 3a 22 4f 50 45 4e 5f 50 41 52 54 49 41 4c 22 2c 36 30 3a 22 4f 50 45 4e 5f Data Ascii: T",15:"CONTENT",18:"END_RAW_BLOCK",19:"OPEN_RAW_BLOCK",23:"CLOSE_RAW_BLOCK",29:"OPEN_BLOCK",33:"CLOSE",34:"OPEN_INVERSE",39:"OPEN_INVERSE_CHAIN",44:"INVERSE",47:"OPEN_ENDBLOCK",48:"OPEN",51:"OPEN_UNESCAPED",54:"CLOSE_UNESCAPED",55:"OPEN_PARTIAL",60:"OPEN_
2024-04-26 03:12:11 UTC	16384	IN	Data Raw: 37 5d 2c 37 33 3a 5b 32 2c 38 31 5d 2c 38 32 3a 5b 32 2c 38 35 5d 2c 38 36 3a 5b 32 2c 31 38 5d 2c 39 30 3a 5b 32 2c 38 39 5d 2c 31 30 31 3a 5b 32 2c 35 33 5d 2c 31 30 34 3a 5b 32 2c 39 33 5d 2c 31 31 30 3a 5b 32 2c 31 39 5d 2c 31 31 31 3a 5b 32 2c 37 37 5d 2c 31 31 36 3a 5b 32 2c 39 37 5d 2c 31 31 39 3a 5b 32 2c 36 33 5d 2c 31 32 32 3a 5b 32 2c 36 39 5d 2c 31 33 35 3a 5b 32 2c 37 35 5d 2c 31 33 36 3a 5b 32 2c 33 32 5d 7d 2c 70 61 72 73 65 45 72 72 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 61 29 7d 2c 70 61 72 73 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 76 61 72 20 61 3b 72 65 74 75 72 6e 20 61 3d 63 2e 6c 65 78 65 72 2e 6c 65 78 28 29 7c 7c 31 2c 22 6e 75 6d Data Ascii: 7],73:[2,81],82:[2,85],86:[2,18],90:[2,89],101:[2,53],104:[2,93],110:[2,19],111:[2,77],116:[2,97],119:[2,63],122:[2,69],135:[2,75],136:[2,32]},parseError:function(a,b){throw new Error(a)},parse:function(a){function b(){var a;return a=c.lexer.lex()\|\|1,"num
2024-04-26 03:12:11 UTC	16384	IN	Data Raw: 3a 62 2e 6c 6f 63 7d 7d 7d 76 61 72 20 69 3d 63 28 37 34 29 5b 22 64 65 66 61 75 6c 74 22 5d 2c 6a 3d 63 28 31 29 5b 22 64 65 66 61 75 6c 74 22 5d 3b 62 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 62 2e 43 6f 6d 70 69 6c 65 72 3d 64 2c 62 2e 70 72 65 63 6f 6d 70 69 6c 65 3d 65 2c 62 2e 63 6f 6d 70 69 6c 65 3d 66 3b 76 61 72 20 6b 3d 63 28 36 29 2c 6c 3d 6a 28 6b 29 2c 6d 3d 63 28 35 29 2c 6e 3d 63 28 38 34 29 2c 6f 3d 6a 28 6e 29 2c 70 3d 5b 5d 2e 73 6c 69 63 65 3b 64 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 6f 6d 70 69 6c 65 72 3a 64 2c 65 71 75 61 6c 73 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 74 68 69 73 2e 6f 70 63 6f 64 65 73 2e 6c 65 6e 67 74 68 3b 69 66 28 61 2e 6f 70 63 6f 64 65 73 2e 6c 65 6e 67 74 68 21 3d 3d 62 29 72 65 74 75 72 Data Ascii: :b.loc}}}var i=c(74)["default"],j=c(1)["default"];b.__esModule=!0,b.Compiler=d,b.precompile=e,b.compile=f;var k=c(6),l=j(k),m=c(5),n=c(84),o=j(n),p=[].slice;d.prototype={compiler:d,equals:function(a){var b=this.opcodes.length;if(a.opcodes.length!==b)retur
2024-04-26 03:12:11 UTC	7367	IN	Data Raw: 2e 74 79 70 65 73 5b 61 5d 3d 64 29 2c 65 26 26 28 66 2e 69 64 73 5b 61 5d 3d 65 29 2c 66 2e 76 61 6c 75 65 73 5b 61 5d 3d 62 7d 2c 70 75 73 68 49 64 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 22 42 6c 6f 63 6b 50 61 72 61 6d 22 3d 3d 3d 61 3f 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 4c 69 74 65 72 61 6c 28 22 62 6c 6f 63 6b 50 61 72 61 6d 73 5b 22 2b 62 5b 30 5d 2b 22 5d 2e 70 61 74 68 5b 22 2b 62 5b 31 5d 2b 22 5d 22 2b 28 63 3f 22 20 2b 20 22 2b 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 22 2e 22 2b 63 29 3a 22 22 29 29 3a 22 50 61 74 68 45 78 70 72 65 73 73 69 6f 6e 22 3d 3d 3d 61 3f 74 68 69 73 2e 70 75 73 68 53 74 72 69 6e 67 28 62 29 3a 22 53 75 62 45 78 70 72 65 73 73 69 6f 6e 22 3d 3d 3d 61 3f 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b Data Ascii: .types[a]=d),e&&(f.ids[a]=e),f.values[a]=b},pushId:function(a,b,c){"BlockParam"===a?this.pushStackLiteral("blockParams["+b[0]+"].path["+b[1]+"]"+(c?" + "+JSON.stringify("."+c):"")):"PathExpression"===a?this.pushString(b):"SubExpression"===a?this.pushStack

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:10 UTC	568	OUT	GET /proxyweb/1.54.36-1-hf/js/lodash-core.min.js HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://mcas-proxyweb.mcas.ms/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:10 UTC	861	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:10 GMT Content-Type: application/javascript Content-Length: 12684 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=31536000 Last-Modified: Mon, 25 Mar 2024 12:17:29 GMT ETag: 0x8DC4CC58A6C4922 x-ms-request-id: 20af5281-401e-004a-6470-978e38000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031210Z-1865489d5f469db67514m1tnm40000000amg000000002wg9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:10 UTC	12684	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 40 6c 69 63 65 6e 73 65 0a 20 2a 20 4c 6f 64 61 73 68 20 28 43 75 73 74 6f 6d 20 42 75 69 6c 64 29 20 6c 6f 64 61 73 68 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 20 7c 20 55 6e 64 65 72 73 63 6f 72 65 2e 6a 73 20 31 2e 38 2e 33 20 75 6e 64 65 72 73 63 6f 72 65 6a 73 2e 6f 72 67 2f 4c 49 43 45 4e 53 45 0a 20 2a 20 42 75 69 6c 64 3a 20 60 6c 6f 64 61 73 68 20 63 6f 72 65 20 2d 6f 20 2e 2f 64 69 73 74 2f 6c 6f 64 61 73 68 2e 63 6f 72 65 2e 6a 73 60 0a 20 2a 2f 0a 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 29 7b 72 65 74 75 72 6e 20 48 28 6e 29 26 26 70 6e 2e 63 61 6c 6c 28 6e 2c 22 63 61 6c 6c 65 65 22 29 26 26 21 79 6e 2e 63 61 6c 6c 28 6e 2c 22 63 61 6c 6c 65 65 22 29 7d 66 75 6e 63 74 69 6f 6e 20 74 28 6e 2c Data Ascii: /** * @license * Lodash (Custom Build) lodash.com/license \| Underscore.js 1.8.3 underscorejs.org/LICENSE * Build: `lodash core -o ./dist/lodash.core.js` */;(function(){function n(n){return H(n)&&pn.call(n,"callee")&&!yn.call(n,"callee")}function t(n,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:10 UTC	562	OUT	GET /proxyweb/1.54.36-1-hf/js/translate.js HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://mcas-proxyweb.mcas.ms/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:11 UTC	860	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:11 GMT Content-Type: application/javascript Content-Length: 7673 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=31536000 Last-Modified: Mon, 25 Mar 2024 12:17:29 GMT ETag: 0x8DC4CC58A434368 x-ms-request-id: 0f36b8f4-101e-003f-0378-97fb32000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031210Z-1865489d5f4vxtqf9836nc5azn00000003s000000000d95v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:11 UTC	7673	IN	Data Raw: 28 28 72 6f 6f 74 2c 20 66 61 63 74 6f 72 79 29 20 3d 3e 20 7b 0a 20 20 20 20 27 75 73 65 20 73 74 72 69 63 74 27 3b 0a 20 20 20 20 2f 2f 49 66 20 74 72 61 6e 73 6c 61 74 65 20 69 73 20 6c 6f 61 64 65 64 20 69 6e 73 69 64 65 20 61 6e 20 61 6d 64 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 20 69 74 20 77 69 6c 6c 20 64 65 66 69 6e 65 20 61 20 6d 6f 64 75 6c 65 2e 20 4f 74 68 65 72 77 69 73 65 20 69 74 20 77 69 6c 6c 20 63 72 65 61 74 65 20 74 68 65 20 6d 6f 64 75 6c 65 20 66 72 6f 6d 20 76 61 6e 69 6c 6c 61 20 6a 61 76 61 73 63 72 69 70 74 20 28 65 78 70 6f 73 69 6e 67 20 74 6f 20 77 69 6e 64 6f 77 29 2e 0a 20 20 20 20 69 66 20 28 74 79 70 65 6f 66 20 64 65 66 69 6e 65 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 20 26 26 20 64 65 66 69 6e 65 2e 61 6d 64 29 20 7b Data Ascii: ((root, factory) => { 'use strict'; //If translate is loaded inside an amd environment it will define a module. Otherwise it will create the module from vanilla javascript (exposing to window). if (typeof define === 'function' && define.amd) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:12 UTC	583	OUT	GET /proxyweb/1.54.36-1-hf/js/Handlebars/handlebars-intl.min.js HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://mcas-proxyweb.mcas.ms/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:12 UTC	861	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:12 GMT Content-Type: application/javascript Content-Length: 27266 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=31536000 Last-Modified: Mon, 25 Mar 2024 12:17:30 GMT ETag: 0x8DC4CC58AE9F203 x-ms-request-id: 135e95ed-201e-0070-1982-97a13c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031212Z-1865489d5f46s4qnhr87brpyc400000009hg00000000g9a7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 03:12:12 UTC	15523	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 76 61 72 20 62 2c 63 2c 64 2c 65 2c 66 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 31 29 3b 66 6f 72 28 62 3d 30 2c 63 3d 66 2e 6c 65 6e 67 74 68 3b 63 3e 62 3b 62 2b 3d 31 29 69 66 28 64 3d 66 5b 62 5d 29 66 6f 72 28 65 20 69 6e 20 64 29 70 2e 63 61 6c 6c 28 64 2c 65 29 26 26 28 61 5b 65 5d 3d 64 5b 65 5d 29 3b 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 62 28 61 2c 62 2c 63 29 7b 74 68 69 73 2e 6c 6f 63 61 6c 65 73 3d 61 2c 74 68 69 73 2e 66 6f 72 6d 61 74 73 3d 62 2c 74 68 69 73 2e 70 6c 75 72 61 6c 46 6e 3d 63 7d 66 75 6e 63 74 69 6f 6e 20 63 28 61 29 7b 74 Data Ascii: (function(){"use strict";function a(a){var b,c,d,e,f=Array.prototype.slice.call(arguments,1);for(b=0,c=f.length;c>b;b+=1)if(d=f[b])for(e in d)p.call(d,e)&&(a[e]=d[e]);return a}function b(a,b,c){this.locales=a,this.formats=b,this.pluralFn=c}function c(a){t
2024-04-26 03:12:12 UTC	11743	IN	Data Raw: 22 2c 64 65 73 63 72 69 70 74 69 6f 6e 3a 27 22 3d 22 27 7d 2c 6c 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 7b 74 79 70 65 3a 22 6f 70 74 69 6f 6e 61 6c 46 6f 72 6d 61 74 50 61 74 74 65 72 6e 22 2c 73 65 6c 65 63 74 6f 72 3a 61 2c 76 61 6c 75 65 3a 62 7d 7d 2c 6d 61 3d 22 6f 66 66 73 65 74 3a 22 2c 6e 61 3d 7b 74 79 70 65 3a 22 6c 69 74 65 72 61 6c 22 2c 76 61 6c 75 65 3a 22 6f 66 66 73 65 74 3a 22 2c 64 65 73 63 72 69 70 74 69 6f 6e 3a 27 22 6f 66 66 73 65 74 3a 22 27 7d 2c 6f 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 2c 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 7b 74 79 70 65 3a 22 70 6c 75 72 61 6c 46 6f 72 6d 61 74 22 2c 6f 66 66 73 65 74 3a 61 2c 6f 70 74 69 6f 6e 73 3a 62 Data Ascii: ",description:'"="'},la=function(a,b){return{type:"optionalFormatPattern",selector:a,value:b}},ma="offset:",na={type:"literal",value:"offset:",description:'"offset:"'},oa=function(a){return a},pa=function(a,b){return{type:"pluralFormat",offset:a,options:b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	23.197.97.241	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:13 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 03:12:13 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0712) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=100322 Date: Fri, 26 Apr 2024 03:12:13 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:13 UTC	639	OUT	GET /proxyweb/1.54.36-1-hf/images/favicon.ico?cb=1.54.146-6 HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mcas-proxyweb.mcas.ms/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:13 UTC	771	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:13 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Mon, 25 Mar 2024 12:17:25 GMT ETag: 0x8DC4CC5883153C5 x-ms-request-id: f377e177-c01e-007e-0f82-970321000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031213Z-17644f8887fz6gvmkwy10mc16n00000006u000000000aa70 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:13 UTC	15613	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 03:12:13 UTC	1561	IN	Data Raw: 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333""""""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:13 UTC	592	OUT	GET /i18n/0.274.5/proxyweb/en_us.json HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://mcas-proxyweb.mcas.ms Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://mcas-proxyweb.mcas.ms/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:13 UTC	800	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:13 GMT Content-Type: application/json Content-Length: 20577 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Tue, 30 Jan 2024 12:36:33 GMT ETag: 0x8DC2190178C353C x-ms-request-id: 507b43fa-d01e-0033-7582-970f2b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031213Z-17644f8887fz6gvmkwy10mc16n00000006zg0000000037z6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 03:12:13 UTC	15584	IN	Data Raw: 7b 0a 20 20 22 50 52 4f 58 59 57 45 42 5f 41 43 54 49 4f 4e 5f 42 4c 4f 43 4b 45 44 5f 44 45 53 43 52 49 50 54 49 4f 4e 22 3a 20 22 54 68 69 73 20 61 63 74 69 6f 6e 20 69 73 20 62 6c 6f 63 6b 65 64 20 62 79 20 79 6f 75 72 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 27 73 20 73 65 63 75 72 69 74 79 20 70 6f 6c 69 63 79 2e 22 2c 0a 20 20 22 50 52 4f 58 59 57 45 42 5f 41 43 54 49 4f 4e 5f 42 4c 4f 43 4b 45 44 5f 50 41 47 45 54 49 54 4c 45 22 3a 20 22 41 63 74 69 6f 6e 20 62 6c 6f 63 6b 65 64 22 2c 0a 20 20 22 50 52 4f 58 59 57 45 42 5f 41 43 54 49 4f 4e 5f 42 4c 4f 43 4b 45 44 5f 52 45 54 55 52 4e 5f 54 4f 5f 53 45 53 53 49 4f 4e 22 3a 20 22 47 6f 20 62 61 63 6b 22 2c 0a 20 20 22 50 52 4f 58 59 57 45 42 5f 41 44 4d 49 4e 5f 56 49 45 57 5f 42 59 50 41 53 53 5f 45 Data Ascii: { "PROXYWEB_ACTION_BLOCKED_DESCRIPTION": "This action is blocked by your organization's security policy.", "PROXYWEB_ACTION_BLOCKED_PAGETITLE": "Action blocked", "PROXYWEB_ACTION_BLOCKED_RETURN_TO_SESSION": "Go back", "PROXYWEB_ADMIN_VIEW_BYPASS_E
2024-04-26 03:12:13 UTC	4993	IN	Data Raw: 6f 6d 61 69 6e 22 2c 0a 20 20 22 50 52 4f 58 59 57 45 42 5f 53 45 43 4f 4e 44 5f 53 49 47 4e 5f 49 4e 5f 49 4e 46 4f 52 4d 41 54 49 4f 4e 5f 50 41 47 45 5f 4c 49 4e 45 31 22 3a 20 22 57 65 20 73 65 65 20 74 68 61 74 20 74 68 65 20 73 69 67 6e 2d 69 6e 20 79 6f 75 20 66 6f 6c 6c 6f 77 65 64 20 73 74 61 72 74 65 64 20 66 72 6f 6d 20 6f 75 74 73 69 64 65 20 6f 66 20 6f 75 72 20 73 65 73 73 69 6f 6e 20 63 6f 6e 74 72 6f 6c 73 22 2c 0a 20 20 22 50 52 4f 58 59 57 45 42 5f 53 45 43 4f 4e 44 5f 53 49 47 4e 5f 49 4e 5f 49 4e 46 4f 52 4d 41 54 49 4f 4e 5f 50 41 47 45 5f 4c 49 4e 45 32 22 3a 20 22 41 20 73 65 63 6f 6e 64 20 73 69 67 6e 2d 69 6e 20 55 52 4c 20 28 7b 75 72 6c 7d 29 20 20 69 73 20 6e 65 65 64 65 64 20 74 6f 20 63 6f 6e 73 75 6d 65 20 74 68 65 20 73 69 Data Ascii: omain", "PROXYWEB_SECOND_SIGN_IN_INFORMATION_PAGE_LINE1": "We see that the sign-in you followed started from outside of our session controls", "PROXYWEB_SECOND_SIGN_IN_INFORMATION_PAGE_LINE2": "A second sign-in URL ({url}) is needed to consume the si

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49748	23.197.97.241	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:13 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 03:12:13 UTC	456	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 Cache-Control: public, max-age=100314 Date: Fri, 26 Apr 2024 03:12:13 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 03:12:13 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:14 UTC	578	OUT	GET /proxyweb/1.54.36-1-hf/js/Handlebars/locale-data/en.js HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://mcas-proxyweb.mcas.ms/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:14 UTC	861	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:14 GMT Content-Type: application/javascript Content-Length: 10710 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=31536000 Last-Modified: Mon, 25 Mar 2024 12:17:36 GMT ETag: 0x8DC4CC58E59693C x-ms-request-id: acae92d8-f01e-0021-4c82-97e90d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031214Z-1865489d5f4c7br6veundbra3w00000000d0000000004bpp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 03:12:14 UTC	10710	IN	Data Raw: 48 61 6e 64 6c 65 62 61 72 73 49 6e 74 6c 2e 5f 5f 61 64 64 4c 6f 63 61 6c 65 44 61 74 61 28 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 22 2c 22 70 6c 75 72 61 6c 52 75 6c 65 46 75 6e 63 74 69 6f 6e 22 3a 66 75 6e 63 74 69 6f 6e 20 28 6e 2c 6f 72 64 29 7b 76 61 72 20 73 3d 53 74 72 69 6e 67 28 6e 29 2e 73 70 6c 69 74 28 22 2e 22 29 2c 76 30 3d 21 73 5b 31 5d 2c 74 30 3d 4e 75 6d 62 65 72 28 73 5b 30 5d 29 3d 3d 6e 2c 6e 31 30 3d 74 30 26 26 73 5b 30 5d 2e 73 6c 69 63 65 28 2d 31 29 2c 6e 31 30 30 3d 74 30 26 26 73 5b 30 5d 2e 73 6c 69 63 65 28 2d 32 29 3b 69 66 28 6f 72 64 29 72 65 74 75 72 6e 20 6e 31 30 3d 3d 31 26 26 6e 31 30 30 21 3d 31 31 3f 22 6f 6e 65 22 3a 6e 31 30 3d 3d 32 26 26 6e 31 30 30 21 3d 31 32 3f 22 74 77 6f 22 3a 6e 31 30 3d 3d 33 26 26 6e Data Ascii: HandlebarsIntl.__addLocaleData({"locale":"en","pluralRuleFunction":function (n,ord){var s=String(n).split("."),v0=!s[1],t0=Number(s[0])==n,n10=t0&&s[0].slice(-1),n100=t0&&s[0].slice(-2);if(ord)return n10==1&&n100!=11?"one":n10==2&&n100!=12?"two":n10==3&&n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49750	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:14 UTC	377	OUT	GET /i18n/0.274.5/proxyweb/en_us.json HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:15 UTC	800	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:15 GMT Content-Type: application/json Content-Length: 20577 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Tue, 30 Jan 2024 12:36:33 GMT ETag: 0x8DC2190178C353C x-ms-request-id: 507b43fa-d01e-0033-7582-970f2b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031215Z-17644f8887fxsmp62x2nasg16g00000001n00000000062fn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 03:12:15 UTC	15584	IN	Data Raw: 7b 0a 20 20 22 50 52 4f 58 59 57 45 42 5f 41 43 54 49 4f 4e 5f 42 4c 4f 43 4b 45 44 5f 44 45 53 43 52 49 50 54 49 4f 4e 22 3a 20 22 54 68 69 73 20 61 63 74 69 6f 6e 20 69 73 20 62 6c 6f 63 6b 65 64 20 62 79 20 79 6f 75 72 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 27 73 20 73 65 63 75 72 69 74 79 20 70 6f 6c 69 63 79 2e 22 2c 0a 20 20 22 50 52 4f 58 59 57 45 42 5f 41 43 54 49 4f 4e 5f 42 4c 4f 43 4b 45 44 5f 50 41 47 45 54 49 54 4c 45 22 3a 20 22 41 63 74 69 6f 6e 20 62 6c 6f 63 6b 65 64 22 2c 0a 20 20 22 50 52 4f 58 59 57 45 42 5f 41 43 54 49 4f 4e 5f 42 4c 4f 43 4b 45 44 5f 52 45 54 55 52 4e 5f 54 4f 5f 53 45 53 53 49 4f 4e 22 3a 20 22 47 6f 20 62 61 63 6b 22 2c 0a 20 20 22 50 52 4f 58 59 57 45 42 5f 41 44 4d 49 4e 5f 56 49 45 57 5f 42 59 50 41 53 53 5f 45 Data Ascii: { "PROXYWEB_ACTION_BLOCKED_DESCRIPTION": "This action is blocked by your organization's security policy.", "PROXYWEB_ACTION_BLOCKED_PAGETITLE": "Action blocked", "PROXYWEB_ACTION_BLOCKED_RETURN_TO_SESSION": "Go back", "PROXYWEB_ADMIN_VIEW_BYPASS_E
2024-04-26 03:12:15 UTC	4993	IN	Data Raw: 6f 6d 61 69 6e 22 2c 0a 20 20 22 50 52 4f 58 59 57 45 42 5f 53 45 43 4f 4e 44 5f 53 49 47 4e 5f 49 4e 5f 49 4e 46 4f 52 4d 41 54 49 4f 4e 5f 50 41 47 45 5f 4c 49 4e 45 31 22 3a 20 22 57 65 20 73 65 65 20 74 68 61 74 20 74 68 65 20 73 69 67 6e 2d 69 6e 20 79 6f 75 20 66 6f 6c 6c 6f 77 65 64 20 73 74 61 72 74 65 64 20 66 72 6f 6d 20 6f 75 74 73 69 64 65 20 6f 66 20 6f 75 72 20 73 65 73 73 69 6f 6e 20 63 6f 6e 74 72 6f 6c 73 22 2c 0a 20 20 22 50 52 4f 58 59 57 45 42 5f 53 45 43 4f 4e 44 5f 53 49 47 4e 5f 49 4e 5f 49 4e 46 4f 52 4d 41 54 49 4f 4e 5f 50 41 47 45 5f 4c 49 4e 45 32 22 3a 20 22 41 20 73 65 63 6f 6e 64 20 73 69 67 6e 2d 69 6e 20 55 52 4c 20 28 7b 75 72 6c 7d 29 20 20 69 73 20 6e 65 65 64 65 64 20 74 6f 20 63 6f 6e 73 75 6d 65 20 74 68 65 20 73 69 Data Ascii: omain", "PROXYWEB_SECOND_SIGN_IN_INFORMATION_PAGE_LINE1": "We see that the sign-in you followed started from outside of our session controls", "PROXYWEB_SECOND_SIGN_IN_INFORMATION_PAGE_LINE2": "A second sign-in URL ({url}) is needed to consume the si

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:14 UTC	399	OUT	GET /proxyweb/1.54.36-1-hf/images/favicon.ico?cb=1.54.146-6 HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:15 UTC	771	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:15 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Mon, 25 Mar 2024 12:17:25 GMT ETag: 0x8DC4CC5883153C5 x-ms-request-id: f377e177-c01e-007e-0f82-970321000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031215Z-17644f8887f9qfxwmwnf4q7tac0000000700000000004x55 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:15 UTC	15613	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 03:12:15 UTC	1561	IN	Data Raw: 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333""""""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:15 UTC	686	OUT	GET /proxyweb/1.54.36-1-hf/images/continue.png HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mcasproxy.cdn.mcas.ms/proxyweb/1.54.36-1-hf/css/proxyweb-all.min.css?cb=1.54.146-6 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:15 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:15 GMT Content-Type: image/png Content-Length: 2769 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Mon, 25 Mar 2024 12:17:27 GMT ETag: 0x8DC4CC58920244A x-ms-request-id: 87c73ae8-201e-004c-7282-977434000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031215Z-1865489d5f4r69rrg7uwqa73hg0000000b10000000000huh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 03:12:15 UTC	2769	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3e 00 00 00 3e 08 06 00 00 00 73 c1 a8 44 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 1e 83 00 00 1e 83 01 43 b6 d2 b3 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 0a 4e 49 44 41 54 68 81 cd 9b 7b 70 54 f5 15 c7 3f e7 b7 4b 5e 0c 0a 4a 76 43 b2 8b e0 0b 2b 22 be 10 ab f8 68 9d 6a 65 a6 6a 55 a2 a2 0e 63 c5 e6 e5 a3 be 46 69 3b 9d 75 3a e3 d8 56 45 41 48 62 c7 c1 96 41 25 2a 6a 9f 8e 76 b4 f5 01 a8 a0 54 05 ad 8a 20 d9 00 bb 49 00 41 43 42 72 ef e9 1f d9 c0 bd 37 bb c9 6e 72 57 f9 fe b5 7b ee f9 9d df f9 e6 77 73 7e e7 77 7e 67 85 3c a2 bc 71 eb d8 80 9a b3 14 99 2a 70 82 2a 51 60 3c 50 0c 1c 0a Data Ascii: PNGIHDR>>sDsBIT\|dpHYsCtEXtSoftwarewww.inkscape.org<NIDATh{pT?K^JvC+"hjejUcFi;u:VEAHbA%jvT IACBr7nrW{ws~w~g<qp*Q`<P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:15 UTC	625	OUT	GET /proxyweb/1.54.36-1-hf/images/warning.png HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mcas-proxyweb.mcas.ms/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:15 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:15 GMT Content-Type: image/png Content-Length: 2399 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Mon, 25 Mar 2024 12:17:25 GMT ETag: 0x8DC4CC5885B6AC7 x-ms-request-id: 65a61b07-401e-0066-0982-97eb12000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031215Z-17644f8887fvnmt8f6f16dxvk800000003wg000000002ad6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:15 UTC	2399	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 06 00 00 00 57 02 f9 87 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 23 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 30 20 37 39 2e 31 36 30 34 35 31 2c 20 32 30 31 37 2f 30 35 2f 30 36 2d 30 31 3a 30 38 3a 32 31 20 20 Data Ascii: PNGIHDR00WtEXtSoftwareAdobe ImageReadyqe<#iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49752	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:15 UTC	386	OUT	GET /proxyweb/1.54.36-1-hf/images/continue.png HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:15 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:15 GMT Content-Type: image/png Content-Length: 2769 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Mon, 25 Mar 2024 12:17:27 GMT ETag: 0x8DC4CC58920244A x-ms-request-id: 87c73ae8-201e-004c-7282-977434000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031215Z-17644f8887fqm2jbpnyr5t7srg000000073000000000afqc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:15 UTC	2769	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3e 00 00 00 3e 08 06 00 00 00 73 c1 a8 44 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 1e 83 00 00 1e 83 01 43 b6 d2 b3 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 0a 4e 49 44 41 54 68 81 cd 9b 7b 70 54 f5 15 c7 3f e7 b7 4b 5e 0c 0a 4a 76 43 b2 8b e0 0b 2b 22 be 10 ab f8 68 9d 6a 65 a6 6a 55 a2 a2 0e 63 c5 e6 e5 a3 be 46 69 3b 9d 75 3a e3 d8 56 45 41 48 62 c7 c1 96 41 25 2a 6a 9f 8e 76 b4 f5 01 a8 a0 54 05 ad 8a 20 d9 00 bb 49 00 41 43 42 72 ef e9 1f d9 c0 bd 37 bb c9 6e 72 57 f9 fe b5 7b ee f9 9d df f9 e6 77 73 7e e7 77 7e 67 85 3c a2 bc 71 eb d8 80 9a b3 14 99 2a 70 82 2a 51 60 3c 50 0c 1c 0a Data Ascii: PNGIHDR>>sDsBIT\|dpHYsCtEXtSoftwarewww.inkscape.org<NIDATh{pT?K^JvC+"hjejUcFi;u:VEAHbA%jvT IACBr7nrW{ws~w~g<qp*Q`<P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49756	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:16 UTC	385	OUT	GET /proxyweb/1.54.36-1-hf/images/warning.png HTTP/1.1 Host: mcasproxy.cdn.mcas.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:16 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:16 GMT Content-Type: image/png Content-Length: 2399 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Mon, 25 Mar 2024 12:17:25 GMT ETag: 0x8DC4CC5885B6AC7 x-ms-request-id: 65a61b07-401e-0066-0982-97eb12000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031216Z-1865489d5f469db67514m1tnm40000000ad0000000016get x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 03:12:16 UTC	2399	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 06 00 00 00 57 02 f9 87 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 23 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 30 20 37 39 2e 31 36 30 34 35 31 2c 20 32 30 31 37 2f 30 35 2f 30 36 2d 30 31 3a 30 38 3a 32 31 20 20 Data Ascii: PNGIHDR00WtEXtSoftwareAdobe ImageReadyqe<#iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49759	104.47.110.28	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:23 UTC	1124	OUT	GET /?url=https%3A%2F%2Fmyapps.microsoft.com%2Fsignin%2F08558f59-9161-41fc-88b3-f0434087a79c%3FtenantId%3D258ac4e4-146a-411e-9dc8-79a9e12fd6da&data=05%7C01%7Cgary.fabrizio1%40Service.wipro.com%7C8a0e1c61209e469846ba08dbe05e2370%7C258ac4e4146a411e9dc879a9e12fd6da%7C0%7C0%7C638350467206547446%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=p0jrjFUb%2Fusi2RID%2FGIlCE82AM9dEDuVAB4PHdDC1%2F4%3D&reserved=0 HTTP/1.1 Host: apc01.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:24 UTC	671	IN	HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://myapps.microsoft.com/signin/08558f59-9161-41fc-88b3-f0434087a79c?tenantId=258ac4e4-146a-411e-9dc8-79a9e12fd6da Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 4.0 X-SL-GetUrlReputation-Verdict: Good X-Robots-Tag: noindex, nofollow X-AspNet-Version: 4.0.30319 X-ServerName: TYZAPC01WS024 X-ServerVersion: 15.20.7519.025 X-ServerLat: 310 X-SafeLinks-Tracking-Id: 744b300c-6a9f-4c87-2bf4-08dc659eb190 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Fri, 26 Apr 2024 03:12:23 GMT Connection: close Content-Length: 235
2024-04-26 03:12:24 UTC	235	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 79 61 70 70 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 73 69 67 6e 69 6e 2f 30 38 35 35 38 66 35 39 2d 39 31 36 31 2d 34 31 66 63 2d 38 38 62 33 2d 66 30 34 33 34 30 38 37 61 37 39 63 3f 74 65 6e 61 6e 74 49 64 3d 32 35 38 61 63 34 65 34 2d 31 34 36 61 2d 34 31 31 65 2d 39 64 63 38 2d 37 39 61 39 65 31 32 66 64 36 64 61 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://myapps.microsoft.com/signin/08558f59-9161-41fc-88b3-f0434087a79c?tenantId=258ac4e4-146a-411e-9dc8-79a9e12fd6da">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49768	152.199.4.44	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:30 UTC	635	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:30 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2373226 Cache-Control: public, max-age=31536000 Content-MD5: 2vlVvyES905PeLIYeo1r7w== Content-Type: application/x-javascript Date: Fri, 26 Apr 2024 03:12:30 GMT Etag: 0x8DC4DBF5E20DC85 Last-Modified: Tue, 26 Mar 2024 18:05:49 GMT Server: ECAcc (mic/9BF3) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: b20c5692-d01e-00ca-11f1-81d077000000 x-ms-version: 2009-09-19 Content-Length: 141339 Connection: close
2024-04-26 03:12:30 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-04-26 03:12:30 UTC	1	IN	Data Raw: 75 Data Ascii: u
2024-04-26 03:12:30 UTC	16383	IN	Data Raw: 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3a 65 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 3f 65 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 3a 7b 7d 7d 2c 68 69 73 74 6f 72 79 3a 7b 70 75 73 68 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 5f 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 64 2e 68 69 73 74 6f 72 79 2e 70 75 73 68 53 74 61 74 65 28 65 2c 6e 29 7d 2c 72 65 70 6c 61 63 65 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 5f 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 64 2e 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 65 2c 6e 29 7d 7d 2c 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 29 7b 65 2e 61 64 64 Data Ascii: tedStyle(e,null):e.currentStyle?e.currentStyle:{}},history:{pushState:function(e,n){_.isHistorySupported()&&d.history.pushState(e,n)},replaceState:function(e,n){_.isHistorySupported()&&d.history.replaceState(e,n)}},addEventListener:function(e,n,t,r){e.add
2024-04-26 03:12:30 UTC	16383	IN	Data Raw: 53 4d 53 3a 22 38 30 30 34 33 34 45 31 22 2c 50 50 5f 45 5f 49 4e 4c 49 4e 45 4c 4f 47 49 4e 5f 49 4e 56 41 4c 49 44 5f 41 4c 54 3a 22 38 30 30 34 33 34 45 32 22 2c 50 50 5f 45 5f 50 52 45 56 49 4f 55 53 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 31 30 31 33 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 57 52 4f 4e 47 3a 22 38 30 30 34 35 35 30 35 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 46 41 54 41 4c 3a 22 38 30 30 34 35 35 33 37 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 55 4e 41 55 54 48 45 4e 54 49 43 41 54 45 44 3a 22 38 30 30 34 35 35 33 38 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 4f 54 48 45 52 3a 22 Data Ascii: SMS:"800434E1",PP_E_INLINELOGIN_INVALID_ALT:"800434E2",PP_E_PREVIOUS_PASSWORD:"80041013",PP_E_HIP_VALIDATION_WRONG:"80045505",PP_E_HIP_VALIDATION_ERROR_FATAL:"80045537",PP_E_HIP_VALIDATION_ERROR_UNAUTHENTICATED:"80045538",PP_E_HIP_VALIDATION_ERROR_OTHER:"
2024-04-26 03:12:30 UTC	16383	IN	Data Raw: 5b 5d 3b 69 66 28 65 29 66 6f 72 28 76 61 72 20 6f 3d 30 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 6f 3c 69 3b 6f 2b 2b 29 72 2e 70 75 73 68 28 6e 2e 63 61 6c 6c 28 74 2c 65 5b 6f 5d 2c 6f 29 29 3b 72 65 74 75 72 6e 20 72 7d 2c 6a 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 5b 5d 3b 69 66 28 65 29 66 6f 72 28 76 61 72 20 6f 3d 30 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 6f 3c 69 3b 6f 2b 2b 29 6e 2e 63 61 6c 6c 28 74 2c 65 5b 6f 5d 2c 6f 29 26 26 72 2e 70 75 73 68 28 65 5b 6f 5d 29 3b 72 65 74 75 72 6e 20 72 7d 2c 4e 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 65 2e 70 75 73 68 2e 61 70 70 6c 79 28 65 2c 6e 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 74 3d 30 2c 72 3d Data Ascii: [];if(e)for(var o=0,i=e.length;o<i;o++)r.push(n.call(t,e[o],o));return r},jb:function(e,n,t){var r=[];if(e)for(var o=0,i=e.length;o<i;o++)n.call(t,e[o],o)&&r.push(e[o]);return r},Nb:function(e,n){if(n instanceof Array)e.push.apply(e,n);else for(var t=0,r=
2024-04-26 03:12:30 UTC	16383	IN	Data Raw: 72 65 74 75 72 6e 21 21 65 7d 2c 53 2e 5a 61 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 28 65 5b 54 5d 3d 3d 3d 50 5b 54 5d 7c 7c 65 5b 54 5d 3d 3d 3d 53 2e 6f 2e 66 6e 5b 54 5d 26 26 65 2e 4e 63 29 7d 2c 53 2e 62 28 22 6f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 74 61 29 2c 53 2e 62 28 22 69 73 4f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 4f 29 2c 53 2e 62 28 22 69 73 57 72 69 74 65 61 62 6c 65 4f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 5a 61 29 2c 53 2e 62 28 22 69 73 57 72 69 74 61 62 6c 65 4f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 5a 61 29 2c 53 2e 62 28 22 6f 62 73 65 72 76 61 62 6c 65 2e 66 6e 22 2c 50 29 2c 53 2e 4c 28 50 2c 22 70 65 65 6b 22 2c 50 2e 76 29 2c 53 2e 4c 28 50 Data Ascii: return!!e},S.Za=function(e){return"function"==typeof e&&(e[T]===P[T]\|\|e[T]===S.o.fn[T]&&e.Nc)},S.b("observable",S.ta),S.b("isObservable",S.O),S.b("isWriteableObservable",S.Za),S.b("isWritableObservable",S.Za),S.b("observable.fn",P),S.L(P,"peek",P.v),S.L(P
2024-04-26 03:12:30 UTC	4	IN	Data Raw: 75 6c 6c 2c Data Ascii: ull,
