Edit tour

Windows Analysis Report
https://url.us.m.mimecastprotect.com/s/7x7ICAD2XpCymA4RtG3TqX?domain=knightlaw.com

Overview

General Information

Sample URL:	https://url.us.m.mimecastprotect.com/s/7x7ICAD2XpCymA4RtG3TqX?domain=knightlaw.com
Analysis ID:	1676575
Infos:

Detection

Score:	1
Range:	0 - 100
Confidence:	80%

Signatures

HTML body contains low number of good links

HTTP GET or POST without a user agent

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1924,i,8050775368731480592,5077760545141803960,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2012 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6324 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.us.m.mimecastprotect.com/s/7x7ICAD2XpCymA4RtG3TqX?domain=knightlaw.com" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1host: www.bing.comorigin: https://www.bing.comreferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Initaccept: */*accept-language: en-CHcontent-type: text/xmlx-agent-deviceid: 01000A4109008071x-bm-cbt: 1741354868x-bm-dateformat: dd/MM/yyyyx-bm-devicedimensions: 784x984x-bm-devicedimensionslogical: 784x984x-bm-devicescale: 100x-bm-dtz: 0x-bm-market: CHx-bm-theme: 000000;0078d7x-bm-windowsflights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12EC0B54,FX:12F0AC91,FX:12FF5D3C,FX:13083122,FX:13143E2F,FX:1318CA30,FX:1318CAEE,FX:1318CAEF,FX:1318CBED,FX:1318CBF1,FX:13214552,FX:13283A3B,FX:133A07C7,FX:133BFFE3,FX:13404069,FX:134128A5,FX:1342B470,FX:13499FAF,FX:134B0F33,FX:1355BA1D,FX:135DF0BBx-device-clientsession: A1A2AC28AE634D2FA6586B168043CEABx-device-isoptin: falsex-device-machineid: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}x-device-ossku: 48x-device-touch: falsex-deviceid: 01000A4109008071x-msedge-externalexp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshx-msedge-externalexptype: JointCoordx-positionertype: Desktopx-search-appid: Microsoft.Windows.Cortana_cw5n1h2txyewy!

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 28 Apr 2025 18:18:44 GMTContent-Type: text/html; charset=utf-8Content-Length: 180Connection: keep-alivex-content-type-options: nosniffx-xss-protection: 1; mode=blockx-frame-options: SAMEORIGINReferrer-Policy: no-referrerX-Robots-Tag: noindex, nofollowStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U"Vary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 28 Apr 2025 18:18:57 GMTContent-Type: text/html; charset=utf-8Content-Length: 180Connection: keep-alivex-content-type-options: nosniffx-xss-protection: 1; mode=blockx-frame-options: SAMEORIGINReferrer-Policy: no-referrerX-Robots-Tag: noindex, nofollowStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U"Vary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 28 Apr 2025 18:19:07 GMTContent-Type: text/html; charset=utf-8Content-Length: 180Connection: keep-alivex-content-type-options: nosniffx-xss-protection: 1; mode=blockx-frame-options: SAMEORIGINReferrer-Policy: no-referrerX-Robots-Tag: noindex, nofollowStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U"Vary: Accept-Encoding

Source: chromecache_73.1.dr	String found in binary or memory: http://www.mimecast.com/
Source: chromecache_73.1.dr	String found in binary or memory: https://community.mimecast.com/docs/DOC-241

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 192.178.49.196:443 -> 192.168.2.9:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.139.111.113:443 -> 192.168.2.9:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.139.111.113:443 -> 192.168.2.9:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 170.10.132.89:443 -> 192.168.2.9:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 170.10.132.89:443 -> 192.168.2.9:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 170.10.132.89:443 -> 192.168.2.9:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.9:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.227.208:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.9:49716 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@21/26@8/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1924,i,8050775368731480592,5077760545141803960,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2012 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.us.m.mimecastprotect.com/s/7x7ICAD2XpCymA4RtG3TqX?domain=knightlaw.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1924,i,8050775368731480592,5077760545141803960,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2012 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://url.us.m.mimecastprotect.com/s/7x7ICAD2XpCymA4RtG3TqX?domain=knightlaw.com	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
url.us.m.mimecastprotect.com	205.139.111.113	true	false	high
security-us.m.mimecastprotect.com	170.10.132.89	true	false	high
www.google.com	192.178.49.196	true	false	high

Contacted URLs

Name	Malicious	Reputation
https://security-us.m.mimecastprotect.com/ttpwp/resources/images/mimecast-logo.png	false	high
https://security-us.m.mimecastprotect.com/ttpwp	false	high
https://security-us.m.mimecastprotect.com/ttpwp/#/enrollment?key=5092c046-e9c8-474f-b6dd-48227813a20d	false	high
https://security-us.m.mimecastprotect.com/ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273	false	high
https://security-us.m.mimecastprotect.com/ttpwp/resources/runtime.0ecbe67b2d69cf74a815.js	false	high
https://security-us.m.mimecastprotect.com/ttpwp/resources/styles.0ecbe67b2d69cf74a815.js	false	high
https://security-us.m.mimecastprotect.com/ttpwp/resources/main.0ecbe67b2d69cf74a815.js	false	high
https://security-us.m.mimecastprotect.com/ttpwp/resources/languages/en.json	false	high
http://c.pki.goog/r/r4.crl	false	high
https://security-us.m.mimecastprotect.com/ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2	false	high
https://security-us.m.mimecastprotect.com/ttpwp/resources/polyfills.0ecbe67b2d69cf74a815.js	false	high
https://security-us.m.mimecastprotect.com/api/ttp/url/enroll-user	false	high
https://security-us.m.mimecastprotect.com/ttpwp/resources/images/favicon.ico	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.mimecast.com/	chromecache_73.1.dr	false		high
https://community.mimecast.com/docs/DOC-241	chromecache_73.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
205.139.111.113	url.us.m.mimecastprotect.com	United States	30031	MIMECAST-US	false
192.178.49.196	www.google.com	United States	15169	GOOGLEUS	false
170.10.132.89	security-us.m.mimecastprotect.com	United States	30031	MIMECAST-US	false

Private

IP
192.168.2.9

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1676575
Start date and time:	2025-04-28 20:17:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://url.us.m.mimecastprotect.com/s/7x7ICAD2XpCymA4RtG3TqX?domain=knightlaw.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@21/26@8/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.178.49.174, 142.250.68.227, 142.250.101.84, 192.178.49.206, 192.178.49.170, 142.250.68.234, 142.250.69.10, 192.178.49.202, 23.55.241.178, 192.178.49.163, 184.29.183.29
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://url.us.m.mimecastprotect.com/s/7x7ICAD2XpCymA4RtG3TqX?domain=knightlaw.com

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 254 x 120, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4228
Entropy (8bit):	7.468692581181979
Encrypted:	false
SSDEEP:	96:vSn6knmWIrIlW/QHCZhHF4HVywjjjWm3QsVA56VBT1CvWrBLjjjjQ:vSn6knDiZhCIwjjjH31VAgBTm0RjjjjQ
MD5:	EB9048F8FBF87B993E77B0AB95DAAA60
SHA1:	38B9F52981F1E3E7C0AA3F9C0773D971D28218BC
SHA-256:	35175BBAB647CEC8479F295A98978D170CD7B62E5FD3F7B64DEFAE81B517B16A
SHA-512:	4C4E50D85B3A1F21674CF080DBD3227FBEECA50B1C6B113E1767E8D6AECF666BE65CBC7A86E17C8E9A72A24AFE335C3EB70C392278E31171D90603AD42FC7E3C
Malicious:	false
Reputation:	low
URL:	https://security-us.m.mimecastprotect.com/ttpwp/resources/images/mimecast-logo.png
Preview:	.PNG........IHDR.......x.......O.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmp:CreateDate="2021-10-29T15:56:24+01:00" xmp:ModifyDate="2021-11-02T15:28:31Z" xmp:MetadataDate="2021-11-02T15:28:31Z" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:e59b0272-9f84-d042-b610-49114ee72bcc" xmpMM:DocumentID="xmp.did:0289126f-2158-4f47-aeef-18573cdfc66d" xmpMM:OriginalDocumentID

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	20
Entropy (8bit):	3.5086949695628418
Encrypted:	false
SSDEEP:	3:8/9VhV/Cm:8/9/Vam
MD5:	4ED71EED77D1C12FE35CBE4D591F22F5
SHA1:	60AC07F101FC34AEB416E9C89BA1D5C9F42ED33B
SHA-256:	6CB2B24E7310C9007261AC7DE5BB5BCE1DC1AFD914250345DF157CDC064DFE38
SHA-512:	26F465D41262932F8B0A8B3F73E00F01D8B398A10679C651486635BE941E0FFCB263CD75ED7FC5386DBB6B75D826E647A14E60B18D17FA3A91BFD723781ED756
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIZCXaJSeWsEskzEgUNWfmV9CGP0mT-T-9AuA==?alt=proto
Preview:	Cg0KCw1Z+ZX0GgQIZBgC

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 37608, version 1.0
Category:	downloaded
Size (bytes):	37608
Entropy (8bit):	7.9930739048349935
Encrypted:	true
SSDEEP:	768:NzA1kfxARdebgMmiX+c2BERO9/ufrv7KkffWz6tw2O7i:NzA1k5aebgMmYWH9mfpfSmPOe
MD5:	E5231978386520AFD0019A8F5D007882
SHA1:	5E06725A18323ED9372E3E488D4F6DF1A56B3091
SHA-256:	71BF29B23EAACC10ACE4DB7E3711FD8F16F199F8F5F8FF5895A0BB0C13546509
SHA-512:	D5EEE91E55BFE7FB220705545D6E767C1A969F4E313F1991C220F4EAA05A7ABC83EE9E6B804D1DF90C1779591F587E1FD58230E120CDA529F8C98BC337E4D3D3
Malicious:	false
Reputation:	low
URL:	https://security-us.m.mimecastprotect.com/ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273
Preview:	wOF2............../..............................T.V..N...x..S..~..6.$..x. ..2..U.C..T'.a..!...{.1...l.$......\|...(.U...=A.1...PkY..N....t.+P`..Kp.:n......p......~.......-....`;D.vu.p.N.t......]u....m....Hln..a.x..N.gl...'[`..V..L{.....f.9.l..sw7....M.....B..n.M.6.....z..(...)..}>...... .A.KG}.Q...Z.....G.w\K........a..,.F...3....Z.i)-..<l.eEu.eY.e6..66].VY.5.n.....\_..W....J.ARC.{....u...r.H-...x.A-j.z........?...0..K..EU...v...YC..y.?J.{.._..L60.R..%...X...j..B]E..U.w.?.....J....dD..9.'.r....o.....X.l.^@>...wj?w.7S<G3ch..%..2Hr....&.....K..Q..l;.......f..O2$..}H K......s...~.m..t\|..+.........'..,S...H{@.X.S.E....p.g..\|.{E....Vi7...u.:K...r.3s~.....d..........(tC.......D....f....higI..9.q...Y.....J.F.....X...2c./......dM.K........1....&.. L.A,I....gL....2.i.Rd.8.h.0w....=.@.b.Q..@AP.}K?.$.....k..."...D..5....#...3r.eY@(p.........&....\...@..q..1......F k<....=....9G.f*..........y..N..[..._5.....U.@..\|}..u.k2..7...).#y.................d..B

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1057448
Entropy (8bit):	5.596973852800436
Encrypted:	false
SSDEEP:	24576:3GHAoVuog7AhVuhguWKAhVuhIOpSr3TSZWkcSO2dpQRPQGLgFpScB8DFaGGemDKW:npSHepScB8CeZ3MZmSCZqFuOF
MD5:	682426F0D6BB971999A034CDEF5EDFDB
SHA1:	0BAA1B75752BF03D72B43102C6E71F22BF10BC69
SHA-256:	9E59B7A074027B5A2DA3A9CE37C59BEFAE3DA8ED42112BF07454966546922116
SHA-512:	32DE760CA2592731D2E941348C2CBBC0F8CAFE33A015B16D41906DC037556CD3496CFCFC46CEAAC69E84E02648D3A1E227C066B4D5C12D5E2780AD40FACAB869
Malicious:	false
Reputation:	low
URL:	https://security-us.m.mimecastprotect.com/ttpwp/resources/main.0ecbe67b2d69cf74a815.js
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[1],{"+br3":function(e,t,n){!function(e){"use strict";e.defineLocale("eu",{months:"urtarrila_otsaila_martxoa_apirila_maiatza_ekaina_uztaila_abuztua_iraila_urria_azaroa_abendua".split("_"),monthsShort:"urt._ots._mar._api._mai._eka._uzt._abu._ira._urr._aza._abe.".split("_"),monthsParseExact:!0,weekdays:"igandea_astelehena_asteartea_asteazkena_osteguna_ostirala_larunbata".split("_"),weekdaysShort:"ig._al._ar._az._og._ol._lr.".split("_"),weekdaysMin:"ig_al_ar_az_og_ol_lr".split("_"),weekdaysParseExact:!0,longDateFormat:{LT:"HH:mm",LTS:"HH:mm:ss",L:"YYYY-MM-DD",LL:"YYYY[ko] MMMM[ren] D[a]",LLL:"YYYY[ko] MMMM[ren] D[a] HH:mm",LLLL:"dddd, YYYY[ko] MMMM[ren] D[a] HH:mm",l:"YYYY-M-D",ll:"YYYY[ko] MMM D[a]",lll:"YYYY[ko] MMM D[a] HH:mm",llll:"ddd, YYYY[ko] MMM D[a] HH:mm"},calendar:{sameDay:"[gaur] LT[etan]",nextDay:"[bihar] LT[etan]",nextWeek:"dddd LT[etan]",lastDay:"[atzo] LT[etan]",lastWeek:"[aurreko] dddd LT[etan]",sameElse:"L"},relativeTim

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.755948041571961
Encrypted:	false
SSDEEP:	3:PouV7uJLzLcvzSAEtvxLzUbSodX7JH4vrLUe9ubygGjxcM16SWXxVWRaecKBc4NM:hxuJLzLcbzEdxqXLorwe9UygqxcMUSWp
MD5:	B574A8D3BC4C6A4FE57E89008E9645A3
SHA1:	471EBF49ADD18D605FD24F188DD460F165DDEF45
SHA-256:	3237A8FE51F94BBF3E3E38E4A8E0DC1A643F5DFB5C49D265A8B456CD646D6FCC
SHA-512:	011CB4A90C3B5A4D467B8765A51121CC2AAE9F5C1B570DC82D73D3B12B32F63928F6BD9BE96C5410212392A13DA287154D729A1E0D21AF3E13CCB07F2DD11224
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html>.<head>. <title></title>.</head>.<body>.<h1>Error 404</h1>.<h2>Sorry, page not found.</h2>.<p>We could not find the page you requested.</p>.</body>.</html>

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1492), with no line terminators
Category:	downloaded
Size (bytes):	1492
Entropy (8bit):	5.1504605464747675
Encrypted:	false
SSDEEP:	24:ECoyffRGmcH7LprYMEw7zsQCBm3lBmGa0BTLWwMWiB/azfIvJkwIdd8BtIcf:EhyHRZclYME0QQuKTLWnBeYkVd8By8
MD5:	3AD4DE7EFFAAC3D0048EF54F8491451F
SHA1:	B807DD524C22B9F6241B1EF14AD6902D5C9D9215
SHA-256:	6C36E59711DF161A3D7A2D6FB3E5C17A8767A2F42AEADD9BF166830FDB8ACD5E
SHA-512:	B605EE47C436722BD21C501299EE1A6D96CC34D582003D6DD539AEE7A91E4EC78BFB6194E2226179627A5152DE16A7ADA2462BA5856F1FAF2647A65D24AB9CBE
Malicious:	false
Reputation:	low
URL:	https://security-us.m.mimecastprotect.com/ttpwp/resources/runtime.0ecbe67b2d69cf74a815.js
Preview:	!function(e){function r(r){for(var n,l,p=r[0],f=r[1],i=r[2],c=0,s=[];c<p.length;c++)l=p[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(a&&a(r);s.length;)s.shift()();return u.push.apply(u,i\|\|[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,p=1;p<t.length;p++)0!==o[t[p]]&&(n=!1);n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={0:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)\|\|Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	3.28732561467651
Encrypted:	false
SSDEEP:	12:qmiiaZgszpGHr0Tn8D+c35COXpapjD4k1PZiwae4vPdeegbOh6mv8n:AusLGfEhB9a6mE
MD5:	44385673EEF386EC121603CD302FD05F
SHA1:	C15A6D61054FFB16D8DF4DA943B545349FC82631
SHA-256:	069E8A1E31ABA074CC28BC9D6D54C67495BD42A02115DC232BE7C8D9F83E40A8
SHA-512:	E80C43BE006B5EEB66F98192B177163E92B75A5CD0AAA880ADE24A67DB7A1F29A0CB958B158244DB47386CDC775DD025E0FC1F97E3D7ADCDDB76D347F3073DA7
Malicious:	false
Reputation:	low
URL:	https://security-us.m.mimecastprotect.com/ttpwp/resources/images/favicon.ico
Preview:	............ .h.......(....... ..... .........................................................................................................\|kW.\|kW.................................................\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.....\|kW.\|kW2............................\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.....\|kW.\|kW.\|kWX....................\|kW.\|kW.\|kW.........\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.\|kW<................\|kWm\|kW.\|kW.........\|kW.\|kW.\|kWg\|kW.\|kW.\|kW.\|kW.\|kW.................\|kW.\|kW.\|kW.\|kW.\|kW.\|kWn....\|kW.\|kW.\|kW.\|kW.\|kWr....................\|kWn\|kW.\|kW.\|kWU........\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.....................\|kW\|\|kWe............\|kW.\|kW.\|kW.\|kW.\|kW.\|kW=....................\|kW.\|kWa\|kW.\|kW.\|kW.\|kW{\|kW.\|kW.\|kW}\|kW.\|kW.................\|kW)\|kW.\|kW.\|kW.\|kW.\|kW.\|kW`............\|kWy\|kW.................\|kWW\|kW.\|kW.\|kW.\|kW.\|kW.\|kW`............\|kWN\|kW.................\|kW`\|kW.\|kW.\|kW.\|kW.\|kW.\|kW`\|kW.\|kWb\|kW.\|kW.\|kW.................\|kW.\|kW&\|kWS\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.\|kW~\|kW@\|kW ................................\|kW.\|kW.\|kW.\|k