2024-04-26 03:12:30 UTC	16383	IN	Data Raw: 65 29 2e 62 69 6e 64 69 6e 67 43 6f 6e 74 65 78 74 46 6f 72 44 65 73 63 65 6e 64 61 6e 74 73 29 2c 74 26 26 21 62 5b 53 2e 61 2e 52 28 6e 29 5d 26 26 64 28 74 2c 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 6e 2c 74 29 7b 76 61 72 20 6f 2c 69 3d 53 2e 61 2e 67 2e 55 62 28 65 2c 45 2c 7b 7d 29 2c 73 3d 69 2e 68 64 3b 69 66 28 21 6e 29 7b 69 66 28 73 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 59 6f 75 20 63 61 6e 6e 6f 74 20 61 70 70 6c 79 20 62 69 6e 64 69 6e 67 73 20 6d 75 6c 74 69 70 6c 65 20 74 69 6d 65 73 20 74 6f 20 74 68 65 20 73 61 6d 65 20 65 6c 65 6d 65 6e 74 2e 22 29 3b 69 2e 68 64 3d 21 30 7d 69 66 28 73 7c 7c 28 69 2e 63 6f 6e 74 65 78 74 3d 74 29 2c 69 2e 5a 62 7c 7c 28 69 2e 5a 62 3d 7b 7d 29 2c 6e 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d Data Ascii: e).bindingContextForDescendants),t&&!b[S.a.R(n)]&&d(t,n)}function p(e,n,t){var o,i=S.a.g.Ub(e,E,{}),s=i.hd;if(!n){if(s)throw Error("You cannot apply bindings multiple times to the same element.");i.hd=!0}if(s\|\|(i.context=t),i.Zb\|\|(i.Zb={}),n&&"function"!=
2024-04-26 03:12:30 UTC	16383	IN	Data Raw: 65 2c 22 63 68 61 6e 67 65 22 5d 29 2c 28 6c 7c 7c 53 2e 53 2e 59 61 28 29 29 26 26 53 2e 69 2e 6d 61 28 65 2c 53 2e 69 2e 48 29 2c 53 2e 61 2e 77 64 28 65 29 2c 75 26 26 32 30 3c 4d 61 74 68 2e 61 62 73 28 75 2d 65 2e 73 63 72 6f 6c 6c 54 6f 70 29 26 26 28 65 2e 73 63 72 6f 6c 6c 54 6f 70 3d 75 29 7d 7d 2c 53 2e 63 2e 6f 70 74 69 6f 6e 73 2e 24 62 3d 53 2e 61 2e 67 2e 5a 28 29 2c 53 2e 63 2e 73 65 6c 65 63 74 65 64 4f 70 74 69 6f 6e 73 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 76 61 72 20 72 3d 6e 28 29 2c 6f 3d 5b 5d 3b 53 2e 61 2e 44 28 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6f 70 74 69 6f 6e 22 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 65 6c Data Ascii: e,"change"]),(l\|\|S.S.Ya())&&S.i.ma(e,S.i.H),S.a.wd(e),u&&20<Math.abs(u-e.scrollTop)&&(e.scrollTop=u)}},S.c.options.$b=S.a.g.Z(),S.c.selectedOptions={init:function(e,n,t){function r(){var r=n(),o=[];S.a.D(e.getElementsByTagName("option"),(function(e){e.sel
2024-04-26 03:12:30 UTC	16383	IN	Data Raw: 3d 6f 2e 4b 65 79 43 6f 64 65 3b 66 75 6e 63 74 69 6f 6e 20 66 28 65 29 7b 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 3f 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3a 65 2e 72 65 74 75 72 6e 56 61 6c 75 65 3d 21 31 7d 6e 2e 61 70 70 6c 79 45 78 74 65 6e 73 69 6f 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 3d 31 2c 6f 3d 7b 7d 3b 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2e 6c 6f 61 64 65 72 73 2e 75 6e 73 68 69 66 74 28 7b 6c 6f 61 64 43 6f 6d 70 6f 6e 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2e 64 65 66 61 75 6c 74 4c 6f 61 64 65 72 2e 6c 6f 61 64 43 6f 6d 70 6f 6e 65 6e 74 28 6e 2c 74 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 69 3b 74 2e 65 6e 61 62 6c 65 Data Ascii: =o.KeyCode;function f(e){e.preventDefault?e.preventDefault():e.returnValue=!1}n.applyExtensions=function(e){var n,t=1,o={};e.components.loaders.unshift({loadComponent:function(n,t,r){e.components.defaultLoader.loadComponent(n,t,(function(n){var i;t.enable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49776	13.107.213.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:32 UTC	658	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:32 UTC	775	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:32 GMT Content-Type: text/css Content-Length: 20314 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 27 Dec 2023 18:18:12 GMT ETag: 0x8DC07082FBB8D2B x-ms-request-id: d2ede606-801e-0006-2061-971f92000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031232Z-1865489d5f47qbmbt8czrx60cn0000000ayg000000007nrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:32 UTC	15609	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 6b 73 e3 36 b2 e8 f7 f9 15 5c a7 52 3b ce 4a 8c 48 3d 2d 57 52 3b 99 cc 26 3e 67 5e 35 33 d9 47 a5 52 5b b4 44 59 3c 43 89 ba 24 65 8f 57 47 ff fd e2 8d 06 d0 20 29 8f b3 d9 7b 2b 27 67 13 0b dd 6c 00 dd 8d 06 1a e8 06 be fe ea 0f c1 f3 62 77 5f 66 37 eb 3a 78 fa fc 3c 78 95 2d ca a2 2a 56 35 29 2f 77 45 99 d4 59 b1 0d 83 67 79 1e 30 a4 2a 28 d3 2a 2d 6f d3 65 18 7c f5 f5 d7 5f fd e1 49 bf fb ff 05 ef 3f 3c 7b f7 21 78 f3 97 e0 c3 8f 57 ef be 0f de 92 5f ff 08 5e bf f9 70 f5 fc 45 d0 99 ca 93 27 1f d6 59 15 ac b2 3c 0d c8 7f af 93 2a 5d 06 c5 36 28 ca 20 db 2e 44 ab d3 2a d8 90 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 f4 21 cf aa 9a 7c 74 9d e6 c5 5d f0 94 90 2b 97 c1 db a4 ac ef 83 ab b7 e7 61 f0 81 e0 16 Data Ascii: }ks6\R;JH=-WR;&>g^53GR[DY<C$eWG ){+'glbw_f7:x<x-V5)/wEYgy0(-oe\|_I?<{!xW_^pE'Y<]6( .D*Y:ve?!\|t]+a
2024-04-26 03:12:32 UTC	4705	IN	Data Raw: 7d df b0 68 ac ab 2c aa b1 88 da cb c6 22 89 f4 a2 b1 42 53 1e da 58 e7 55 1e b5 fb a5 96 31 c6 85 9c 5c 95 58 0f 77 34 04 a7 bc ef e9 bc 62 55 e4 cb 9d 46 11 60 f2 34 8a 20 ba 0a e1 1d 2d b3 ba 41 d4 6a 33 50 25 58 6c a8 15 02 68 eb 56 83 ba b5 a0 21 5d f4 aa e1 60 30 5e 26 13 b7 4f 5a e3 0c 32 50 fb 10 40 6b 9f fc 5a d9 82 86 f5 c9 a7 ad bc 4f 0f 53 c6 3e 8f 75 ef 81 fb bb e5 60 13 bf d0 d1 86 c0 d4 70 43 60 72 bc 81 ca 0c ee 7b ca cd 06 61 90 56 01 34 34 b4 0d 0f 13 81 b8 e1 dc 70 52 d0 d3 64 f3 b6 df 8a 2c 1c d2 a7 e1 c5 ec 1c b9 2b 18 00 b1 42 22 26 de 7d 9d 59 8d 1f 8e 83 89 00 6e 65 8f 64 aa a2 fc c3 d8 65 70 5f b6 f7 9c 65 7e ea 83 9d 2c f7 31 10 e4 08 df ce 47 c4 df 33 f4 3c 40 c9 2e 2b 17 af 8a ce 37 c9 36 db ed 73 c6 5e f7 a6 5d 71 27 8b f1 12 Data Ascii: }h,"BSXU1\Xw4bUF`4 -Aj3P%XlhV!]`0^&OZ2P@kZOS>u`pC`r{aV44pRd,+B"&}Ynedep_e~,1G3<@.+76s^]q'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49777	13.107.213.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:32 UTC	635	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:33 UTC	792	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:32 GMT Content-Type: application/x-javascript Content-Length: 121212 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 27 Mar 2024 20:03:18 GMT ETag: 0x8DC4E98F25B224F x-ms-request-id: d42e42c5-701e-0069-4c22-96d4af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031232Z-1865489d5f4r69rrg7uwqa73hg0000000awg00000000f5uu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:33 UTC	15592	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 6d 7b e3 38 8e 00 f8 fd 7e 85 a3 99 cb d8 1d c5 25 f9 dd 4a ab b3 ae bc 54 65 3b 89 33 71 aa bb 77 53 99 3c b2 44 3b ea c8 92 57 92 f3 32 8e f7 b7 1f 00 92 12 65 cb a9 aa d9 bd bb e7 9e eb 9d ad 58 24 48 82 20 08 82 20 08 7e f8 69 e7 ff a8 fc 54 d9 ff fe ff 2a a3 9b c1 f5 4d 65 78 5a b9 f9 7c 76 7d 5c b9 82 af ff a8 5c 0e 6f ce 8e 4e be bf 1e 6c 14 ff ff e6 c1 4f 2a 13 3f 60 15 f8 3b 76 12 e6 55 a2 b0 12 c5 15 3f 74 a3 78 1e c5 4e ca 92 ca 0c fe 8d 7d 27 a8 4c e2 68 56 49 1f 58 65 1e 47 7f 32 37 4d 2a 81 9f a4 50 68 cc 82 e8 b9 52 85 ea 62 af 72 e5 c4 e9 6b e5 ec aa 56 87 fa 19 d4 e6 4f fd 10 4a bb d1 fc 15 7e 3f a4 95 30 4a 7d 97 55 9c d0 a3 da 02 f8 08 13 56 59 84 1e 8b 2b cf 0f be fb 50 b9 f0 dd 38 4a a2 49 5a 89 99 Data Ascii: m{8~%JTe;3qwS<D;W2eX$H ~iTMexZ\|v}\\oNlO?`;vU?txN}'LhVIXeG27M*PhRbrkVOJ~?0J}UVY+P8JIZ
2024-04-26 03:12:33 UTC	16384	IN	Data Raw: e9 cb 27 9f 3d a3 6d 30 b0 96 7c 26 fd 96 25 94 cd 6e 7f 53 66 e2 3e 4f 84 75 40 c2 24 a5 97 0f f8 d6 24 84 7c 74 3a 5e e5 77 0c 50 d0 e0 48 a7 e4 a8 89 96 43 e0 35 59 9f 95 56 9b 2d 34 b0 bd 86 78 37 2c c4 37 73 77 22 75 f3 e1 5f 38 2f 74 af 05 16 86 5f 43 fe 3c 3d 39 b2 67 1c 9f bc bd 49 de aa 97 df 9b a9 fe 68 8d 30 ef 14 1b 60 52 e4 74 98 9b 75 8a ef 91 f0 a7 31 48 37 d3 fe f2 df 7f b9 60 a8 33 a1 2e 75 7f 3e 82 6f 1e 4f 8c 79 f6 52 04 b2 e2 af 08 43 ce 9c 3f 54 ca 0f 32 10 12 63 4c 89 fd 03 e6 67 01 0a f2 87 0f 44 95 f2 8d d3 22 98 48 5c 6b 9a 42 5e 70 61 84 28 5c 46 29 86 d1 a3 bd 16 05 99 a2 9f 57 bf 1f 5b 26 de 65 7f c0 58 1c f8 ec 2e 8f 58 26 6d 0a 32 b0 08 46 e5 c8 43 8b 90 d6 78 01 6b ee 20 f0 9d 84 82 72 cd c6 e8 57 cf 9f 5b 90 0f ec 96 26 8b Data Ascii: '=m0\|&%nSf>Ou@$$\|t:^wPHC5YV-4x7,7sw"u_8/t_C<=9gIh0`Rtu1H7`3.u>oOyRC?T2cLgD"H\kB^pa(\F)W[&eX.X&m2FCxk rW[&
2024-04-26 03:12:33 UTC	16384	IN	Data Raw: 62 00 67 7f 3b 0e f0 ad 2d 3e 8d 03 4c e7 25 87 ea 49 53 05 7d 91 d4 77 88 1c 5b f5 7b 53 3c f7 93 52 d4 97 70 ed 39 16 a9 0f f6 14 9e ad 6e f9 ab 6b cf b7 ce a1 08 89 38 c2 07 32 dd 4e a2 51 e0 a8 5f 6f 98 2b 47 5e 43 39 3c 36 3c 3e 00 d7 be 8c 05 0a 76 15 8f 21 70 9e 2a e1 3c 42 bc af 55 85 42 84 da 64 d2 d5 39 7a 3e df d8 20 df e7 12 c9 41 d5 10 64 fb e1 44 01 fd a8 86 aa 1e 57 90 19 62 73 47 65 d4 24 b5 91 9c 7e c8 5e 41 a1 84 24 bb 94 97 d7 01 23 26 9f 51 70 06 ff e4 57 80 e6 50 90 22 e9 15 56 47 25 ff c0 82 3b 40 7a 52 f2 44 2c ef 09 85 9d 40 3c 3c 43 d9 95 76 bf 03 08 0f 24 a1 c2 43 cc 8e 5f 7b dc 2a 20 38 f0 57 7b 5d 2f 26 76 45 97 04 b9 6d 28 10 45 41 67 52 3f 62 77 69 51 86 02 01 72 64 32 d7 64 5b 5f d4 74 32 50 b3 a0 41 b9 bd 66 61 6f 2c 17 f3 Data Ascii: bg;->L%IS}w[{S<Rp9nk82NQ_o+G^C9<6<>v!p<BUBd9z> AdDWbsGe$~^A$#&QpWP"VG%;@zRD,@<<Cv$C_{ 8W{]/&vEm(EAgR?bwiQrd2d[_t2PAfao,
2024-04-26 03:12:33 UTC	16384	IN	Data Raw: e4 f7 00 90 14 f2 82 3d 01 00 46 7d 9c b9 cf 35 2a 47 52 fc 3e 8d 46 71 7e bf c3 da ab b0 8f d1 e8 2e ba cf 1c 34 d6 c4 43 09 38 08 73 c8 77 c2 07 ad 32 15 b4 fd 5e 9a 22 35 0a bf f8 c8 c0 0f 46 07 83 36 d9 35 52 80 79 5a 78 ba 59 27 74 b3 e2 7e c5 1c 91 e4 bf 83 28 94 86 98 a3 be 72 87 73 d3 0f 73 fe b5 47 47 8c 7e 0e 7b 6c e3 f9 63 8f 81 d6 71 73 9f 15 4a 1d e9 1d d7 e1 72 99 57 cd c2 33 88 2f ef 5e c6 b2 8c 81 2c 3b 22 62 20 ee 9b bc 7f 13 b4 ca 31 28 43 d2 61 8f 11 21 e4 6d b8 72 30 6a 70 5e 31 e0 96 9a 85 f2 de 03 73 54 33 d4 f3 93 53 51 53 93 a0 ad 34 98 91 c5 e6 56 75 84 a9 60 69 ad 4d c6 d6 eb f8 db a3 d6 4e cc d9 10 4f 92 07 ee df 79 fe 5d f3 77 fe 90 72 90 bb f0 e1 77 1b 88 8b e6 69 f8 20 ed df ce ce 31 bc 78 d6 0f db 73 3f 53 87 6f 81 32 2c 49 Data Ascii: =F}5*GR>Fq~.4C8sw2^"5F65RyZxY't~(rssGG~{lcqsJrW3/^,;"b 1(Ca!mr0jp^1sT3SQS4Vu`iMNOy]wrwi 1xs?So2,I
2024-04-26 03:12:33 UTC	16384	IN	Data Raw: 5b fb 6e 83 b4 3b 96 d2 db 35 84 0e 7c 7d 7f 2e ec 22 48 f2 75 1f d6 18 85 c9 a1 b2 1f 7f a3 8a 39 6c 2d 74 7a 4e 14 50 e5 31 6a 69 9a 2d 97 43 d5 70 c6 6c 11 21 17 76 e4 96 7a ff 42 e3 58 37 18 24 e6 cf 14 ba 51 1b ef 5d c3 1a 65 90 14 40 cd 2a 32 6f a4 54 88 c0 49 10 06 eb 03 46 9c 4e 5e 96 92 86 37 3e 0d cf dc c1 da 5a 28 89 fc 60 1a 28 48 88 cd ce e8 5e 06 98 c5 5c 19 5d 03 12 69 44 6f 7f 9f f7 71 28 41 c6 e1 c3 95 38 6c b9 ce d5 75 aa 00 2b 68 a1 6c 60 d1 a0 52 e6 e5 17 c9 1a 92 16 89 ab c6 e8 71 1b 86 d9 b1 22 fe 30 10 14 7b d4 5f 13 a1 9c ab 9f e1 17 e2 25 68 4f 4c 4c b4 0f 9d c7 ba cf de 75 70 f1 7c f2 f0 b0 e1 d1 a7 d6 2e d6 36 06 ba 87 d9 cb 60 c2 66 0f dc 88 82 c2 9b 89 50 0b 20 61 80 73 4c 1d 12 a9 d7 ae c1 07 ce 9d 75 2f 7b be 41 67 d0 cb 60 Data Ascii: [n;5\|}."Hu9l-tzNP1ji-Cpl!vzBX7$Q]e@*2oTIFN^7>Z(`(H^\]iDoq(A8lu+hl`Rq"0{_%hOLLup\|.6`fP asLu/{Ag`