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.28732561467651
Encrypted:	false
SSDEEP:	12:qmiiaZgszpGHr0Tn8D+c35COXpapjD4k1PZiwae4vPdeegbOh6mv8n:AusLGfEhB9a6mE
MD5:	44385673EEF386EC121603CD302FD05F
SHA1:	C15A6D61054FFB16D8DF4DA943B545349FC82631
SHA-256:	069E8A1E31ABA074CC28BC9D6D54C67495BD42A02115DC232BE7C8D9F83E40A8
SHA-512:	E80C43BE006B5EEB66F98192B177163E92B75A5CD0AAA880ADE24A67DB7A1F29A0CB958B158244DB47386CDC775DD025E0FC1F97E3D7ADCDDB76D347F3073DA7
Malicious:	false
Reputation:	low
Preview:	............ .h.......(....... ..... .........................................................................................................\|kW.\|kW.................................................\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.....\|kW.\|kW2............................\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.....\|kW.\|kW.\|kWX....................\|kW.\|kW.\|kW.........\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.\|kW<................\|kWm\|kW.\|kW.........\|kW.\|kW.\|kWg\|kW.\|kW.\|kW.\|kW.\|kW.................\|kW.\|kW.\|kW.\|kW.\|kW.\|kWn....\|kW.\|kW.\|kW.\|kW.\|kWr....................\|kWn\|kW.\|kW.\|kWU........\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.....................\|kW\|\|kWe............\|kW.\|kW.\|kW.\|kW.\|kW.\|kW=....................\|kW.\|kWa\|kW.\|kW.\|kW.\|kW{\|kW.\|kW.\|kW}\|kW.\|kW.................\|kW)\|kW.\|kW.\|kW.\|kW.\|kW.\|kW`............\|kWy\|kW.................\|kWW\|kW.\|kW.\|kW.\|kW.\|kW.\|kW`............\|kWN\|kW.................\|kW`\|kW.\|kW.\|kW.\|kW.\|kW.\|kW`\|kW.\|kWb\|kW.\|kW.\|kW.................\|kW.\|kW&\|kWS\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.\|kW~\|kW@\|kW ................................\|kW.\|kW.\|kW.\|k

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	17216
Entropy (8bit):	5.3916928747919055
Encrypted:	false
SSDEEP:	384:+6W07PLkroKAqnNN6cVSfMSYICv70n6vxVgHNH3pv/EYRs6Um2kLBPUMx:RB7PLkcMTSETv5rgt5EkUEPUu
MD5:	557F6A48768DD7A1A5B218E047DD614E
SHA1:	DC4B86159E615BBC725958A6D1140FD00F304E58
SHA-256:	91BB156262610251086C8995CBA4FD16F64DDE0F78EA069CBF488EA3FB71958D
SHA-512:	5B382CDABDB041C946FDEF254807A6D036E55CAAB61CE95460478D52A62D65F23AB11B0CBA89DAEA7CDAEF133830150F261A894F353B0ACEEA5EBEA79F4D0293
Malicious:	false
Reputation:	low
URL:	https://security-us.m.mimecastprotect.com/ttpwp/resources/languages/en.json
Preview:	{"DECISION_WILL_BE_LOGGED":"Your decision will be logged for tracking and audit purposes.","IN_PRIVATE_BROWSER_MODE_WARNING":"Please leave {{browser}} to complete device enrollment.","IN_PRIVATE_CHROME":"Incognito mode","IN_PRIVATE_FIREFOX":"Private Browsing","IN_PRIVATE_SAFARI":"Private Browsing","IN_PRIVATE_IE":"InPrivate mode","COMPATIBILITY_VIEW":"Compatibility View","IN_PRIVATE_EDGE":"InPrivate mode","DISABLED_COOKIE_ERROR":"<strong>Cookies are required.</strong> To continue, please allow cookies in your browser and try again.","ACCESS_DENIED_MESSAGE_COMPONENT":{"TITLE":"Sorry, you don.t have permission to access this page","DESCRIPTION":"If you need access, please contact your administrator.","LINK_1":"Go to the login page"},"$I18N_ACCOUNT_SWITCH_BAR":{"VIEWING_ACCOUNT":"Viewing account"},"$I18N_ASIDE_RECIPIENTS":{"SEARCH_PLACEHOLDER":"Search recipients","COLUMNS":{"EMAIL":"Recipients","STATUS":"Message Status"},"STATUS":{"DELIVERY":"Pending Delivery","DELIVERED":"Delivered","H

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	410447
Entropy (8bit):	4.969953504958795
Encrypted:	false
SSDEEP:	1536:5gttQTtsXFCVwRFtoN5h6SF9t/kqpEE9lcl2ldk66LebnuyMKdPSNZSp+4e4Vgx:5G7RFtoN5OebnuyRdPSPSEGo
MD5:	B93A06166FAB6F0B09F66089685DF6FA
SHA1:	B8DF3D9B12BCD2CF6E3CEA2CC0ED99C783814E1F
SHA-256:	558A0A353248BB83AEE2484AA4AC0D89528D31235BD447E5E552E20EEB452B24
SHA-512:	475EC38ECF2565CFE184B8F06AEE39E30C532DCAC42A60FD9CA8024D7D1BDB5B6C486E7CE0BE27E471999D2E012A6D653FF3D2414069D8B6AC796C5F0B86115F
Malicious:	false
Reputation:	low
URL:	https://security-us.m.mimecastprotect.com/ttpwp/resources/styles.0ecbe67b2d69cf74a815.js
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[4],{4:function(n,e,o){n.exports=o("lEuh")},JPst:function(n,e,o){"use strict";n.exports=function(n){var e=[];return e.toString=function(){return this.map(function(e){var o=n(e);return e[2]?"@media ".concat(e[2]," {").concat(o,"}"):o}).join("")},e.i=function(n,o,t){"string"==typeof n&&(n=[[null,n,""]]);var a={};if(t)for(var r=0;r<this.length;r++){var c=this[r][0];null!=c&&(a[c]=!0)}for(var l=0;l<n.length;l++){var i=[].concat(n[l]);t&&a[i[0]]\|\|(o&&(i[2]=i[2]?"".concat(o," and ").concat(i[2]):o),e.push(i))}},e}},LboF:function(n,e,o){"use strict";var t,a=function(){var n={};return function(e){if(void 0===n[e]){var o=document.querySelector(e);if(window.HTMLIFrameElement&&o instanceof window.HTMLIFrameElement)try{o=o.contentDocument.head}catch(t){o=null}n[e]=o}return n[e]}}(),r=[];function c(n){for(var e=-1,o=0;o<r.length;o++)if(r[o].identifier===n){e=o;break}return e}function l(n,e){for(var o={},t=[],a=0;a<n.length;a++){var l=n[a],i=e.base

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	95292
Entropy (8bit):	5.3286141701672785
Encrypted:	false
SSDEEP:	1536:XtRQ1TMnmHtOTFhNrG/W6hFDGNC3LNqqo:XbQ1sNhNr/KZqL
MD5:	43948F311AC20AC5C1860119413D048C
SHA1:	875EC7627DA8DA2F2C078DEDFB8E4250279D87F5
SHA-256:	131EEE5FF2F8A59E2C904505B412C7632F46CA2A5F62A27D45F7E6ED79B68B27
SHA-512:	6C96ADCB95FD346DFB3FAFD87FB3E4575E1BBC59D60245C82773A0A17C29D60EABCE3821FD64BB575AF0BBCA2D6EE6BD2DD2CFB3AFB842B30FEA5A9003D7A19B
Malicious:	false
Reputation:	low
URL:	https://security-us.m.mimecastprotect.com/ttpwp/resources/polyfills.0ecbe67b2d69cf74a815.js
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[2],{"0TWp":function(e,t,n){"use strict";var r,i,o=this&&this.__spreadArray\|\|function(e,t,n){if(n\|\|2===arguments.length)for(var r,i=0,o=t.length;i<o;i++)!r&&i in t\|\|(r\|\|(r=Array.prototype.slice.call(t,0,i)),r[i]=t[i]);return e.concat(r\|\|Array.prototype.slice.call(t))};void 0===(i="function"==typeof(r=function(){!function(e){var t=e.performance;function n(e){t&&t.mark&&t.mark(e)}function r(e,n){t&&t.measure&&t.measure(e,n)}n("Zone");var i=e.__Zone_symbol_prefix\|\|"__zone_symbol__";function o(e){return i+e}var a=!0===e[o("forceDuplicateZoneCheck")];if(e.Zone){if(a\|\|"function"!=typeof e.Zone.__symbol__)throw new Error("Zone already loaded.");return e.Zone}var s=function(){function t(e,t){this._parent=e,this._name=t?t.name\|\|"unnamed":"<root>",this._properties=t&&t.properties\|\|{},this._zoneDelegate=new l(this,this._parent&&this._parent._zoneDelegate,t)}return t.assertZonePatched=function(){if(e.Promise!==R.ZoneAwarePromise)throw new Error("

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 137104, version 331.-31196
Category:	downloaded
Size (bytes):	137104
Entropy (8bit):	7.998265825794848
Encrypted:	true
SSDEEP:	3072:6uGMxS/+gbEUbwrT4pZT630r3OhDkLWJZYa3se4YuOzf7ThRvu3jzJ8Va1I:9AmAZ230r3rLOSa3YOzf7NdYz6WI
MD5:	DBF1FC91F1BEEC2915123257EA4D58EF
SHA1:	D2A6D5D31334F6D0831F1C17D26E23FE0AA6A8DB
SHA-256:	8D4D29042C23B5FCBED3AF690421776DE0F8AD3D308D66E24A9D80BCC8CCB522
SHA-512:	72E9CCB5CE2D88AAC739B513B95DFB7667CF80B617510AAFEB2C72345C7CDC3459B7002C4A46AFD967AFC1E3CAB091E078EA9CB6437550B4C7990009799128A2
Malicious:	false
Reputation:	low
URL:	https://security-us.m.mimecastprotect.com/ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2
Preview:	wOF2...............P...4.K.$....................?FFTM....`........h..9.6.$..\|..... ......=[...D...66U..n2..s.O7..-.n......^...O...R..'@.......d"...Iv".kZ.......(..A...b.Te..!d.I......f....{.})2.W.lo....a^......S..K..^A.t..z.7.[s.....&9H.}k...rU4.rt..u..'......o............FsD!....)FERh....Q2.4@...3df..i...q5pU.(7W7m........x\...o.(...!....O5n........J...^s.5.~...3=""B}...z...#&.....oX.~}.]H..yF.I.j.H.DJ..o.-...i.. }......\k.u.h...o..b-y..\7..S: ...#4...O./...=H.s@...S..YV.Z_...'......."..\4...N....... \.....b.?.=...6^&..E.a.....".W..\..P t..&<...>......u...B.q.....^VB....T..2.....S...H.p.(y..t..5...>4....U...q...C....A..b......E.....y."...P.......{wMr...0....CR~..l..j.O.M.-.%Ip................6D..L(5l..u......'4..Z..L...ZQ&V.F....-g+..+..V.Cn.....l.&B.f.X.L.lh......5...T....Z.5?...t..e.]...2H...Vd.. ..A..C...D...%.B]..C..8@..j.h.U......:j...B..m]......6..;.;Wv..'$I7.B...p....@.6.T!.?.F{..R...C[...../U....j..[U.......3N.'f........4_./6..x...