2024-04-26 03:12:33 UTC	16384	IN	Data Raw: 7e e0 d9 16 67 96 07 dd 24 06 a6 67 2e 3a 13 22 4e b9 73 c3 7d 82 d5 6e 0c ea d9 91 1f 4a 28 29 42 84 10 bd 29 34 59 91 49 cb 71 33 c8 8f cc 8f f8 6e 3a 4b 3c 1b aa 5e ec 0a 88 73 a8 c7 2e 70 1b 4c 50 30 61 b9 01 0b 63 77 37 eb 64 34 23 cb 0f 33 61 45 71 04 25 c5 b1 53 c9 5c 11 3b 99 6b 5b 8e c3 3d 58 06 bb e9 2c b1 21 16 dc 14 aa 44 c8 05 38 b8 25 18 83 25 e0 07 a4 b2 40 4f be d9 36 cb 6a 37 46 33 8a 63 d8 a3 2e 4c 98 48 78 31 73 1d c1 63 c9 a5 6b 65 41 40 42 72 37 f4 e4 25 16 68 34 62 69 e6 63 4d 2c 1f 82 c9 e1 2c f6 3c d2 9e 03 08 f6 dd 4c 9d d1 8c 52 1f e4 93 49 2f b2 c0 c6 dd d0 b2 bd c8 66 98 4d b0 58 61 59 ce 4e 38 b9 e3 27 8e 23 20 f3 32 32 0b 6d 2b 86 24 77 98 b0 3d 3b 82 7c 8f bc 30 0e 77 d2 8d d1 8c 62 e1 87 91 6d 05 ae 13 79 96 45 03 b3 52 cb Data Ascii: ~g$g.:"Ns}nJ()B)4YIq3n:K<^s.pLP0acw7d4#3aEq%S\;k[=X,!D8%%@O6j7F3c.LHx1sckeA@Br7%h4bicM,,<LRI/fMXaYN8'# 22m+$w=;\|0wbmyER
2024-04-26 03:12:33 UTC	16384	IN	Data Raw: 3b 5e 4f df 33 30 3a ba 6c ef 2b 3a 09 a6 ef 19 71 32 ea e5 2b 63 f2 57 d2 2a 7f b7 60 96 9b 2d 2a c8 61 5b 2e 04 2d e7 db e7 41 5b 04 47 33 d3 7e 65 e5 34 a3 a2 f1 6d 39 81 97 d9 3d 37 d1 47 77 c7 cf ae ac a3 7e b9 fe 73 95 9a 79 cd 32 ea 2c f1 d5 f7 5f 84 2c df 2e 8a b3 a3 b2 78 fc 41 f2 f3 c5 8a 57 68 fd f3 97 db d1 19 9b 37 35 a3 bf 7e 25 fe ff 55 a8 db 34 7e 33 ba 36 60 7f 6d 8a fe a6 f0 b3 59 b6 ba f3 64 63 5b d5 f7 3f 22 46 1c 9d 49 29 d2 f3 d3 b3 9d 8b f3 16 e6 94 a6 9b 6f 50 9e ff e1 f1 6e 87 12 f2 3f 5e ab 2d 0e d9 fc 01 6c d8 df 20 f2 e7 9b 30 53 5e e6 53 59 5e 47 da 2d a8 c2 37 e6 26 ff ed dc 97 3b 54 32 4b 9a fa 6a 5d ab 55 6e 9f 44 a2 bc 68 8d 32 0f e9 00 50 ef 6f 3d eb 4b 1c e9 3a 79 71 fe 9a b6 39 21 77 9d e0 b2 46 7e 54 90 2d 09 4e 07 af Data Ascii: ;^O30:l+:q2+cW`-a[.-A[G3~e4m9=7Gw~sy2,_,.xAWh75~%U4~36`mYdc[?"FI)oPn?^-l 0S^SY^G-7&;T2Kj]UnDh2Po=K:yq9!wF~T-N
2024-04-26 03:12:33 UTC	7316	IN	Data Raw: c3 63 98 d0 fe fd 26 b7 b8 5e e2 81 fb 3e 31 42 65 52 c6 b5 42 41 83 fd 4b 62 cc fd 28 d8 9f 11 23 a5 e4 6b ff 86 18 3e a7 51 fb 1f a1 7e 99 70 ed bf 03 f0 97 a9 d6 fe 29 d4 bf a6 3b f1 d0 9d cf d1 74 b5 1f 1b 21 13 9e f2 27 d9 dd 53 1c fb 65 27 ea f6 30 8e 31 9f 72 87 4d 36 ee 76 7b c0 00 e3 4e 16 1b 6e dc bd cb 57 3c 93 27 8f f3 04 ec d9 f9 0d 56 87 a0 f0 0c fb 60 81 44 01 57 00 16 8c 4c 2b 4f 31 d3 d5 57 3e ba fd 1d d3 40 89 80 66 59 20 bd f7 fc 2b 30 6a a4 3d fc e9 8b fc c7 ed 2d e9 71 60 bd 02 66 7d bd f8 91 dc dc 15 23 73 63 ee 41 c1 47 45 07 85 e3 a2 c1 6f bb e9 e7 28 f3 2f 3b fc 67 0f 6f f0 75 bf fa 6e 4a 5a 1f 7b 07 b0 0c 5c b8 dc 8f a9 90 82 e4 16 49 90 97 7c e1 15 60 83 bf 49 e2 e7 f3 c4 ff 88 31 b4 f1 59 e7 97 de e1 bb d9 e9 2f 2f a4 e8 a6 39 Data Ascii: c&^>1BeRBAKb(#k>Q~p);t!'Se'01rM6v{NnW<'V`DWL+O1W>@fY +0j=-q`f}#scAGEo(/;gounJZ{\I\|`I1Y//9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49778	13.107.213.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:32 UTC	654	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:33 UTC	797	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:32 GMT Content-Type: application/x-javascript Content-Length: 15799 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 28 Mar 2024 02:23:53 GMT ETag: 0x8DC4ECE1D0444D4 x-ms-request-id: c7963ec0-201e-0048-0105-946e9e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031232Z-17644f8887fhxv4mpnn600zp3000000006tg000000006k5m x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:33 UTC	15587	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dd 7d 4d 73 23 47 b2 d8 dd bf 02 8b 75 68 86 4f 3d 10 3e f8 89 11 34 06 01 70 06 4f 24 00 01 e0 50 0a 49 46 34 81 22 d8 4b a0 1b af bb 31 1c 2e 35 8e bd f9 f0 0e be da 37 1f 7c f2 d1 17 df fd 53 36 e2 f9 77 38 3f aa aa ab ba 1b 00 39 d2 d3 ee b3 42 c1 41 77 55 65 65 65 65 65 65 66 65 65 ff e1 66 ed 4f 63 2f f0 5f 8a bd 47 f5 bb 10 bc f4 f7 1e bd 9b 97 de 8f fe cf 7b a1 88 d7 a1 5f c0 df 25 f1 71 15 84 71 f4 fa 83 1b 16 e2 06 be 6a 3c ca 77 f5 c7 4f 8e 37 ab fb ce 22 70 67 62 56 ff 43 e5 d3 6b d9 54 60 d3 a9 bb 58 bc 8c 15 04 27 76 92 df c1 1e 3c 70 b3 c6 1f ca 49 c1 27 ec c6 6b 3c 6a 40 41 69 d9 10 4e 50 9a 36 3c f8 bb 6a 14 8b 4e f0 b2 bc f7 e9 e5 8f c9 30 9c c0 f1 00 f9 97 d5 3d c2 d2 6f 78 2f 2b 00 1f fe 39 d8 73 42 f8 e7 Data Ascii: }Ms#GuhO=>4pO$PIF4"K1.57\|S6w8?9BAwUeeeeeefeefOc/_G{_%qqj<wO7"pgbVCkT`X'v<pI'k<j@AiNP6<jN0=ox/+9sB
2024-04-26 03:12:33 UTC	212	IN	Data Raw: 4c d9 50 88 3d 11 31 a3 82 91 44 92 9b ac 27 fa 55 71 d0 e8 52 b2 83 36 27 fc b6 dc 23 94 e3 1e 80 37 6e 69 ad 92 7b 01 76 8e 29 d0 a4 f3 81 4e a5 61 fe e9 d7 44 09 47 be c4 aa 78 02 e5 da 24 f0 cf 03 17 6f 15 81 0e 9b 57 59 59 50 76 65 74 81 91 0e 08 e2 ca 8f 9f d0 09 e6 cc 63 f5 01 0c 1d b1 ff ac b6 da 7e a0 7c 70 78 3f 7a 67 ef 29 ac ad fb a8 08 00 af bb ab 0b 46 ef 41 74 8a 4c fb 39 f7 de 8d 28 4c 4b db fa 95 7d d4 f5 b7 b4 b4 70 4f 6e 04 ef ef ec d2 6a c8 b3 29 ad 7d 6c 5b d9 81 ae 31 dc 64 9c fb e5 ea ce 71 1a 0d 53 9d 56 9f d3 e9 b7 17 a3 2e 37 aa 7e fa f4 f3 9e c3 b9 43 4b 93 49 e3 0f e5 d7 ff 0f de d8 74 96 1f d7 00 00 Data Ascii: LP=1D'UqR6'#7ni{v)NaDGx$oWYYPvetc~\|px?zg)FAtL9(LK}pOnj)}l[1dqSV.7~CKIt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49781	13.107.213.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:33 UTC	577	OUT	GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:34 UTC	797	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:34 GMT Content-Type: application/x-javascript Content-Length: 61052 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 25 May 2023 17:22:47 GMT ETag: 0x8DB5D44A8CEE4F4 x-ms-request-id: bb4e089b-901e-0023-3557-9309ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031234Z-17644f8887fhxv4mpnn600zp3000000006wg000000003u46 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:34 UTC	15587	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 cc bd 69 77 db 46 b2 30 fc fd fe 0a 0a 27 57 03 8c da 34 29 2f 71 48 23 bc b2 44 db 4c b4 45 4b 9c 8c ac d1 81 c8 96 04 9b 04 18 00 94 ac 91 f8 df 9f aa ea 1d 04 28 29 c9 7d ef 7b 12 8b 40 a3 7a af ae ae ae ae c5 bf 89 93 51 7a d3 2c f8 98 4f 78 91 dd 9e dd f0 f3 69 34 fc fa 53 9e 26 d3 70 e9 d7 fb fb 93 d3 a0 39 9d e5 57 fe c9 c9 fa 29 3b 61 8c 5d cc 92 61 11 a7 89 cf 59 c1 92 e0 ce 9b e5 bc 91 17 59 3c 2c bc 6e d2 cc fc 22 60 49 73 e4 17 cc fb 35 1a cf f8 cf 50 81 c7 7c 9d 2d b8 cb 78 31 cb 92 46 d6 e4 f3 40 c3 f6 af 79 52 6c 47 05 4f 86 b7 35 e0 51 19 7c 9f 67 79 9c 63 16 5e 93 e5 dc ca 72 94 45 43 be cd af f9 b8 06 78 64 01 6f 4c a7 83 24 8f 2f af 8a 7c 33 cd aa 8b 8f 9d 16 bd 8b 72 5e 0b 6a 17 7d d6 ff 06 4d 1e f1 d1 20 Data Ascii: iwF0'W4)/qH#DLEK()}{@zQz,Oxi4S&p9W);a]aYY<,n"`Is5P\|-x1F@yRlGO5Q\|gyc^rECxdoL$/\|3r^j}M
2024-04-26 03:12:34 UTC	16384	IN	Data Raw: 11 ba 78 22 35 03 45 5f ae b8 15 0a 6b 9f 0b 6f 06 46 14 14 a0 01 d4 75 81 77 09 f9 14 b6 80 d5 55 f7 1d da c5 86 b6 4e 3c e4 1f ba 37 9b b7 b5 c3 23 d4 c8 84 ec 45 b0 c9 37 15 f4 52 19 68 52 db 84 ba 3a 93 b3 c0 d0 32 cd 34 96 c5 e1 77 a8 86 82 5b a0 e4 0c 44 e8 9f fe b7 62 f3 e2 12 ef cd f4 45 86 1d 76 a9 ca dd 36 79 da 4e 84 b4 06 0b 02 f6 93 7c 32 6b 9e 1f 01 48 1d b9 b0 1d 0e 45 73 ff 0a 48 49 e1 df 50 90 3f 40 e9 4f 5c e1 0c 8a 9e 20 e1 3d f7 f7 d8 4d ad e8 59 f6 8d fc 90 12 fc 6f ee 36 ee 97 d9 84 b2 55 80 c3 3d dc ed cb 9b 20 58 b6 fb e2 12 a8 93 cc bb ce 09 d9 17 b7 1b 9e c3 3b 01 49 81 06 e2 8a cd c8 00 2b 23 63 ac 8c 91 a8 99 6f 92 81 56 7b 8e f7 8d b2 42 9c 4a 97 0c 0b bf 45 f5 d2 62 f4 5e b0 ec 3b b3 a4 63 b8 24 72 e0 05 15 1f 7d e2 3d 3f 37 Data Ascii: x"5E_koFuwUN<7#E7RhR:24w[DbEv6yN\|2kHEsHIP?@O\ =MYo6U= X;I+#coV{BJEb^;c$r}=?7
2024-04-26 03:12:34 UTC	16384	IN	Data Raw: 15 db ec c7 f1 16 6d 6f 68 90 c6 f2 9e eb 33 2a c7 18 89 31 56 eb 59 ec bb 71 89 7f aa 93 e3 73 84 51 29 6d 4a 14 bb 22 63 6f 55 2c 47 e7 05 5d 5b 13 bf a6 ac 26 93 2d 98 72 a5 b7 e5 5a dc 5a c8 41 d4 fd e4 3e 1d 71 da 8f 3c 15 aa a8 02 27 5f eb 0a 69 e7 9e 8a 73 ab 65 64 09 18 b0 07 f0 47 1a e5 af 1f a1 b3 aa 6f 4a be 45 d8 0b 7b 11 7c 72 79 14 0f bd 57 cd 6e 76 d1 ec b5 e1 b3 8d 9d 95 66 c2 ca 10 cd 0f a3 7c 90 c5 ac c9 5a ae fa 7f c2 e6 88 97 22 c9 e1 52 b2 22 5d 8a f0 0f 96 12 40 d3 a5 e8 7c be 94 98 1b 2d 25 d5 4c 26 46 3d 61 3a 5c 4a 00 f5 97 a2 e2 77 4b d1 f9 c9 52 72 ef 6a 29 b9 77 6c 21 fc db 40 f8 5d c6 fc 1b 37 be c9 6d fc 7a 4e 9b e8 e0 a1 68 5f 34 7d d6 b3 76 7a fe 9b e8 2e 1e 44 9c d8 a2 fa f9 8d 92 11 d2 4d a4 6e 0a 47 ef 48 fc 1c f5 39 69 Data Ascii: moh3*1VYqsQ)mJ"coU,G][&-rZZA>q<'_isedGoJE{\|ryWnvf\|Z"R"]@\|-%L&F=a:\JwKRrj)wl!@]7mzNh_4}vz.DMnGH9i
2024-04-26 03:12:34 UTC	12697	IN	Data Raw: 3a 78 d7 71 cb 0f 05 12 73 65 5f 43 ee b5 a6 0a 6e 83 08 03 ba f6 3a d7 c1 f5 6c 76 ab 4e 60 47 68 19 58 60 f5 1f 5e bb c3 54 de 2e 80 82 4f c9 76 ef a4 d4 b5 72 0a ee 68 55 55 91 83 40 67 5f dc f5 4a 1c f6 94 3e 3d 7d 79 a0 3e 39 55 07 e7 28 38 b8 38 65 d6 f5 5b 91 70 12 1c 69 47 2b 47 a6 a3 95 0e 6d 81 13 58 fc 26 42 bf 8e 1d ad 38 fe 3e ed 53 99 91 95 ee 68 64 66 52 9b 89 03 08 8d 1b 82 51 74 a5 1c f1 3a ed 15 45 74 3b 29 5e 35 bb d6 fb fa 7a db 7a 27 1a 93 ee 23 3d 44 bf 15 6d ad 43 c0 d2 64 91 ac 81 29 f3 92 ec 05 5f 59 d7 da da 65 be a6 3f da b7 38 0a be 24 da e8 8d 01 b8 41 ae b4 0b ff d2 ba a5 24 85 d5 3e 9e 97 b0 f2 d1 73 cf a0 45 b4 57 a1 27 69 f7 9e 79 d0 2d 71 2f 29 4f 51 86 ce 20 a4 8e 6f 80 45 9c a5 63 47 7c 28 33 2f 2a 99 bd c0 49 d2 0d 4e Data Ascii: :xqse_Cn:lvN`GhX`^T.OvrhUU@g_J>=}y>9U(88e[piG+GmX&B8>ShdfRQt:Et;)^5zz'#=DmCd)_Ye?8$A$>sEW'iy-q/)OQ oEcG\|(3/*IN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49782	13.107.213.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:35 UTC	649	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:35 UTC	744	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:35 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: 06b055b8-701e-0045-6fdc-96b185000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031235Z-1865489d5f42v7z23dxn2r65v40000000asg00000000td6u x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:35 UTC	15640	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 03:12:35 UTC	1534	IN	Data Raw: 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49783	13.107.213.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:35 UTC	618	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:35 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:35 GMT Content-Type: application/x-javascript Content-Length: 54325 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Feb 2024 19:13:15 GMT ETag: 0x8DC2E5A2998EB1D x-ms-request-id: 3b0fab4a-601e-0024-2b39-96d8a5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031235Z-17644f8887fqm2jbpnyr5t7srg000000077g000000004urv x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 03:12:35 UTC	15566	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec bd 6b 7b db 46 92 30 fa 7d 7f 05 85 67 46 06 4c 90 22 a9 8b 65 52 10 c7 76 92 79 bd 4f 12 fb d8 ce bc 67 8f cc c9 03 81 a0 84 98 02 b8 b8 d8 d6 88 dc df 7e aa aa ef 40 83 92 af c9 66 3c bb b1 88 46 a3 2f d5 dd d5 75 af bd fb 3b ff d1 b9 df e9 dd fd 7f 9d 97 af 1e bd 78 d5 79 f6 43 e7 d5 ff 79 fa e2 bb ce 73 78 fa af ce cf cf 5e 3d 7d f2 fd dd db c1 4e f1 bf 57 97 49 d1 59 24 cb b8 03 7f cf c3 22 9e 77 b2 b4 93 e5 9d 24 8d b2 7c 95 e5 61 19 17 9d 2b f8 37 4f c2 65 67 91 67 57 9d f2 32 ee ac f2 ec b7 38 2a 8b ce 32 29 4a f8 e8 3c 5e 66 ef 3a 2e 34 97 cf 3b cf c3 bc bc ee 3c 7d ee f5 a1 fd 18 5a 4b 2e 92 14 be 8e b2 d5 35 fc be 2c 3b 69 56 26 51 dc 09 d3 39 b5 b6 84 87 b4 88 3b 55 3a 8f f3 ce bb cb 24 ba ec fc 94 44 79 56 64 Data Ascii: k{F0}gFL"eRvyOg~@f<F/u;xyCysx^=}NWIY$"w$\|a+7OeggW28*2)J<^f:.4;<}ZK.5,;iV&Q9;U:$DyVd
2024-04-26 03:12:35 UTC	16384	IN	Data Raw: d7 26 f4 e5 ac f2 e9 76 8f df 7e 95 fe 7a ac bf f3 e6 46 fc 20 af 2c 68 22 6c ec af 0f f1 58 23 9c 57 4f 85 29 04 a2 a6 af 99 30 b3 14 9a 61 1d 83 94 a6 41 a5 e1 ba 40 8e 69 4d 84 c0 0c 7a ee 60 3d 99 b6 58 4f 32 bb c9 b1 51 33 f7 d0 cc 59 d4 64 3d a8 ea f4 ac 64 83 78 6e c2 77 d6 2c 2b 64 ba 9c e8 88 be 66 c5 8c df 66 99 b1 37 5b 0c 65 ed c6 b0 84 1d b8 27 9d b1 78 9f d1 85 0e f7 b3 61 34 de 22 6c a6 2f 35 ab 02 8b c7 89 b8 f8 6d be 19 44 1a 30 db e7 98 94 60 dc 01 03 75 61 53 a0 c6 87 a8 0e 1b 7a e3 5c 73 c0 60 ee 51 be 50 27 6e f4 b1 3e be 6e 52 fc db 7d 60 b6 9b e9 5b 3d 60 f2 fa ac ed ce 08 79 ab 13 40 ae a4 cc 80 81 49 2c 6b 50 9f d5 16 d2 7d b4 9d 74 bf 2b 55 8b fe 30 c4 64 10 31 bb 9d c9 e0 96 d3 e6 5e 6f 10 6f 75 1b 48 73 4a c9 96 29 ed 37 a6 64 Data Ascii: &v~zF ,h"lX#WO)0aA@iMz`=XO2Q3Yd=dxnw,+dff7[e'xa4"l/5mD0`uaSz\s`QP'n>nR}`[=`y@I,kP}t+U0d1^oouHsJ)7d
2024-04-26 03:12:35 UTC	16384	IN	Data Raw: 4d 1b 87 df 42 87 3b 7d 41 91 56 ce 68 80 92 6a 27 33 9a 06 05 0e 6a ee 80 44 c4 66 f1 6a 1b d6 a5 51 f4 e0 d1 11 ad 3c 3a ae a2 1c fd f7 9b 24 c3 f6 61 2e 2f 03 95 db 1a db 11 47 1c 6c 89 73 db 4d aa 52 da b0 57 db 32 bf 29 5f 14 77 2f 6b 5d 29 40 84 dd b9 1c e4 35 e5 58 be 7e cb 47 b9 bb 2a af 2e 8c 24 e3 da 82 16 69 69 c9 e0 a5 e4 f7 2e 25 75 e6 0a b6 d4 ed 8d c5 7c aa 50 dc 9c bf f5 32 fa f9 9a a1 fb 5b 8c 97 74 e1 59 21 ca 81 0c 11 73 4a 13 f3 55 f6 45 f9 3a bc a4 72 e9 69 3b 21 8d ae e3 f7 5e 42 e7 ce 71 21 e7 6f 59 7c ee e8 9b 5f a1 85 a7 01 59 7a 29 5e da 20 4b 2f c5 13 5d da b4 de 7b e9 8b e3 e6 74 04 65 da 5b 0f ca e4 1a c9 19 bf b1 7f 1f 64 ff df c5 f6 ba 6e 26 a0 b8 dd de 5a 6b db e4 cb ad 6d bf c0 ce 96 da d2 60 6a ab 5a e3 58 dc 52 e6 5f 6e Data Ascii: MB;}AVhj'3jDfjQ<:$a./GlsMRW2)_w/k])@5X~G*.$ii.%u\|P2[tY!sJUE:ri;!^Bq!oY\|_Yz)^ K/]{te[dn&Zkm`jZXR_n
2024-04-26 03:12:35 UTC	5991	IN	Data Raw: 39 35 50 78 6e 18 8b 9a 2f af 01 ef 75 bf ab b7 ae 01 f2 5d ff de 98 b0 b0 3e 49 0e 7e 63 40 3c 29 b8 d4 80 14 aa 30 32 c0 a4 8e 42 d4 35 3d 5f 18 b8 a3 11 36 4f 9a 57 c3 d9 74 ef a4 b8 f7 97 0d 0d bb 85 3e 8b 58 ca db be e7 c3 1b 78 bd b3 c3 96 68 64 69 85 5f 70 17 50 83 d8 fd 33 ab 3f bf a4 b3 1d 87 c9 32 e6 91 0b 6c 50 5a 4a f6 5c 2d 1d b3 22 79 95 55 3b 8d 66 e7 4b 13 fe f9 05 af ed 06 6b ab 90 17 34 34 0c 28 2d 2a bd f3 be c0 75 de d3 f6 02 7a 2f e0 69 a9 24 cb 5c ef 0f ef 5e 3c cd 2e 67 59 4a b6 fe 6a 52 34 68 93 b4 86 af 7e e1 84 3e d1 43 fe ac 88 cb 70 5e 4e 3a fd c3 de 59 54 c4 07 f7 85 be 29 16 8b 95 25 ab 59 35 e6 6f a8 db f0 2e 3e 7f fe 69 46 a2 81 57 38 17 aa 49 22 ed a7 b4 13 d1 92 8d eb 69 f9 16 09 1b 5c 25 e9 38 bb da 86 23 f6 4c d9 de 66 Data Ascii: 95Pxn/u]>I~c@<)02B5=_6OWt>Xxhdi_pP3?2lPZJ\-"yU;fKk44(-*uz/i$\^<.gYJjR4h~>Cp^N:YT)%Y5o.>iFW8I"i\%8#Lf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49784	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:36 UTC	404	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:36 UTC	744	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:36 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: 06b055b8-701e-0045-6fdc-96b185000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031236Z-1865489d5f42v7z23dxn2r65v40000000avg0000000040s0 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:36 UTC	15640	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 03:12:36 UTC	1534	IN	Data Raw: 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49785	13.107.213.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:36 UTC	620	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:36 UTC	817	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:36 GMT Content-Type: application/x-javascript Content-Length: 5512 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Feb 2024 19:13:16 GMT ETag: 0x8DC2E5A29A25668 x-ms-request-id: ac5eda27-501e-006b-4575-9782ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031236Z-1865489d5f47qbmbt8czrx60cn0000000avg00000000hkqg x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 03:12:36 UTC	5512	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ad 5b 7d 77 da 46 d6 ff bf 9f 42 68 f7 10 69 33 96 4d 9a b6 cf e2 aa 3e 0e 2f 09 ad 1d bb 06 b7 9b 26 39 1c 81 06 50 2c 24 55 23 8c a9 e1 bb ef ef ce 48 48 80 c0 4e 9f ed 49 0d 9a b9 73 e7 ce 9d fb 7e c5 f1 bf 2a df 68 ff d2 8e 9e ff 9f d6 ed 9d df f4 b4 ab b6 d6 7b d7 b9 69 6a d7 78 fa a0 bd bf ea 75 1a ad e7 e3 a1 4d e9 ff de c4 13 da c8 f3 b9 86 cf 81 23 b8 ab 85 81 16 c6 9a 17 0c c3 38 0a 63 27 e1 42 9b e2 6f ec 39 be 36 8a c3 a9 96 4c b8 16 c5 e1 17 3e 4c 84 e6 7b 22 c1 a2 01 f7 c3 b9 66 00 5d ec 6a d7 4e 9c 2c b4 ce b5 69 01 3f 07 36 6f ec 05 58 3d 0c a3 05 be 4f 12 2d 08 13 6f c8 35 27 70 25 36 1f 0f 81 e0 da 2c 70 79 ac cd 27 de 70 a2 5d 7a c3 38 14 e1 28 d1 62 3e e4 de 3d 36 11 33 8c 6f 6e c1 34 27 e6 9a e0 89 36 0a Data Ascii: [}wFBhi3M>/&9P,$U#HHNIs~*h{ijxuM#8c'Bo96L>L{"f]jN,i?6oX=O-o5'p%6,py'p]z8(b>=63on4'6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49787	13.107.213.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:36 UTC	668	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:36 UTC	740	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:36 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:47 GMT ETag: 0x8DB5C3F48EC4154 x-ms-request-id: 6edf690a-a01e-0050-4104-9486ad000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031236Z-17644f8887f9qfxwmwnf4q7tac00000006yg0000000074g7 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:36 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49786	13.107.213.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:36 UTC	662	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:36 UTC	734	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:36 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4904824B x-ms-request-id: 8b54f661-901e-0033-1c57-97b989000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031236Z-1865489d5f4r69rrg7uwqa73hg0000000ay0000000009nn8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:36 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49789	152.195.19.97	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:37 UTC	701	OUT	GET /dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/illustration?ts=636565365803385104 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:37 UTC	619	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 27184 Cache-Control: public, max-age=86400 Content-MD5: KYlqcfLYq0zJWXbQOB25YA== Content-Type: image/* Date: Fri, 26 Apr 2024 03:12:37 GMT Etag: 0x8D588D3DB54AC0C Last-Modified: Tue, 13 Mar 2018 11:16:24 GMT Server: ECAcc (mid/8792) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: d0f2ced2-a01e-0048-7f48-975ed5000000 x-ms-version: 2009-09-19 Content-Length: 299928 Connection: close
2024-04-26 03:12:37 UTC	16383	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 3c 00 00 ff e1 03 6f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 30 20 37 39 2e 31 36 30 34 35 31 2c 20 32 30 31 37 2f 30 35 2f 30 36 2d 30 31 3a 30 38 3a 32 31 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Ducky<ohttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xm
2024-04-26 03:12:37 UTC	16383	IN	Data Raw: 99 94 0d 27 95 34 9b 8f 56 76 ca 46 26 d3 b4 50 28 9e 50 da 49 91 60 93 69 50 b6 6d 31 24 aa 0d c5 93 51 48 f3 a7 40 c8 f5 c7 1c e8 9c d3 a4 50 2f 9c d3 a4 73 0e 91 cd 3a 25 13 d2 15 48 3a 86 f3 8e 6c 29 96 4a 46 b3 ac 73 ca e7 96 20 d6 52 33 36 9d a3 a2 5f 36 1e 78 c8 ae 6e 20 18 19 9b 0d a6 b2 e1 4c c4 02 41 d5 31 38 25 93 90 6f 3b 85 53 ce 96 0b 65 73 13 33 33 23 13 41 d6 36 9c b0 0c cb 24 1d 13 33 49 a4 f4 e7 30 c4 c0 aa 71 4f a0 1e 4c cc c8 da 60 49 c1 39 e6 e2 d1 68 de 60 57 2b 94 0d 45 83 ac 77 0e 31 b0 10 6a 36 03 22 0d 46 c2 e9 54 c8 e4 1c a3 b6 75 8e d9 68 c4 ac 6b 33 33 37 15 0d 45 63 cc 92 41 91 e8 4d 87 a7 3e 5e 72 09 86 32 83 68 31 24 c4 83 db 97 0e 31 91 ac da 41 b0 83 00 74 8b 46 b3 c2 9b 8e a1 5c d8 5c 3d 01 54 d6 53 28 18 03 20 0d e0 c0 Data Ascii: '4VvF&P(PI`iPm1$QH@P/s:%H:l)JFs R36_6xn LA18%o;Ses33#A6$3I0qOL`I9h`W+Ew1j6"FTuhk337EcAM>^r2h1$1AtF\\=TS(
2024-04-26 03:12:37 UTC	16383	IN	Data Raw: 6f ce 4c e4 ce 4c df 82 44 ce 45 d7 93 39 0e 72 1c 25 c6 72 b6 73 1c e5 6c e5 6c e6 7c e6 93 39 64 ce 59 33 c8 93 39 9f 39 5f 39 1f 39 5b 39 1f 35 63 9e fc f5 cd c7 37 9c dd 9a ea 01 62 35 6c f7 9c d5 f0 6e c5 05 b0 ee 04 ca 73 93 d0 12 73 90 60 2d b7 97 4c 32 ae 9b f5 c2 4e 6d 90 ba 68 4b b3 46 ed 61 df 37 b6 09 57 4e 42 4e ed 30 16 d3 7b 13 b2 5d 22 66 6c 61 b5 b7 6b 9b bd a1 98 e6 a4 66 f6 39 bd b3 59 4e 02 4e 69 eb c7 ea ea c9 9e f4 22 0b 72 29 a5 7d 33 46 0f f3 31 83 06 4d cd 86 37 18 23 3a ec 4d 78 f2 3a fb 93 66 71 a0 cd 8e d9 c2 46 2c 04 8d ba b2 a1 df fd f6 1c 11 eb 8d 1c 7b 95 54 61 1e 9a 4f 8a 26 57 96 3e 41 e2 2e 9e 1a 64 d0 b2 cb 14 2a 63 92 48 e3 41 1b 2b ab 23 07 ae d2 c9 be 47 3f 64 e4 df ba af f9 ff 00 e9 ab e8 ba 9d 3f b6 83 62 63 66 f7 Data Ascii: oLLDE9r%rsll\|9dY399_99[95c7b5lnss`-L2NmhKFa7WNBN0{]"flakf9YNNi"r)}3F1M7#:Mx:fqF,{TaO&W>A.d*cHA+#G?d?bcf
2024-04-26 03:12:37 UTC	16383	IN	Data Raw: 1b c9 bf 91 97 2e 2b 4b 2f be 28 24 99 96 c2 fa 57 4f cc b5 b8 df 28 01 b9 b7 95 ce 33 3e 5c f4 a9 1f e3 f6 e5 2f c9 b7 ae e4 db c9 d6 45 c1 9e 65 dc ec aa bb 3f fa b5 01 20 e7 8f a7 e5 ec b3 b0 96 d9 43 23 08 63 fc 9f 98 08 de f2 cf 5b 65 ad 24 8f 29 bb c9 3f 5d 0d 6b 33 8a 94 b8 64 88 45 90 53 e5 c3 d7 ee 06 16 59 37 27 33 ce 06 37 03 88 a1 96 68 fb 38 c5 cc 7a 16 82 c8 1d 0a 80 49 e0 12 1f 82 60 24 01 a6 0d b9 bd 80 dd 57 5d f4 b1 5a ae c6 96 80 3e 55 5d 56 e4 24 c7 78 1c 8f b0 94 e0 ec 6d 1c f3 ae 91 e4 5e 20 c9 d9 91 e2 5e 9e bf d2 a0 84 09 3a 98 33 ea 96 df 3c 5e ce 7c 6a 34 50 35 9a 4b 83 76 96 65 40 d2 3b 4c ec 95 d3 26 92 3e 39 1e 68 e6 e5 ed 06 25 8e d1 58 c5 3c a4 a0 0f 1c 70 b0 a8 aa 11 1f d5 9f f5 5c 31 a0 32 a0 c5 9e 51 8e e6 52 3e f1 b7 60 Data Ascii: .+K/($WO(3>\/Ee? C#c[e$)?]k3dESY7'37h8zI`$W]Z>U]V$xm^ ^:3<^\|j4P5Kve@;L&>9h%X<p\12QR>`
2024-04-26 03:12:37 UTC	4	IN	Data Raw: 96 e7 07 2c Data Ascii: ,