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17216
Entropy (8bit):	5.3916928747919055
Encrypted:	false
SSDEEP:	384:+6W07PLkroKAqnNN6cVSfMSYICv70n6vxVgHNH3pv/EYRs6Um2kLBPUMx:RB7PLkcMTSETv5rgt5EkUEPUu
MD5:	557F6A48768DD7A1A5B218E047DD614E
SHA1:	DC4B86159E615BBC725958A6D1140FD00F304E58
SHA-256:	91BB156262610251086C8995CBA4FD16F64DDE0F78EA069CBF488EA3FB71958D
SHA-512:	5B382CDABDB041C946FDEF254807A6D036E55CAAB61CE95460478D52A62D65F23AB11B0CBA89DAEA7CDAEF133830150F261A894F353B0ACEEA5EBEA79F4D0293
Malicious:	false
Reputation:	low
Preview:	{"DECISION_WILL_BE_LOGGED":"Your decision will be logged for tracking and audit purposes.","IN_PRIVATE_BROWSER_MODE_WARNING":"Please leave {{browser}} to complete device enrollment.","IN_PRIVATE_CHROME":"Incognito mode","IN_PRIVATE_FIREFOX":"Private Browsing","IN_PRIVATE_SAFARI":"Private Browsing","IN_PRIVATE_IE":"InPrivate mode","COMPATIBILITY_VIEW":"Compatibility View","IN_PRIVATE_EDGE":"InPrivate mode","DISABLED_COOKIE_ERROR":"<strong>Cookies are required.</strong> To continue, please allow cookies in your browser and try again.","ACCESS_DENIED_MESSAGE_COMPONENT":{"TITLE":"Sorry, you don.t have permission to access this page","DESCRIPTION":"If you need access, please contact your administrator.","LINK_1":"Go to the login page"},"$I18N_ACCOUNT_SWITCH_BAR":{"VIEWING_ACCOUNT":"Viewing account"},"$I18N_ASIDE_RECIPIENTS":{"SEARCH_PLACEHOLDER":"Search recipients","COLUMNS":{"EMAIL":"Recipients","STATUS":"Message Status"},"STATUS":{"DELIVERY":"Pending Delivery","DELIVERED":"Delivered","H

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 254 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4228
Entropy (8bit):	7.468692581181979
Encrypted:	false
SSDEEP:	96:vSn6knmWIrIlW/QHCZhHF4HVywjjjWm3QsVA56VBT1CvWrBLjjjjQ:vSn6knDiZhCIwjjjH31VAgBTm0RjjjjQ
MD5:	EB9048F8FBF87B993E77B0AB95DAAA60
SHA1:	38B9F52981F1E3E7C0AA3F9C0773D971D28218BC
SHA-256:	35175BBAB647CEC8479F295A98978D170CD7B62E5FD3F7B64DEFAE81B517B16A
SHA-512:	4C4E50D85B3A1F21674CF080DBD3227FBEECA50B1C6B113E1767E8D6AECF666BE65CBC7A86E17C8E9A72A24AFE335C3EB70C392278E31171D90603AD42FC7E3C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......x.......O.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmp:CreateDate="2021-10-29T15:56:24+01:00" xmp:ModifyDate="2021-11-02T15:28:31Z" xmp:MetadataDate="2021-11-02T15:28:31Z" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:e59b0272-9f84-d042-b610-49114ee72bcc" xmpMM:DocumentID="xmp.did:0289126f-2158-4f47-aeef-18573cdfc66d" xmpMM:OriginalDocumentID

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2088)
Category:	downloaded
Size (bytes):	3447
Entropy (8bit):	5.375155573043273
Encrypted:	false
SSDEEP:	48:08kjiKt+nPnlS2yYXyPXyBlt+nPnlS2yYXyPXybWISYjLo:0t+nvlmYCK3t+nvlmYCKbt4
MD5:	DE5C1E879C74EBA0945792548817107A
SHA1:	3871F82641CFC1887AF4B86204F8655BA0DA436F
SHA-256:	E9AC78E393B720910736D5A008D0BA3C9555E5923E3259C97099E232FDE3BA42
SHA-512:	54DD2C42F8B9BA7D44288EC4B64C4CE209B1BF7F1F7480E93E2519F817D8FE517F97512B457C3B7698D5449DE01750AB63A3D213C9F064B487D67B67E073EA6D
Malicious:	false
Reputation:	low
URL:	https://security-us.m.mimecastprotect.com/ttpwp
Preview:	<!doctype html>.<html lang="en">.<head>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no, maximum-scale=1, minimum-scale=1">. <title>Mimecast TTP Web Portal</title>. <meta name="apple-mobile-web-app-capable" content="yes">. [if lte IE 10]> <link rel="icon" href="/ttpwp/resources/images/favicon.ico" /> <![endif]-->. <link rel="shortcut icon" href="/ttpwp/resources/images/favicon.ico" />. <link rel="apple-touch-icon" sizes="152x152" href="/ttpwp/resources/images/favicon-mobile.png" />. <link rel="apple-touch-icon-precomposed" sizes="152x152" href="/ttpwp/resources/images/favicon-mobile.png" />. . . <script>window.mimecast = {"branding":{"defaultBranding":{"defaultConfiguration":{"knowledgeBase":{"href":"https://community.mimecast.com/docs/DOC-241","label":"LOGIN_HOME_LNK"},"home":{"href":"http://www.mimec

Total Packets: 273
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2025 20:18:17.163794041 CEST	49674	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:17.179434061 CEST	49675	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:17.179436922 CEST	49673	443	192.168.2.9	2.23.227.215
Apr 28, 2025 20:18:18.554511070 CEST	49676	80	192.168.2.9	2.23.73.143
Apr 28, 2025 20:18:18.554565907 CEST	49677	443	192.168.2.9	2.19.104.63
Apr 28, 2025 20:18:26.773813009 CEST	49674	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:26.780272007 CEST	49673	443	192.168.2.9	2.23.227.215
Apr 28, 2025 20:18:26.789391994 CEST	49675	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:27.524621964 CEST	49692	443	192.168.2.9	192.178.49.196
Apr 28, 2025 20:18:27.524667025 CEST	443	49692	192.178.49.196	192.168.2.9
Apr 28, 2025 20:18:27.524986982 CEST	49692	443	192.168.2.9	192.178.49.196
Apr 28, 2025 20:18:27.524986982 CEST	49692	443	192.168.2.9	192.178.49.196
Apr 28, 2025 20:18:27.525018930 CEST	443	49692	192.178.49.196	192.168.2.9
Apr 28, 2025 20:18:27.855354071 CEST	443	49692	192.178.49.196	192.168.2.9
Apr 28, 2025 20:18:27.855441093 CEST	49692	443	192.168.2.9	192.178.49.196
Apr 28, 2025 20:18:27.857000113 CEST	49692	443	192.168.2.9	192.178.49.196
Apr 28, 2025 20:18:27.857007027 CEST	443	49692	192.178.49.196	192.168.2.9
Apr 28, 2025 20:18:27.857599974 CEST	443	49692	192.178.49.196	192.168.2.9
Apr 28, 2025 20:18:27.909159899 CEST	49692	443	192.168.2.9	192.178.49.196
Apr 28, 2025 20:18:28.713560104 CEST	49694	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:28.713625908 CEST	443	49694	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:28.713743925 CEST	49694	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:28.714574099 CEST	49695	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:28.714634895 CEST	443	49695	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:28.714796066 CEST	49695	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:28.714868069 CEST	49694	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:28.714879036 CEST	443	49694	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:28.715029001 CEST	49695	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:28.715039015 CEST	443	49695	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:29.140904903 CEST	443	49695	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:29.140988111 CEST	49695	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:29.142163992 CEST	49695	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:29.142194033 CEST	443	49695	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:29.142386913 CEST	49695	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:29.142406940 CEST	443	49695	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:29.146918058 CEST	443	49694	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:29.147018909 CEST	49694	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:29.147293091 CEST	443	49695	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:29.148122072 CEST	49694	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:29.148132086 CEST	443	49694	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:29.149301052 CEST	443	49694	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:29.191926956 CEST	49695	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:29.192291021 CEST	49694	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:29.549304008 CEST	443	49695	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:29.549412012 CEST	49695	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:29.553436041 CEST	49695	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:29.553553104 CEST	443	49695	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:29.840415001 CEST	443	49695	205.139.111.113	192.168.2.9
Apr 28, 2025 20:18:29.880601883 CEST	49695	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:18:29.988019943 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:29.988059044 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:29.988152027 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:29.988327026 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:29.988333941 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:30.622987986 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:30.623111963 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:30.820494890 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:30.820518017 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:30.821346045 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:30.823430061 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:30.864278078 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.037266016 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.037554026 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.037609100 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.063616991 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.063642025 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.064115047 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.064167023 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.064232111 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.065537930 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.065552950 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.080833912 CEST	49698	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.080879927 CEST	443	49698	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.080941916 CEST	49698	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.081310034 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.081403017 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.081505060 CEST	49698	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.081515074 CEST	443	49698	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.081547976 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.081629038 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.081646919 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.283370018 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.283653021 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.283730030 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.285867929 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.285878897 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.695718050 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.696155071 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.696229935 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.696424961 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.696439028 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.699568033 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.699773073 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.699815035 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.699976921 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.699984074 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.708337069 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.708765984 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.708777905 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.708832979 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.708848000 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.708892107 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.709258080 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.709269047 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.709343910 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.716773987 CEST	443	49698	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.717024088 CEST	49698	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.717067957 CEST	443	49698	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.917145014 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.917165041 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.917283058 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.917795897 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.917870045 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:31.918513060 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:31.918626070 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.109174967 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.109603882 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.109613895 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.109711885 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.109785080 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.109857082 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.110063076 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.110074043 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.110152960 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.118750095 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.119167089 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.119177103 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.119265079 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.119333982 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.119404078 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.119647980 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.119661093 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.119729042 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.121541023 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.121629000 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.313409090 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.313555956 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.314361095 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.314451933 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.314904928 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.314990997 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.324111938 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.324218988 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.324770927 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.324853897 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.325342894 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.325423002 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.515882969 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.516094923 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.517215014 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.517229080 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.517366886 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.518203020 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.518376112 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.528502941 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.528610945 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.529095888 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.529181004 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.529648066 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.529726982 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.530400038 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.530414104 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.530503035 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.531135082 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.531223059 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.531616926 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.531687975 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.720850945 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.721048117 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.722347021 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.722412109 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.722510099 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.722582102 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.722810984 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.722881079 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.724070072 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.724145889 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.724246025 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.724968910 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.725133896 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.733851910 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.733947039 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.734421015 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.734508038 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.735215902 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.735233068 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.735316038 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.736242056 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.736264944 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.736385107 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.737003088 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.737097025 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.737528086 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.737593889 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.738270998 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.738377094 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.738790035 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.738862038 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.942733049 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.942965031 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.943437099 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.943526983 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.945137024 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.945236921 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.945749044 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.945827007 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.947073936 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.947170973 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.948323011 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.948415041 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.948932886 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.949004889 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.949666023 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.949779034 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.950179100 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.950252056 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.950639963 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.950722933 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.951319933 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.951426983 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.952037096 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.952140093 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.952557087 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.952626944 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.953041077 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.953114033 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.953717947 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.953825951 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.954281092 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.954370975 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.955197096 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.955218077 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.955368042 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:32.956147909 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:32.956301928 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.147738934 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.147927999 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.148644924 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.148749113 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.149198055 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.149272919 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.149707079 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.149782896 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.150187016 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.150258064 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.150789022 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.150861979 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.151276112 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.151344061 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.151777029 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.151844978 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.153006077 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.153101921 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.153537989 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.153605938 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.154342890 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.154458046 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.321836948 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.390327930 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.390367031 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.436589003 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.436638117 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.467480898 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.467515945 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.468425989 CEST	49698	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.468461037 CEST	443	49698	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.605751038 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.606204033 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.606213093 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.606333971 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.648134947 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.649020910 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.649130106 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.788325071 CEST	49701	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.788386106 CEST	443	49701	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.788461924 CEST	49701	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.788549900 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.788635969 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.788723946 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.788822889 CEST	49701	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.788839102 CEST	443	49701	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.788985014 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.789004087 