2024-04-26 03:12:37 UTC	16383	IN	Data Raw: 75 bc 59 2d 58 8d 54 47 2c 7d 71 d8 73 74 41 e6 d5 9e 0f 66 79 91 97 81 bd 0c c8 c0 4c ac 63 d7 7c af ab 46 16 ae 59 e1 16 03 56 cf d3 66 b5 8e 7e 97 4a 73 d7 4c 67 76 27 23 6f 94 21 8a c7 4f d9 45 14 94 7b 48 56 6a 7d ba 43 25 60 c3 65 24 a8 90 6e ca df 93 75 88 84 dd ac d2 2a e9 8a 78 f2 0e c1 77 c2 36 c5 af 3c d6 69 d8 25 f9 3c 88 f9 c6 01 60 47 09 91 64 f0 c8 8f 85 b7 d6 7b 15 71 ae de 0f 56 2a fc 36 9e ac 32 4d 75 aa 96 b6 e2 9f 65 39 3d 74 56 2c 49 0c 6f c7 9e ad 23 c7 b7 15 43 17 41 1b f5 f7 23 48 9e e4 43 3c c7 55 5b f0 38 f1 2c df c3 d1 cc 73 e8 64 e1 e9 2c e5 ae 48 a1 69 24 15 d1 63 5e ab a8 67 6c 95 e2 fa ac b0 76 82 68 fe a5 ac 6c 39 2e 00 62 ae db a0 58 f5 ce 28 57 2e cb c8 ef 2c 7b 98 80 c1 e3 2c 48 52 18 33 92 a1 a0 e2 9e 64 e3 af 20 d7 25 Data Ascii: uY-XTG,}qstAfyLc\|FYVf~JsLgv'#o!OE{HVj}C%`e$nuxw6<i%<`Gd{qV62Mue9=tV,Io#CA#HC<U[8,sd,Hi$c^glvhl9.bX(W.,{,HR3d %
2024-04-26 03:12:37 UTC	16383	IN	Data Raw: 4c 15 58 04 c2 41 d4 b6 66 b9 58 64 8e e4 66 fe c5 aa d9 72 a0 f2 65 20 38 8a 69 07 6d 8a 31 14 0a 76 81 0e b4 19 8d 58 ae 19 56 3f 6a 68 81 c5 4a a6 97 16 94 c1 80 58 ba 70 68 8c 4c 69 93 05 17 d2 0e 1e 49 a5 1d 40 7d ab 55 be 18 c7 fb b0 98 dc 68 ec cc a2 6d 46 88 17 32 d4 39 55 5f fe 28 0d 24 7b c5 02 6d eb 8f ae 2a 65 8c 61 e8 88 5a a3 37 99 c9 70 0a e1 ec 4d 28 88 8d ab 5d b2 04 60 5a 99 ae a7 79 12 e0 70 e9 09 bb 68 9d 47 98 c8 21 23 01 d4 cc 84 14 87 e2 56 ce 59 a9 d4 00 70 40 13 ed 42 c4 a2 18 0e 75 3b 83 8a e7 a4 64 8d c3 84 79 94 63 12 d0 96 28 db 02 b8 c5 1b 6d a4 a0 08 65 2d 43 e2 7a 37 2c 75 48 e1 e6 84 65 cf 2a cc a3 d4 80 3a 6a 0a 2c 30 f0 8b 7b 54 78 b5 42 3e 84 fa 34 d6 a9 c7 14 50 b8 2e 33 9e 54 d7 06 12 a2 73 17 4d d3 14 54 b6 d9 29 08 Data Ascii: LXAfXdfre 8im1vXV?jhJXphLiI@}UhmF29U_(${meaZ7pM(]`ZyphG!#VYp@Bu;dyc(me-Cz7,uHe:j,0{TxB>4P.3TsMT)
2024-04-26 03:12:37 UTC	16383	IN	Data Raw: 4f ff 00 93 dd dc ff 00 ed 82 97 e9 ac c6 f0 db 9a 84 4f 6b 1b 41 ea 5e be c4 d3 c2 3c 92 51 d3 50 2e 73 1c 4a ee 47 fd 3c 55 91 fa 83 72 87 87 6a ec 3f 78 a3 fb d8 ab de 41 5a 9b ff 00 72 c7 ea 56 45 bb e6 67 49 d3 03 9e f4 41 32 03 dd 8e 3e 6a 27 55 c0 00 d3 40 a4 d7 27 28 c0 55 c6 08 b7 76 ee 30 2a 4f a6 7b d0 03 13 82 e4 72 73 4e 20 41 08 46 f0 f8 02 2f 28 e6 ea 3f a6 13 1e f0 3f 72 6b bc 72 07 e1 9d 88 4d b4 44 0f ad 93 e4 9a 24 06 18 9c 15 2e 41 6b d5 19 f9 22 7e b2 88 23 50 22 88 88 40 c6 6f 57 cd 5c 85 d9 e9 06 58 05 c3 3a 85 18 97 31 d5 58 a8 fe 81 bf 4f a4 33 b6 2b d3 ff 00 2a 8f e9 5b 46 91 ab 0e 6c d7 a7 ec 43 f4 8d d2 d2 31 6c 73 5e 96 cf 95 7f 0a 47 45 86 2d 8a 0e 63 a5 f8 b0 c1 4b f4 a6 3d 1a 33 b2 8e b9 47 43 8d 58 60 a7 fa 69 44 58 f4 bb Data Ascii: OOkA^<QP.sJG<Urj?xAZrVEgIA2>j'U@'(Uv0O{rsN AF/(??rkrMD$.Ak"~#P"@oW\X:1XO3+[FlC1ls^GE-cK=3GCX`iDX
2024-04-26 03:12:37 UTC	16383	IN	Data Raw: 38 8c 41 5a ac 49 b6 c0 e0 b4 f7 11 e9 4b de 18 2b 77 2d f1 5a 18 90 85 11 66 42 3a 1e 25 4a 42 2e 0e 31 fe 85 ee 9d 89 a3 11 38 8c 46 d4 66 3e 05 f2 79 3d 2a b4 d9 28 ae 9d f8 09 7e 3c d4 45 9e 32 ee 46 6b 0a a1 4a 28 8c 06 65 4f 4c 46 91 ca 06 6b 05 0a 55 ea a0 db d1 ea 70 ca 44 f0 a2 dc 44 a2 24 1f 72 77 a1 50 b7 7a 5a 62 fc 05 48 c6 7a a5 85 c1 b1 5b 96 b3 cc f6 fc d1 94 e8 5a aa 56 63 6d af 03 c3 3c 99 04 c1 da aa af 92 cd 1c 58 8e 25 6f 12 f1 20 79 2b 7e 9c 45 b1 b7 72 b6 45 b0 2a 63 15 6b e1 8e 62 14 08 80 0f 39 47 05 6c e9 f7 81 a6 0a d1 0f 51 27 43 1e 38 90 5f 6a 80 39 c0 83 5f 52 ed fa d7 45 b9 d9 e6 df b9 35 8b 7d 69 d5 a7 2f b4 21 a3 86 d5 08 6a 06 cc 22 6f dd ea 18 fa 21 5a 15 d3 ec ed 0b 51 34 d4 6b 25 ae 53 70 d9 ab 9f 0f 4c 19 f5 14 de 0c Data Ascii: 8AZIK+w-ZfB:%JB.18Ff>y=(~<E2FkJ(eOLFkUpDD$rwPzZbHz[ZVcm<X%o y+~ErEckb9GlQ'C8_j9_RE5}i/!j"o!ZQ4k%SpL
2024-04-26 03:12:37 UTC	16383	IN	Data Raw: 85 1d 72 84 32 51 d2 59 71 71 22 df 52 08 ef 4d e2 3c 5c 16 dc 9f ec 45 a2 e1 1c 94 46 d3 8a fc 51 fd 89 95 4d 7c 31 aa a6 1e 01 06 54 f0 77 4f 14 e5 3a a0 54 c5 71 07 f0 64 c9 be 89 3b 95 dd aa 00 e6 a3 ba 08 9c 99 5a 1b 94 06 54 51 6d ca 6a 2a 43 35 07 da a0 06 4a 64 a9 ef 52 f3 5f 72 81 19 02 ea ef 9e 0a 8a c8 da 8a b2 3f 10 4d b1 05 07 c9 ca 92 0a c7 9b aa a2 0e da 14 7c 97 6b 1f c2 15 b1 b6 5e 36 c2 ed e2 8b 57 c0 3e c5 00 32 8f 8c c9 57 1b 2a 2a c7 c0 9d ea e9 db 2f 02 86 f0 54 98 e9 3b d6 a1 50 9a 75 8e 60 d4 2d 56 25 a2 5e e9 c3 eb 5a 2e 8d 25 71 81 e6 53 5b 0e 76 a8 99 1c d0 a2 c1 50 2c 16 0b 05 82 c1 60 b0 58 2c 16 1e 0e 43 ad 47 89 b0 8e 4b 89 db dd 40 1a 6e 4e 68 76 84 48 27 8b 15 16 c7 36 59 ac d5 55 49 58 95 89 54 2b 81 73 b2 78 f2 ed 29 a0 Data Ascii: r2QYqq"RM<\EFQM\|1TwO:Tqd;ZTQmjC5JdR_r?M\|k^6W>2W*/T;Pu`-V%^Z.%qS[vP,`X,CGK@nNhvH'6YUIXT+sx)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49788	152.195.19.97	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:37 UTC	699	OUT	GET /dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/bannerlogo?ts=637617112422502334 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:37 UTC	617	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 58405 Cache-Control: public, max-age=86400 Content-MD5: c+sjBoeN+PIIDz2sthqx4w== Content-Type: image/* Date: Fri, 26 Apr 2024 03:12:37 GMT Etag: 0x8D94562B16D3197 Last-Modified: Mon, 12 Jul 2021 18:27:23 GMT Server: ECAcc (mid/8764) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 980fbf7a-801e-0012-6bff-963832000000 x-ms-version: 2009-09-19 Content-Length: 3874 Connection: close
2024-04-26 03:12:37 UTC	3874	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 18 00 00 00 3c 08 06 00 00 01 ca c3 95 8e 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 0e c4 49 44 41 54 78 da 62 60 18 0a 80 6b c9 34 01 93 19 9b ff 0f b8 43 fc 77 65 cd 67 58 55 7a 1e c4 36 c9 58 3c 5f d2 a7 c3 61 50 84 90 bc 6d 01 dd 42 87 09 99 63 2a 15 fa 1f 46 03 71 03 88 0e 35 32 77 1c 14 a1 f2 20 d5 bf 00 44 cf 0c ed fb 3f 28 1c b4 4f 2d 6b 3f c3 48 04 00 01 34 74 80 4f ef e9 f7 f4 b4 8f 19 4f a1 17 a0 f8 55 fa e0 67 36 e5 07 5f 6e ed f9 41 f7 ac 0d cd d6 0d 20 fa 1b db fd 0f 67 f7 ef 7d c0 f6 f1 85 80 96 4f 3b 5d 72 13 23 36 87 00 81 3d 10 2f 3c fd 6c f5 02 70 74 25 cc de bf 65 41 2a fd cb 9b 7f d7 d4 df ff 3b a8 7e fe Data Ascii: PNGIHDR<tEXtSoftwareAdobe ImageReadyqe<IDATxb`k4CwegXUz6X<_aPmBcFq52w D?(O-k?H4tOOUg6_nA g}O;]r#6=/<lpt%eA;~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49791	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:37 UTC	423	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:37 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:37 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:47 GMT ETag: 0x8DB5C3F48EC4154 x-ms-request-id: 82246d8f-701e-0045-1f76-97b185000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031237Z-1865489d5f4b68hj4nmrur3p700000000ap000000000b7gw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:37 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49790	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:37 UTC	417	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:38 UTC	740	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:38 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4904824B x-ms-request-id: 367a3994-301e-0051-0280-93adaf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031238Z-17644f8887ffzxh64y0yfwy56c0000000760000000006zet x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:38 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49793	152.195.19.97	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:38 UTC	454	OUT	GET /dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/bannerlogo?ts=637617112422502334 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:38 UTC	617	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 58406 Cache-Control: public, max-age=86400 Content-MD5: c+sjBoeN+PIIDz2sthqx4w== Content-Type: image/* Date: Fri, 26 Apr 2024 03:12:38 GMT Etag: 0x8D94562B16D3197 Last-Modified: Mon, 12 Jul 2021 18:27:23 GMT Server: ECAcc (mid/8764) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 980fbf7a-801e-0012-6bff-963832000000 x-ms-version: 2009-09-19 Content-Length: 3874 Connection: close
2024-04-26 03:12:38 UTC	3874	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 18 00 00 00 3c 08 06 00 00 01 ca c3 95 8e 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 0e c4 49 44 41 54 78 da 62 60 18 0a 80 6b c9 34 01 93 19 9b ff 0f b8 43 fc 77 65 cd 67 58 55 7a 1e c4 36 c9 58 3c 5f d2 a7 c3 61 50 84 90 bc 6d 01 dd 42 87 09 99 63 2a 15 fa 1f 46 03 71 03 88 0e 35 32 77 1c 14 a1 f2 20 d5 bf 00 44 cf 0c ed fb 3f 28 1c b4 4f 2d 6b 3f c3 48 04 00 01 34 74 80 4f ef e9 f7 f4 b4 8f 19 4f a1 17 a0 f8 55 fa e0 67 36 e5 07 5f 6e ed f9 41 f7 ac 0d cd d6 0d 20 fa 1b db fd 0f 67 f7 ef 7d c0 f6 f1 85 80 96 4f 3b 5d 72 13 23 36 87 00 81 3d 10 2f 3c fd 6c f5 02 70 74 25 cc de bf 65 41 2a fd cb 9b 7f d7 d4 df ff 3b a8 7e fe Data Ascii: PNGIHDR<tEXtSoftwareAdobe ImageReadyqe<IDATxb`k4CwegXUz6X<_aPmBcFq52w D?(O-k?H4tOOUg6_nA g}O;]r#6=/<lpt%eA;~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49795	152.195.19.97	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:39 UTC	456	OUT	GET /dbd5a2dd-avjm7q6yockj6clgtqda-xdwc1ruzzsfyrzf0zk25ek/logintenantbranding/0/illustration?ts=636565365803385104 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:39 UTC	619	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 27186 Cache-Control: public, max-age=86400 Content-MD5: KYlqcfLYq0zJWXbQOB25YA== Content-Type: image/* Date: Fri, 26 Apr 2024 03:12:39 GMT Etag: 0x8D588D3DB54AC0C Last-Modified: Tue, 13 Mar 2018 11:16:24 GMT Server: ECAcc (mid/8792) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: d0f2ced2-a01e-0048-7f48-975ed5000000 x-ms-version: 2009-09-19 Content-Length: 299928 Connection: close
2024-04-26 03:12:39 UTC	16383	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 3c 00 00 ff e1 03 6f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 30 20 37 39 2e 31 36 30 34 35 31 2c 20 32 30 31 37 2f 30 35 2f 30 36 2d 30 31 3a 30 38 3a 32 31 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Ducky<ohttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xm
2024-04-26 03:12:39 UTC	1	IN	Data Raw: 99 Data Ascii:
2024-04-26 03:12:39 UTC	16383	IN	Data Raw: 94 0d 27 95 34 9b 8f 56 76 ca 46 26 d3 b4 50 28 9e 50 da 49 91 60 93 69 50 b6 6d 31 24 aa 0d c5 93 51 48 f3 a7 40 c8 f5 c7 1c e8 9c d3 a4 50 2f 9c d3 a4 73 0e 91 cd 3a 25 13 d2 15 48 3a 86 f3 8e 6c 29 96 4a 46 b3 ac 73 ca e7 96 20 d6 52 33 36 9d a3 a2 5f 36 1e 78 c8 ae 6e 20 18 19 9b 0d a6 b2 e1 4c c4 02 41 d5 31 38 25 93 90 6f 3b 85 53 ce 96 0b 65 73 13 33 33 23 13 41 d6 36 9c b0 0c cb 24 1d 13 33 49 a4 f4 e7 30 c4 c0 aa 71 4f a0 1e 4c cc c8 da 60 49 c1 39 e6 e2 d1 68 de 60 57 2b 94 0d 45 83 ac 77 0e 31 b0 10 6a 36 03 22 0d 46 c2 e9 54 c8 e4 1c a3 b6 75 8e d9 68 c4 ac 6b 33 33 37 15 0d 45 63 cc 92 41 91 e8 4d 87 a7 3e 5e 72 09 86 32 83 68 31 24 c4 83 db 97 0e 31 91 ac da 41 b0 83 00 74 8b 46 b3 c2 9b 8e a1 5c d8 5c 3d 01 54 d6 53 28 18 03 20 0d e0 c0 c8 Data Ascii: '4VvF&P(PI`iPm1$QH@P/s:%H:l)JFs R36_6xn LA18%o;Ses33#A6$3I0qOL`I9h`W+Ew1j6"FTuhk337EcAM>^r2h1$1AtF\\=TS(