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.888195038 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.888632059 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.888643980 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.888703108 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.888736963 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.888787031 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.889060020 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.889080048 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.889153957 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.894334078 CEST	443	49698	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.894746065 CEST	443	49698	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.894757032 CEST	443	49698	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.894818068 CEST	49698	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.894848108 CEST	443	49698	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.894887924 CEST	49698	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:33.895230055 CEST	443	49698	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.895245075 CEST	443	49698	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:33.895314932 CEST	49698	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.094722986 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.094841003 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.095499992 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.095607042 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.096304893 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.096388102 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.300757885 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.300873995 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.301863909 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.301882982 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.301976919 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.332464933 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.332499027 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.420723915 CEST	443	49701	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.420799017 CEST	49701	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.421319962 CEST	49701	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.421329021 CEST	443	49701	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.421514988 CEST	49701	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.421521902 CEST	443	49701	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.427947998 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.428035021 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.428466082 CEST	443	49701	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.428823948 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.428833961 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.429073095 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.429080963 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.430814028 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.472642899 CEST	49701	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.472722054 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.548111916 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.548453093 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.548532963 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.582505941 CEST	49703	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.582562923 CEST	443	49703	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.582634926 CEST	49703	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.582987070 CEST	49703	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.582994938 CEST	443	49703	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.645395041 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.645765066 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.645842075 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.648277044 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.696279049 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.851133108 CEST	443	49701	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.851666927 CEST	443	49701	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.851677895 CEST	443	49701	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.851703882 CEST	443	49701	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.851730108 CEST	49701	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.851744890 CEST	443	49701	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.851787090 CEST	49701	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:34.862529039 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.862803936 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:34.862879992 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:35.197519064 CEST	443	49703	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:35.198129892 CEST	49703	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:35.198144913 CEST	443	49703	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:36.150965929 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:36.151026011 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:36.151099920 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:36.154299974 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:36.154313087 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:36.700551987 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:36.700666904 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:36.705121994 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:36.705132008 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:36.705692053 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:36.751230001 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:36.868545055 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:36.920320988 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:37.276004076 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:37.276035070 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:37.276135921 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.277574062 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.278549910 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:37.320277929 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.450388908 CEST	49706	80	192.168.2.9	192.178.49.195
Apr 28, 2025 20:18:37.599198103 CEST	80	49706	192.178.49.195	192.168.2.9
Apr 28, 2025 20:18:37.599344015 CEST	49706	80	192.168.2.9	192.178.49.195
Apr 28, 2025 20:18:37.599572897 CEST	49706	80	192.168.2.9	192.178.49.195
Apr 28, 2025 20:18:37.635637999 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.635963917 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.635973930 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.635999918 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.636018038 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.636030912 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.636147022 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:37.636147022 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:37.636168003 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.636178970 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.636198997 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.636229038 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:37.636265993 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:37.637582064 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:37.680491924 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:37.747859955 CEST	80	49706	192.178.49.195	192.168.2.9
Apr 28, 2025 20:18:37.748217106 CEST	80	49706	192.178.49.195	192.168.2.9
Apr 28, 2025 20:18:37.790676117 CEST	49706	80	192.168.2.9	192.178.49.195
Apr 28, 2025 20:18:37.942617893 CEST	49672	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:37.942662001 CEST	443	49672	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:37.943608046 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:37.943660021 CEST	443	49709	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:37.943799973 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:37.944247961 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:37.944264889 CEST	443	49709	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:38.071547031 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:38.071969032 CEST	443	49704	52.149.20.212	192.168.2.9
Apr 28, 2025 20:18:38.072046041 CEST	49704	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:18:38.516369104 CEST	443	49709	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:38.516442060 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:38.609841108 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:38.609880924 CEST	443	49709	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:38.610812902 CEST	443	49709	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:38.610884905 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:38.621021032 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:38.621097088 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:38.621164083 CEST	443	49709	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:38.621609926 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:38.621671915 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:38.622184038 CEST	443	49709	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:38.622236013 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:38.623790979 CEST	443	49709	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:38.623837948 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:38.624011040 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:38.664274931 CEST	443	49709	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:38.947679996 CEST	443	49709	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:38.947747946 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:38.948029995 CEST	443	49709	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:38.948414087 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:38.949263096 CEST	443	49709	2.23.227.208	192.168.2.9
Apr 28, 2025 20:18:38.949306965 CEST	49709	443	192.168.2.9	2.23.227.208
Apr 28, 2025 20:18:44.404803038 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:44.404819965 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:44.715126991 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:44.715425968 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:44.715472937 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:44.735272884 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:44.735312939 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:44.952060938 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:44.952389002 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:44.952444077 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:45.413815975 CEST	49671	443	192.168.2.9	204.79.197.203
Apr 28, 2025 20:18:45.720536947 CEST	49671	443	192.168.2.9	204.79.197.203
Apr 28, 2025 20:18:46.329874039 CEST	49671	443	192.168.2.9	204.79.197.203
Apr 28, 2025 20:18:47.535012960 CEST	49671	443	192.168.2.9	204.79.197.203
Apr 28, 2025 20:18:49.938325882 CEST	49671	443	192.168.2.9	204.79.197.203
Apr 28, 2025 20:18:53.948584080 CEST	49678	443	192.168.2.9	52.182.141.63
Apr 28, 2025 20:18:54.251135111 CEST	49678	443	192.168.2.9	52.182.141.63
Apr 28, 2025 20:18:54.649465084 CEST	49679	80	192.168.2.9	2.17.190.73
Apr 28, 2025 20:18:54.741957903 CEST	49671	443	192.168.2.9	204.79.197.203
Apr 28, 2025 20:18:54.865252972 CEST	49678	443	192.168.2.9	52.182.141.63
Apr 28, 2025 20:18:54.957794905 CEST	49679	80	192.168.2.9	2.17.190.73
Apr 28, 2025 20:18:55.569046021 CEST	49679	80	192.168.2.9	2.17.190.73
Apr 28, 2025 20:18:56.070338011 CEST	49678	443	192.168.2.9	52.182.141.63
Apr 28, 2025 20:18:56.769646883 CEST	49679	80	192.168.2.9	2.17.190.73
Apr 28, 2025 20:18:57.243717909 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:57.243743896 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:57.563952923 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:57.564433098 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:57.568428993 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:57.571454048 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:57.571485996 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:57.787154913 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:57.787425995 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:18:57.787487984 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:18:58.308372021 CEST	49681	80	192.168.2.9	204.79.197.203
Apr 28, 2025 20:18:58.478360891 CEST	49678	443	192.168.2.9	52.182.141.63
Apr 28, 2025 20:18:58.610132933 CEST	49681	80	192.168.2.9	204.79.197.203
Apr 28, 2025 20:18:59.182517052 CEST	49679	80	192.168.2.9	2.17.190.73
Apr 28, 2025 20:18:59.213376999 CEST	49681	80	192.168.2.9	204.79.197.203
Apr 28, 2025 20:19:00.420196056 CEST	49681	80	192.168.2.9	204.79.197.203
Apr 28, 2025 20:19:02.827553988 CEST	49681	80	192.168.2.9	204.79.197.203
Apr 28, 2025 20:19:03.285535097 CEST	49678	443	192.168.2.9	52.182.141.63
Apr 28, 2025 20:19:03.991619110 CEST	49679	80	192.168.2.9	2.17.190.73
Apr 28, 2025 20:19:04.350143909 CEST	49671	443	192.168.2.9	204.79.197.203
Apr 28, 2025 20:19:07.024960995 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:19:07.024982929 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:19:07.290576935 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:19:07.291467905 CEST	443	49696	170.10.132.89	192.168.2.9
Apr 28, 2025 20:19:07.291558981 CEST	49696	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:19:07.298026085 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:19:07.298072100 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:19:07.513272047 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:19:07.513536930 CEST	443	49702	170.10.132.89	192.168.2.9
Apr 28, 2025 20:19:07.513828993 CEST	49702	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:19:07.631721973 CEST	49681	80	192.168.2.9	204.79.197.203
Apr 28, 2025 20:19:12.867377996 CEST	49692	443	192.168.2.9	192.178.49.196
Apr 28, 2025 20:19:12.867407084 CEST	443	49692	192.178.49.196	192.168.2.9
Apr 28, 2025 20:19:12.898020029 CEST	49678	443	192.168.2.9	52.182.141.63
Apr 28, 2025 20:19:13.595801115 CEST	49679	80	192.168.2.9	2.17.190.73
Apr 28, 2025 20:19:14.160758018 CEST	49694	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:19:14.160799026 CEST	443	49694	205.139.111.113	192.168.2.9
Apr 28, 2025 20:19:14.749561071 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:14.749607086 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:14.749697924 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:14.750057936 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:14.750065088 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:14.854535103 CEST	49695	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:19:14.854564905 CEST	443	49695	205.139.111.113	192.168.2.9
Apr 28, 2025 20:19:15.296740055 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.296824932 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.298597097 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.298618078 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.299223900 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.305481911 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.305502892 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.305536032 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.306181908 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.306318998 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.307238102 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.356031895 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.667385101 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.667754889 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.667772055 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.667838097 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.667865038 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.667889118 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.667958021 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.667958975 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.667958975 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.667989016 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.668011904 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.668046951 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.668052912 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.668067932 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.668086052 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.668100119 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.668124914 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.670006037 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.686101913 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:15.686510086 CEST	443	49716	52.149.20.212	192.168.2.9
Apr 28, 2025 20:19:15.686577082 CEST	49716	443	192.168.2.9	52.149.20.212
Apr 28, 2025 20:19:17.238286018 CEST	49681	80	192.168.2.9	204.79.197.203
Apr 28, 2025 20:19:18.614873886 CEST	49697	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:19:18.614893913 CEST	443	49697	170.10.132.89	192.168.2.9
Apr 28, 2025 20:19:18.660799980 CEST	49699	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:19:18.660830021 CEST	443	49699	170.10.132.89	192.168.2.9
Apr 28, 2025 20:19:18.905194044 CEST	49698	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:19:18.905221939 CEST	443	49698	170.10.132.89	192.168.2.9
Apr 28, 2025 20:19:19.857845068 CEST	49701	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:19:19.857881069 CEST	443	49701	170.10.132.89	192.168.2.9
Apr 28, 2025 20:19:20.202404022 CEST	49703	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:19:20.202435017 CEST	443	49703	170.10.132.89	192.168.2.9
Apr 28, 2025 20:19:28.802994013 CEST	49692	443	192.168.2.9	192.178.49.196
Apr 28, 2025 20:19:28.803765059 CEST	443	49692	192.178.49.196	192.168.2.9
Apr 28, 2025 20:19:28.803834915 CEST	49692	443	192.168.2.9	192.178.49.196
Apr 28, 2025 20:19:29.812294960 CEST	49694	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:19:29.812719107 CEST	443	49694	205.139.111.113	192.168.2.9
Apr 28, 2025 20:19:29.813116074 CEST	49694	443	192.168.2.9	205.139.111.113
Apr 28, 2025 20:19:35.812547922 CEST	49703	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:19:35.812933922 CEST	443	49703	170.10.132.89	192.168.2.9
Apr 28, 2025 20:19:35.813019991 CEST	49703	443	192.168.2.9	170.10.132.89
Apr 28, 2025 20:19:38.084244967 CEST	49706	80	192.168.2.9	192.178.49.195
Apr 28, 2025 20:19:38.237549067 CEST	80	49706	192.178.49.195	192.168.2.9
Apr 28, 2025 20:19:38.237670898 CEST	49706	80	192.168.2.9	192.178.49.195

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2025 20:18:22.949968100 CEST	53	60010	1.1.1.1	192.168.2.9
Apr 28, 2025 20:18:23.074754000 CEST	53	55192	1.1.1.1	192.168.2.9
Apr 28, 2025 20:18:26.377063990 CEST	53	64488	1.1.1.1	192.168.2.9
Apr 28, 2025 20:18:27.380528927 CEST	53302	53	192.168.2.9	1.1.1.1
Apr 28, 2025 20:18:27.380966902 CEST	61395	53	192.168.2.9	1.1.1.1
Apr 28, 2025 20:18:27.523036957 CEST	53	53302	1.1.1.1	192.168.2.9
Apr 28, 2025 20:18:27.523283958 CEST	53	61395	1.1.1.1	192.168.2.9
Apr 28, 2025 20:18:28.565960884 CEST	64568	53	192.168.2.9	1.1.1.1
Apr 28, 2025 20:18:28.566344023 CEST	49800	53	192.168.2.9	1.1.1.1
Apr 28, 2025 20:18:28.706274033 CEST	53	64568	1.1.1.1	192.168.2.9
Apr 28, 2025 20:18:28.706917048 CEST	53	49800	1.1.1.1	192.168.2.9
Apr 28, 2025 20:18:29.842622995 CEST	60504	53	192.168.2.9	1.1.1.1
Apr 28, 2025 20:18:29.842967987 CEST	53131	53	192.168.2.9	1.1.1.1
Apr 28, 2025 20:18:29.983412027 CEST	53	53131	1.1.1.1	192.168.2.9
Apr 28, 2025 20:18:29.987214088 CEST	53	60504	1.1.1.1	192.168.2.9
Apr 28, 2025 20:18:33.606234074 CEST	53	60371	1.1.1.1	192.168.2.9
Apr 28, 2025 20:18:33.624881983 CEST	64278	53	192.168.2.9	1.1.1.1
Apr 28, 2025 20:18:33.625087976 CEST	64618	53	192.168.2.9	1.1.1.1
Apr 28, 2025 20:18:33.773458004 CEST	53	64618	1.1.1.1	192.168.2.9
Apr 28, 2025 20:18:33.787596941 CEST	53	64278	1.1.1.1	192.168.2.9
Apr 28, 2025 20:18:43.411283970 CEST	53	61471	1.1.1.1	192.168.2.9
Apr 28, 2025 20:19:02.205265999 CEST	53	60927	1.1.1.1	192.168.2.9
Apr 28, 2025 20:19:22.787168980 CEST	53	64772	1.1.1.1	192.168.2.9
Apr 28, 2025 20:19:24.655855894 CEST	53	55993	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 28, 2025 20:18:27.380528927 CEST	192.168.2.9	1.1.1.1	0x92d3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:27.380966902 CEST	192.168.2.9	1.1.1.1	0x9280	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 28, 2025 20:18:28.565960884 CEST	192.168.2.9	1.1.1.1	0x51a6	Standard query (0)	url.us.m.mimecastprotect.com	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:28.566344023 CEST	192.168.2.9	1.1.1.1	0xccb8	Standard query (0)	url.us.m.mimecastprotect.com	65	IN (0x0001)	false
Apr 28, 2025 20:18:29.842622995 CEST	192.168.2.9	1.1.1.1	0xb29f	Standard query (0)	security-us.m.mimecastprotect.com	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:29.842967987 CEST	192.168.2.9	1.1.1.1	0x4dba	Standard query (0)	security-us.m.mimecastprotect.com	65	IN (0x0001)	false
Apr 28, 2025 20:18:33.624881983 CEST	192.168.2.9	1.1.1.1	0x8930	Standard query (0)	security-us.m.mimecastprotect.com	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:33.625087976 CEST	192.168.2.9	1.1.1.1	0xb76d	Standard query (0)	security-us.m.mimecastprotect.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 28, 2025 20:18:27.523036957 CEST	1.1.1.1	192.168.2.9	0x92d3	No error (0)	www.google.com	192.178.49.196	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:27.523283958 CEST	1.1.1.1	192.168.2.9	0x9280	No error (0)	www.google.com		65	IN (0x0001)	false
Apr 28, 2025 20:18:28.706274033 CEST	1.1.1.1	192.168.2.9	0x51a6	No error (0)	url.us.m.mimecastprotect.com	205.139.111.113	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:28.706274033 CEST	1.1.1.1	192.168.2.9	0x51a6	No error (0)	url.us.m.mimecastprotect.com	207.211.31.106	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:28.706274033 CEST	1.1.1.1	192.168.2.9	0x51a6	No error (0)	url.us.m.mimecastprotect.com	205.139.111.12	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:28.706274033 CEST	1.1.1.1	192.168.2.9	0x51a6	No error (0)	url.us.m.mimecastprotect.com	207.211.31.64	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:28.706274033 CEST	1.1.1.1	192.168.2.9	0x51a6	No error (0)	url.us.m.mimecastprotect.com	205.139.111.117	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:28.706274033 CEST	1.1.1.1	192.168.2.9	0x51a6	No error (0)	url.us.m.mimecastprotect.com	207.211.31.113	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:29.987214088 CEST	1.1.1.1	192.168.2.9	0xb29f	No error (0)	security-us.m.mimecastprotect.com	170.10.132.89	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:29.987214088 CEST	1.1.1.1	192.168.2.9	0xb29f	No error (0)	security-us.m.mimecastprotect.com	170.10.132.87	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:29.987214088 CEST	1.1.1.1	192.168.2.9	0xb29f	No error (0)	security-us.m.mimecastprotect.com	170.10.128.87	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:29.987214088 CEST	1.1.1.1	192.168.2.9	0xb29f	No error (0)	security-us.m.mimecastprotect.com	170.10.128.89	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:29.987214088 CEST	1.1.1.1	192.168.2.9	0xb29f	No error (0)	security-us.m.mimecastprotect.com	170.10.132.88	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:29.987214088 CEST	1.1.1.1	192.168.2.9	0xb29f	No error (0)	security-us.m.mimecastprotect.com	170.10.128.88	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:33.787596941 CEST	1.1.1.1	192.168.2.9	0x8930	No error (0)	security-us.m.mimecastprotect.com	170.10.132.89	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:33.787596941 CEST	1.1.1.1	192.168.2.9	0x8930	No error (0)	security-us.m.mimecastprotect.com	170.10.132.87	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:33.787596941 CEST	1.1.1.1	192.168.2.9	0x8930	No error (0)	security-us.m.mimecastprotect.com	170.10.128.88	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:33.787596941 CEST	1.1.1.1	192.168.2.9	0x8930	No error (0)	security-us.m.mimecastprotect.com	170.10.128.89	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:33.787596941 CEST	1.1.1.1	192.168.2.9	0x8930	No error (0)	security-us.m.mimecastprotect.com	170.10.128.87	A (IP address)	IN (0x0001)	false
Apr 28, 2025 20:18:33.787596941 CEST	1.1.1.1	192.168.2.9	0x8930	No error (0)	security-us.m.mimecastprotect.com	170.10.132.88	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