2024-04-26 03:12:39 UTC	16383	IN	Data Raw: ce 4c e4 ce 4c df 82 44 ce 45 d7 93 39 0e 72 1c 25 c6 72 b6 73 1c e5 6c e5 6c e6 7c e6 93 39 64 ce 59 33 c8 93 39 9f 39 5f 39 1f 39 5b 39 1f 35 63 9e fc f5 cd c7 37 9c dd 9a ea 01 62 35 6c f7 9c d5 f0 6e c5 05 b0 ee 04 ca 73 93 d0 12 73 90 60 2d b7 97 4c 32 ae 9b f5 c2 4e 6d 90 ba 68 4b b3 46 ed 61 df 37 b6 09 57 4e 42 4e ed 30 16 d3 7b 13 b2 5d 22 66 6c 61 b5 b7 6b 9b bd a1 98 e6 a4 66 f6 39 bd b3 59 4e 02 4e 69 eb c7 ea ea c9 9e f4 22 0b 72 29 a5 7d 33 46 0f f3 31 83 06 4d cd 86 37 18 23 3a ec 4d 78 f2 3a fb 93 66 71 a0 cd 8e d9 c2 46 2c 04 8d ba b2 a1 df fd f6 1c 11 eb 8d 1c 7b 95 54 61 1e 9a 4f 8a 26 57 96 3e 41 e2 2e 9e 1a 64 d0 b2 cb 14 2a 63 92 48 e3 41 1b 2b ab 23 07 ae d2 c9 be 47 3f 64 e4 df ba af f9 ff 00 e9 ab e8 ba 9d 3f b6 83 62 63 66 f7 f1 Data Ascii: LLDE9r%rsll\|9dY399_99[95c7b5lnss`-L2NmhKFa7WNBN0{]"flakf9YNNi"r)}3F1M7#:Mx:fqF,{TaO&W>A.d*cHA+#G?d?bcf
2024-04-26 03:12:39 UTC	16383	IN	Data Raw: c9 bf 91 97 2e 2b 4b 2f be 28 24 99 96 c2 fa 57 4f cc b5 b8 df 28 01 b9 b7 95 ce 33 3e 5c f4 a9 1f e3 f6 e5 2f c9 b7 ae e4 db c9 d6 45 c1 9e 65 dc ec aa bb 3f fa b5 01 20 e7 8f a7 e5 ec b3 b0 96 d9 43 23 08 63 fc 9f 98 08 de f2 cf 5b 65 ad 24 8f 29 bb c9 3f 5d 0d 6b 33 8a 94 b8 64 88 45 90 53 e5 c3 d7 ee 06 16 59 37 27 33 ce 06 37 03 88 a1 96 68 fb 38 c5 cc 7a 16 82 c8 1d 0a 80 49 e0 12 1f 82 60 24 01 a6 0d b9 bd 80 dd 57 5d f4 b1 5a ae c6 96 80 3e 55 5d 56 e4 24 c7 78 1c 8f b0 94 e0 ec 6d 1c f3 ae 91 e4 5e 20 c9 d9 91 e2 5e 9e bf d2 a0 84 09 3a 98 33 ea 96 df 3c 5e ce 7c 6a 34 50 35 9a 4b 83 76 96 65 40 d2 3b 4c ec 95 d3 26 92 3e 39 1e 68 e6 e5 ed 06 25 8e d1 58 c5 3c a4 a0 0f 1c 70 b0 a8 aa 11 1f d5 9f f5 5c 31 a0 32 a0 c5 9e 51 8e e6 52 3e f1 b7 60 8d Data Ascii: .+K/($WO(3>\/Ee? C#c[e$)?]k3dESY7'37h8zI`$W]Z>U]V$xm^ ^:3<^\|j4P5Kve@;L&>9h%X<p\12QR>`
2024-04-26 03:12:39 UTC	16383	IN	Data Raw: e7 07 2c 75 bc 59 2d 58 8d 54 47 2c 7d 71 d8 73 74 41 e6 d5 9e 0f 66 79 91 97 81 bd 0c c8 c0 4c ac 63 d7 7c af ab 46 16 ae 59 e1 16 03 56 cf d3 66 b5 8e 7e 97 4a 73 d7 4c 67 76 27 23 6f 94 21 8a c7 4f d9 45 14 94 7b 48 56 6a 7d ba 43 25 60 c3 65 24 a8 90 6e ca df 93 75 88 84 dd ac d2 2a e9 8a 78 f2 0e c1 77 c2 36 c5 af 3c d6 69 d8 25 f9 3c 88 f9 c6 01 60 47 09 91 64 f0 c8 8f 85 b7 d6 7b 15 71 ae de 0f 56 2a fc 36 9e ac 32 4d 75 aa 96 b6 e2 9f 65 39 3d 74 56 2c 49 0c 6f c7 9e ad 23 c7 b7 15 43 17 41 1b f5 f7 23 48 9e e4 43 3c c7 55 5b f0 38 f1 2c df c3 d1 cc 73 e8 64 e1 e9 2c e5 ae 48 a1 69 24 15 d1 63 5e ab a8 67 6c 95 e2 fa ac b0 76 82 68 fe a5 ac 6c 39 2e 00 62 ae db a0 58 f5 ce 28 57 2e cb c8 ef 2c 7b 98 80 c1 e3 2c 48 52 18 33 92 a1 a0 e2 9e 64 e3 af Data Ascii: ,uY-XTG,}qstAfyLc\|FYVf~JsLgv'#o!OE{HVj}C%`e$nuxw6<i%<`Gd{qV62Mue9=tV,Io#CA#HC<U[8,sd,Hi$c^glvhl9.bX(W.,{,HR3d
2024-04-26 03:12:39 UTC	16383	IN	Data Raw: 71 f5 6f 4c 15 58 04 c2 41 d4 b6 66 b9 58 64 8e e4 66 fe c5 aa d9 72 a0 f2 65 20 38 8a 69 07 6d 8a 31 14 0a 76 81 0e b4 19 8d 58 ae 19 56 3f 6a 68 81 c5 4a a6 97 16 94 c1 80 58 ba 70 68 8c 4c 69 93 05 17 d2 0e 1e 49 a5 1d 40 7d ab 55 be 18 c7 fb b0 98 dc 68 ec cc a2 6d 46 88 17 32 d4 39 55 5f fe 28 0d 24 7b c5 02 6d eb 8f ae 2a 65 8c 61 e8 88 5a a3 37 99 c9 70 0a e1 ec 4d 28 88 8d ab 5d b2 04 60 5a 99 ae a7 79 12 e0 70 e9 09 bb 68 9d 47 98 c8 21 23 01 d4 cc 84 14 87 e2 56 ce 59 a9 d4 00 70 40 13 ed 42 c4 a2 18 0e 75 3b 83 8a e7 a4 64 8d c3 84 79 94 63 12 d0 96 28 db 02 b8 c5 1b 6d a4 a0 08 65 2d 43 e2 7a 37 2c 75 48 e1 e6 84 65 cf 2a cc a3 d4 80 3a 6a 0a 2c 30 f0 8b 7b 54 78 b5 42 3e 84 fa 34 d6 a9 c7 14 50 b8 2e 33 9e 54 d7 06 12 a2 73 17 4d d3 14 54 b6 Data Ascii: qoLXAfXdfre 8im1vXV?jhJXphLiI@}UhmF29U_(${meaZ7pM(]`ZyphG!#VYp@Bu;dyc(me-Cz7,uHe:j,0{TxB>4P.3TsMT
2024-04-26 03:12:39 UTC	5	IN	Data Raw: 71 3d 81 4f ff Data Ascii: q=O
2024-04-26 03:12:40 UTC	16383	IN	Data Raw: 00 93 dd dc ff 00 ed 82 97 e9 ac c6 f0 db 9a 84 4f 6b 1b 41 ea 5e be c4 d3 c2 3c 92 51 d3 50 2e 73 1c 4a ee 47 fd 3c 55 91 fa 83 72 87 87 6a ec 3f 78 a3 fb d8 ab de 41 5a 9b ff 00 72 c7 ea 56 45 bb e6 67 49 d3 03 9e f4 41 32 03 dd 8e 3e 6a 27 55 c0 00 d3 40 a4 d7 27 28 c0 55 c6 08 b7 76 ee 30 2a 4f a6 7b d0 03 13 82 e4 72 73 4e 20 41 08 46 f0 f8 02 2f 28 e6 ea 3f a6 13 1e f0 3f 72 6b bc 72 07 e1 9d 88 4d b4 44 0f ad 93 e4 9a 24 06 18 9c 15 2e 41 6b d5 19 f9 22 7e b2 88 23 50 22 88 88 40 c6 6f 57 cd 5c 85 d9 e9 06 58 05 c3 3a 85 18 97 31 d5 58 a8 fe 81 bf 4f a4 33 b6 2b d3 ff 00 2a 8f e9 5b 46 91 ab 0e 6c d7 a7 ec 43 f4 8d d2 d2 31 6c 73 5e 96 cf 95 7f 0a 47 45 86 2d 8a 0e 63 a5 f8 b0 c1 4b f4 a6 3d 1a 33 b2 8e b9 47 43 8d 58 60 a7 fa 69 44 58 f4 bb 28 75 Data Ascii: OkA^<QP.sJG<Urj?xAZrVEgIA2>j'U@'(Uv0O{rsN AF/(??rkrMD$.Ak"~#P"@oW\X:1XO3+[FlC1ls^GE-cK=3GCX`iDX(u
2024-04-26 03:12:40 UTC	16383	IN	Data Raw: 41 5a ac 49 b6 c0 e0 b4 f7 11 e9 4b de 18 2b 77 2d f1 5a 18 90 85 11 66 42 3a 1e 25 4a 42 2e 0e 31 fe 85 ee 9d 89 a3 11 38 8c 46 d4 66 3e 05 f2 79 3d 2a b4 d9 28 ae 9d f8 09 7e 3c d4 45 9e 32 ee 46 6b 0a a1 4a 28 8c 06 65 4f 4c 46 91 ca 06 6b 05 0a 55 ea a0 db d1 ea 70 ca 44 f0 a2 dc 44 a2 24 1f 72 77 a1 50 b7 7a 5a 62 fc 05 48 c6 7a a5 85 c1 b1 5b 96 b3 cc f6 fc d1 94 e8 5a aa 56 63 6d af 03 c3 3c 99 04 c1 da aa af 92 cd 1c 58 8e 25 6f 12 f1 20 79 2b 7e 9c 45 b1 b7 72 b6 45 b0 2a 63 15 6b e1 8e 62 14 08 80 0f 39 47 05 6c e9 f7 81 a6 0a d1 0f 51 27 43 1e 38 90 5f 6a 80 39 c0 83 5f 52 ed fa d7 45 b9 d9 e6 df b9 35 8b 7d 69 d5 a7 2f b4 21 a3 86 d5 08 6a 06 cc 22 6f dd ea 18 fa 21 5a 15 d3 ec ed 0b 51 34 d4 6b 25 ae 53 70 d9 ab 9f 0f 4c 19 f5 14 de 0c 31 2b Data Ascii: AZIK+w-ZfB:%JB.18Ff>y=(~<E2FkJ(eOLFkUpDD$rwPzZbHz[ZVcm<X%o y+~ErEckb9GlQ'C8_j9_RE5}i/!j"o!ZQ4k%SpL1+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49797	13.107.213.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:39 UTC	663	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:40 UTC	805	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:40 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49ED96E0 x-ms-request-id: 6d23ac16-e01e-0054-03c3-962aa5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031240Z-1865489d5f47spgmg1tk1770cg0000000atg000000008863 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 03:12:40 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49798	13.107.213.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:39 UTC	624	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:40 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:40 GMT Content-Type: application/x-javascript Content-Length: 35813 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Feb 2024 19:13:16 GMT ETag: 0x8DC2E5A29EDB0A1 x-ms-request-id: 004f1334-f01e-0019-2985-9626af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031240Z-1865489d5f4b68hj4nmrur3p700000000ap000000000b7n0 x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 03:12:40 UTC	15566	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 7b 7f db 38 92 28 fa ff f9 14 b6 a6 c7 11 db b4 2c ea 2d db 8c c7 f1 a3 93 99 a4 93 cd a3 67 67 6c 75 86 a2 20 89 6d 8a 94 49 ca 8f c4 de cf 7e ab 0a 6f 52 76 92 d9 b3 e7 dc df bd 99 69 9a 28 14 0a 85 02 50 28 14 0a d4 ee cf 9b ff 6b e3 e7 8d 9d ef ff b7 f1 e1 e3 d1 fb 8f 1b 6f cf 36 3e be 7c f5 fe 64 e3 1d a4 fe b1 f1 eb db 8f af 8e 4f bf 9f 0e 56 8a ff 7d 9c 47 f9 c6 34 8a d9 06 fc 1d 07 39 9b 6c a4 c9 46 9a 6d 44 49 98 66 cb 34 0b 0a 96 6f 2c e0 99 45 41 bc 31 cd d2 c5 46 31 67 1b cb 2c fd 83 85 45 be 11 47 79 01 85 c6 2c 4e 6f 36 ea 40 2e 9b 6c bc 0b b2 e2 6e e3 d5 3b a7 01 f4 19 50 8b 66 51 02 a5 c3 74 79 07 ef f3 62 23 49 8b 28 64 1b 41 32 21 6a 31 24 92 9c 6d ac 92 09 cb 36 6e e6 51 38 df 78 13 85 59 9a a7 d3 62 Data Ascii: {8(,-gglu mI~oRvi(P(ko6>\|dOV}G49lFmDIf4o,EA1F1g,EGy,No6@.ln;PfQtyb#I(dA2!j1$m6nQ8xYb
2024-04-26 03:12:40 UTC	16384	IN	Data Raw: fb f4 8a 9f 60 92 f4 a9 99 cc fa b2 bd d7 13 b0 c4 06 dc ca 65 96 2c ec 0f e5 1d 27 21 95 80 e4 d4 cb 2b 1f 51 c4 8b 15 a2 2b 7a 64 54 7d 78 69 fe fa 15 f1 34 37 7f ff 6a 48 38 1a 63 c0 31 54 3e 0d 4a 3c 74 5e fb 49 76 ca 59 7b 5d bb 7c 7a dd 96 b0 75 ce 53 22 b3 de f0 a1 2c fb db ee 74 13 31 9f 8b df f9 c1 01 f8 21 9a a9 2f 3e 92 7d 93 1b 80 50 01 a6 12 d2 92 90 6b 1b a2 4f df 78 d2 08 c8 0e 38 44 1d a9 b7 45 fa aa 04 50 9f a1 66 22 2d 27 02 ed 08 cd ef cc 4d 44 5a 5d b0 9c 72 80 0a b5 a6 e3 0f 00 98 4b 42 87 83 cc 2f c2 11 eb e5 cf 3f d0 77 57 f9 cf 71 c9 a1 46 3d 8b e0 b5 83 72 11 e4 73 39 87 69 73 9b 2f ec 2f 29 53 cd e5 0e 5d 44 92 7e 5b 00 d4 47 1c 02 9e 54 2e b0 50 a4 55 20 57 a8 6e ee 7c 78 7b f6 51 8f 40 42 4c a7 85 1e 83 1c 12 1b de fe a9 80 48 Data Ascii: `e,'!+Q+zdT}xi47jH8c1T>J<t^IvY{]\|zuS",t1!/>}PkOx8DEPf"-'MDZ]rKB/?wWqF=rs9is//)S]D~[GT.PU Wn\|x{Q@BLH
2024-04-26 03:12:40 UTC	3863	IN	Data Raw: ac c2 18 06 70 37 5a 66 93 fc 61 14 40 f7 bf 8e fc cd dd a4 86 91 90 19 d3 45 f3 72 8f 21 d5 e4 0c 79 9a 4f 10 48 66 a8 4e a4 db e3 4b c1 87 72 bb 6d 34 d5 3e d9 cc 55 c8 ee 9c a4 a6 95 b9 d5 17 33 33 2c e8 70 fb 44 11 ed bb 2c 48 eb 8c 92 a6 b8 a8 8a e5 0a 9f 59 31 be e5 8c 34 65 74 1e 1c 19 75 de 81 31 86 b5 fe 29 4d 81 0b 7b 6d e1 fe 15 2e 1f 3e ef ec 93 cf 31 d1 93 93 0c 4e 1f 1b ff a4 f6 da 09 9c d7 b5 ee c9 6b 67 87 b8 3c 9d ce 19 2e 03 e2 e2 f1 42 df df f1 2b 2b 86 2b a8 9a 25 10 da a6 5a 4e ee 79 00 b9 f3 53 d2 6d 63 74 4b d1 35 fc e2 22 6c e8 e9 c0 6c bf f5 8e a0 23 c0 d8 95 3b 3d eb 13 df e7 53 29 ef 2b 5b 5d c9 12 0c 9e 8a 33 00 52 25 5a b7 87 89 f1 16 cb 67 4f 25 77 f7 16 52 dc ae f6 b1 c2 c6 4b c1 41 51 e7 9d 50 3f d3 0e 55 45 ba 19 14 a8 a5 Data Ascii: p7Zfa@Er!yOHfNKrm4>U33,pD,HY14etu1)M{m.>1Nkg<.B+++%ZNySmctK5"ll#;=S)+[]3R%ZgO%wRKAQP?UE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49800	13.107.246.41	443	5284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 03:12:41 UTC	418	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 03:12:41 UTC	805	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 03:12:41 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49ED96E0 x-ms-request-id: 6d23ac16-e01e-0054-03c3-962aa5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T031241Z-1865489d5f42v7z23dxn2r65v40000000aug000000006ggw x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 03:12:41 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Target ID:	0
Start time:	05:12:01
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:12:05
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2012,i,13689327843227247037,18124641368038824989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:12:07
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91