url.us.m.mimecastprotect.com

security-us.m.mimecastprotect.com

slscr.update.microsoft.com

www.bing.com

c.pki.goog

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.9	49706	192.178.49.195	80

Timestamp	Bytes transferred	Direction	Data
Apr 28, 2025 20:18:37.599572897 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 28, 2025 20:18:37.748217106 CEST	1243	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 28 Apr 2025 17:30:42 GMT Expires: Mon, 28 Apr 2025 18:20:42 GMT Cache-Control: public, max-age=3000 Age: 2875 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49695	205.139.111.113	443	1548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 18:18:29 UTC	723	OUT	GET /s/7x7ICAD2XpCymA4RtG3TqX?domain=knightlaw.com HTTP/1.1 Host: url.us.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:29 UTC	1460	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 28 Apr 2025 18:18:29 GMT Content-Length: 0 Connection: keep-alive Location: https://url.us.m.mimecastprotect.com/r/lxdHSUknRdqT90_ZCVnHdy3p832Cw3Ei-dO0RXuhdy9OigFHoLpcQhthnfUVCbTsYqmEd97sd2Ey7hPmI1vTX9M4wT8r6q2t5uzeALmzDdReWFWbG8vTK-lRQJucJRcm63y-GYbpar4MaN4UfOICy1iIyxx3X5QTTLjrhU2cPKeej7X6Nh4jqhfiPoBaD_sG_Ao3Lov6oqrWZv1Msn0XbCxIRwPtxH_QZqUVq1_LbByoTK7hy_h9cO98moKivi4UyJlQbbGmz9MlxcVOonpqEj1hYYiwITpWtvbV6QfSYJ7AGTt9t99C8zGYNSCB5ktKIXIAzQ-YSVpitGKsi9sB7LKuaKV65Xj47BbQDceTORDEORr_SmFsjcq7_grkmWYMBBSz00ij9tWIqgGgIyWj-mKxvfY9wk1CCvbxfXkxeqxUsvoZncHYV9TVumAohWSRktiey0jntaRX5pryyR8jd0ctIkimvLUwbs6oL6Apu0QViGJ5Bs6JZvnnxxabIEvpTyEwxQpS7SbKFyKDMGpK5hlbSqQgNzpyF3D5BUq5_AVH3woYI0wYgDG0il63lrykSDsptzi9WeV7o5DXmth4W-WmX6r_lgKs0iTRMkMoW5JI3LKn1sG9xGO1E0LxJ4hugTvmd9TUUb2KqcEcE3dCiu1GTdRtXAFl5vgKIN8ZmCNa9HemotPyDiuUu36PRCqabsiFAH-THpcoJ1k5wqaovTW_n5e19WabTSw8w-ADLgnG8XJY2B9Nv9rTLrKxy5EcmPY4fjgzxE-ek77XzyVyjG73TtJMoBGieWrkWb_Gg7NRkGoJoNkJzog5jDupi_Ohp1yaHTwQJaOJUv3XwalezPlz-QBq5Ju-xEQ9FgEmTJIpusmtZd1ScyUP90tpRnPgHK--Ax67QRcLLLzfWJuhvUkKFm670l3pB5ZOgRxOKXgYF800ALf6-SDNZULi3HKwezgAzvJV6fIVBOF [TRUNCATED]
2025-04-28 18:18:29 UTC	1460	IN	Data Raw: 75 6a 61 6f 66 55 63 38 6e 4c 79 69 6b 59 47 48 61 65 64 34 7a 48 7a 79 43 4c 77 39 64 55 31 58 70 49 78 6a 34 41 35 74 50 64 36 6e 6e 50 36 48 2d 62 4e 5f 65 74 43 31 52 4a 31 74 44 47 7a 6d 4d 62 7a 7a 4f 66 70 67 62 63 39 66 69 32 6d 50 6e 34 78 4a 49 79 68 47 37 6b 43 66 39 46 4b 70 69 55 31 61 4c 59 69 4a 58 7a 6c 52 6e 63 56 65 69 66 4f 37 44 5a 54 57 4c 53 69 44 31 2d 71 4e 46 4d 6b 74 68 75 71 49 2d 4d 37 6b 4c 42 67 78 67 79 76 4d 41 75 54 31 66 69 59 75 4d 58 74 48 64 61 36 38 4b 66 42 73 4e 58 55 68 62 4d 36 5a 6e 69 50 53 6a 4e 69 69 71 52 35 79 61 71 57 71 70 76 52 76 44 59 38 50 72 4d 7a 4c 64 30 61 76 6e 50 31 57 62 72 55 38 49 52 59 5f 39 6b 57 72 61 4c 49 7a 47 55 64 54 55 6d 39 39 52 59 6d 37 45 47 6f 47 70 6b 41 32 4a 54 62 33 7a 4b 36 Data Ascii: ujaofUc8nLyikYGHaed4zHzyCLw9dU1XpIxj4A5tPd6nnP6H-bN_etC1RJ1tDGzmMbzzOfpgbc9fi2mPn4xJIyhG7kCf9FKpiU1aLYiJXzlRncVeifO7DZTWLSiD1-qNFMkthuqI-M7kLBgxgyvMAuT1fiYuMXtHda68KfBsNXUhbM6ZniPSjNiiqR5yaqWqpvRvDY8PrMzLd0avnP1WbrU8IRY_9kWraLIzGUdTUm99RYm7EGoGpkA2JTb3zK6
2025-04-28 18:18:29 UTC	693	IN	Data Raw: 51 68 79 74 66 6f 57 73 32 53 64 59 39 66 36 4b 4c 5f 6c 41 30 56 37 79 34 74 79 43 6e 5a 4b 63 77 49 61 74 68 6e 35 56 36 4f 6a 62 34 63 35 61 77 4f 44 45 6f 61 64 4a 6c 72 39 56 2d 68 45 6a 6b 70 69 38 7a 61 77 35 52 79 47 66 78 79 47 4b 64 5f 56 34 73 59 30 63 59 49 6f 72 59 33 46 31 6a 39 38 6f 41 78 31 6f 4b 47 39 44 30 52 4f 74 52 51 42 43 53 49 68 33 36 71 57 6a 54 5f 76 73 74 4b 65 7a 72 46 61 67 31 54 2d 32 4b 39 53 31 4b 38 41 49 4b 38 56 4c 41 72 78 34 45 35 30 75 47 79 54 41 6a 37 43 53 4b 56 62 38 53 64 2d 4b 52 2d 4c 42 4b 30 71 69 37 75 73 6a 44 4e 73 6b 75 5a 34 42 63 58 64 41 2d 39 62 43 79 6a 7a 36 57 67 69 32 69 7a 36 33 62 34 74 52 63 4c 71 70 45 79 4e 65 6b 58 67 30 57 4e 6d 47 72 6b 46 78 78 30 71 67 52 4f 66 72 41 4e 36 63 4b 56 54 Data Ascii: QhytfoWs2SdY9f6KL_lA0V7y4tyCnZKcwIathn5V6Ojb4c5awODEoadJlr9V-hEjkpi8zaw5RyGfxyGKd_V4sY0cYIorY3F1j98oAx1oKG9D0ROtRQBCSIh36qWjT_vstKezrFag1T-2K9S1K8AIK8VLArx4E50uGyTAj7CSKVb8Sd-KR-LBK0qi7usjDNskuZ4BcXdA-9bCyjz6Wgi2iz63b4tRcLqpEyNekXg0WNmGrkFxx0qgROfrAN6cKVT
2025-04-28 18:18:29 UTC	1460	OUT	GET /r/lxdHSUknRdqT90_ZCVnHdy3p832Cw3Ei-dO0RXuhdy9OigFHoLpcQhthnfUVCbTsYqmEd97sd2Ey7hPmI1vTX9M4wT8r6q2t5uzeALmzDdReWFWbG8vTK-lRQJucJRcm63y-GYbpar4MaN4UfOICy1iIyxx3X5QTTLjrhU2cPKeej7X6Nh4jqhfiPoBaD_sG_Ao3Lov6oqrWZv1Msn0XbCxIRwPtxH_QZqUVq1_LbByoTK7hy_h9cO98moKivi4UyJlQbbGmz9MlxcVOonpqEj1hYYiwITpWtvbV6QfSYJ7AGTt9t99C8zGYNSCB5ktKIXIAzQ-YSVpitGKsi9sB7LKuaKV65Xj47BbQDceTORDEORr_SmFsjcq7_grkmWYMBBSz00ij9tWIqgGgIyWj-mKxvfY9wk1CCvbxfXkxeqxUsvoZncHYV9TVumAohWSRktiey0jntaRX5pryyR8jd0ctIkimvLUwbs6oL6Apu0QViGJ5Bs6JZvnnxxabIEvpTyEwxQpS7SbKFyKDMGpK5hlbSqQgNzpyF3D5BUq5_AVH3woYI0wYgDG0il63lrykSDsptzi9WeV7o5DXmth4W-WmX6r_lgKs0iTRMkMoW5JI3LKn1sG9xGO1E0LxJ4hugTvmd9TUUb2KqcEcE3dCiu1GTdRtXAFl5vgKIN8ZmCNa9HemotPyDiuUu36PRCqabsiFAH-THpcoJ1k5wqaovTW_n5e19WabTSw8w-ADLgnG8XJY2B9Nv9rTLrKxy5EcmPY4fjgzxE-ek77XzyVyjG73TtJMoBGieWrkWb_Gg7NRkGoJoNkJzog5jDupi_Ohp1yaHTwQJaOJUv3XwalezPlz-QBq5Ju-xEQ9FgEmTJIpusmtZd1ScyUP90tpRnPgHK--Ax67QRcLLLzfWJuhvUkKFm670l3pB5ZOgRxOKXgYF800ALf6-SDNZULi3HKwezgAzvJV6fIVBOFsZcYkTaxPXLT5z7Uh8mIrY5vuMBMs4yXcHa5EtK5Ci [TRUNCATED]
2025-04-28 18:18:29 UTC	1460	OUT	Data Raw: 75 4d 58 74 48 64 61 36 38 4b 66 42 73 4e 58 55 68 62 4d 36 5a 6e 69 50 53 6a 4e 69 69 71 52 35 79 61 71 57 71 70 76 52 76 44 59 38 50 72 4d 7a 4c 64 30 61 76 6e 50 31 57 62 72 55 38 49 52 59 5f 39 6b 57 72 61 4c 49 7a 47 55 64 54 55 6d 39 39 52 59 6d 37 45 47 6f 47 70 6b 41 32 4a 54 62 33 7a 4b 36 43 70 53 64 77 79 39 32 5f 50 37 6c 2d 64 2d 33 42 38 75 4d 6d 70 39 42 5a 34 52 4d 78 79 72 56 32 76 55 68 4a 7a 71 57 55 65 34 44 31 74 74 36 56 31 36 34 4f 72 62 74 63 4e 61 4d 32 4c 31 47 4e 6a 37 38 62 39 63 54 47 5a 66 77 55 56 52 6c 34 4c 4b 50 64 62 49 63 42 7a 37 73 30 46 71 6c 72 70 39 68 62 56 70 6a 58 2d 78 78 65 30 46 36 6d 6a 31 41 59 78 43 52 68 45 65 69 34 77 4c 6e 51 47 30 6e 4f 71 47 49 58 31 48 58 71 47 6d 58 49 6a 37 72 6a 31 50 78 2d 77 71 Data Ascii: uMXtHda68KfBsNXUhbM6ZniPSjNiiqR5yaqWqpvRvDY8PrMzLd0avnP1WbrU8IRY_9kWraLIzGUdTUm99RYm7EGoGpkA2JTb3zK6CpSdwy92_P7l-d-3B8uMmp9BZ4RMxyrV2vUhJzqWUe4D1tt6V164OrbtcNaM2L1GNj78b9cTGZfwUVRl4LKPdbIcBz7s0Fqlrp9hbVpjX-xxe0F6mj1AYxCRhEei4wLnQG0nOqGIX1HXqGmXIj7rj1Px-wq
2025-04-28 18:18:29 UTC	1131	OUT	Data Raw: 34 45 35 30 75 47 79 54 41 6a 37 43 53 4b 56 62 38 53 64 2d 4b 52 2d 4c 42 4b 30 71 69 37 75 73 6a 44 4e 73 6b 75 5a 34 42 63 58 64 41 2d 39 62 43 79 6a 7a 36 57 67 69 32 69 7a 36 33 62 34 74 52 63 4c 71 70 45 79 4e 65 6b 58 67 30 57 4e 6d 47 72 6b 46 78 78 30 71 67 52 4f 66 72 41 4e 36 63 4b 56 54 75 4a 6e 75 31 47 5f 39 2d 59 39 52 31 56 4f 4b 63 42 2d 54 44 53 6b 70 7a 58 72 6c 58 6a 63 47 79 36 67 76 4c 4a 65 51 32 67 41 57 62 2d 69 70 5f 51 77 58 72 39 4f 77 73 31 71 54 74 30 46 4e 5f 2d 74 6d 4f 76 53 55 50 55 49 63 5a 73 61 75 6f 45 53 71 30 7a 4f 65 6f 66 30 6a 6a 44 53 62 34 48 6a 6c 6e 33 53 54 52 7a 4b 54 6f 4b 76 72 38 7a 5a 58 54 49 64 47 61 77 6f 4a 67 48 50 42 4d 64 74 47 78 4f 65 49 61 71 4d 44 5a 4b 57 6b 50 48 31 50 61 6c 34 38 74 6f 6c Data Ascii: 4E50uGyTAj7CSKVb8Sd-KR-LBK0qi7usjDNskuZ4BcXdA-9bCyjz6Wgi2iz63b4tRcLqpEyNekXg0WNmGrkFxx0qgROfrAN6cKVTuJnu1G_9-Y9R1VOKcB-TDSkpzXrlXjcGy6gvLJeQ2gAWb-ip_QwXr9Ows1qTt0FN_-tmOvSUPUIcZsauoESq0zOeof0jjDSb4Hjln3STRzKToKvr8zZXTIdGawoJgHPBMdtGxOeIaqMDZKWkPH1Pal48tol
2025-04-28 18:18:29 UTC	303	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 28 Apr 2025 18:18:29 GMT Content-Length: 0 Connection: keep-alive Location: https://security-us.m.mimecastprotect.com/ttpwp#/enrollment?key=5092c046-e9c8-474f-b6dd-48227813a20d Cache-control: no-store Pragma: no-cache X-Robots-Tag: noindex, nofollow

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49696	170.10.132.89	443	1548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 18:18:30 UTC	688	OUT	GET /ttpwp HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:31 UTC	439	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3447 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ETag: W/"d77-OHH4JkHPwYh69LhiBPhlW6DaQ28" Vary: Accept-Encoding
2025-04-28 18:18:31 UTC	1460	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c Data Ascii: <!doctype html><html lang="en"><head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no, maximum-scale=1, minimum-scale=1"> <
2025-04-28 18:18:31 UTC	1460	IN	Data Raw: 45 5f 42 41 53 45 22 7d 2c 22 6b 6e 6f 77 6c 65 64 67 65 42 61 73 65 22 3a 7b 22 64 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 68 72 65 66 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6f 6d 6d 75 6e 69 74 79 2e 6d 69 6d 65 63 61 73 74 2e 63 6f 6d 2f 64 6f 63 73 2f 44 4f 43 2d 32 34 31 22 2c 22 6c 61 62 65 6c 22 3a 22 4c 4f 47 49 4e 5f 48 4f 4d 45 5f 4c 4e 4b 22 7d 2c 22 6c 6f 67 69 6e 48 65 6c 70 22 3a 7b 22 64 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 68 72 65 66 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6f 6d 6d 75 6e 69 74 79 2e 6d 69 6d 65 63 61 73 74 2e 63 6f 6d 2f 64 6f 63 73 2f 44 4f 43 2d 32 34 31 22 2c 22 6c 61 62 65 6c 22 3a 22 4c 4f 47 49 4e 5f 4c 4f 47 49 4e 5f 48 45 4c 50 5f 4c 4e 4b 22 7d 2c 22 73 75 70 70 6f 72 74 22 3a 7b 22 64 65 66 61 75 6c 74 22 3a 74 Data Ascii: E_BASE"},"knowledgeBase":{"default":true,"href":"https://community.mimecast.com/docs/DOC-241","label":"LOGIN_HOME_LNK"},"loginHelp":{"default":true,"href":"https://community.mimecast.com/docs/DOC-241","label":"LOGIN_LOGIN_HELP_LNK"},"support":{"default":t
2025-04-28 18:18:31 UTC	527	IN	Data Raw: 51 42 6b 55 55 41 41 41 41 41 41 56 34 45 5f 47 74 47 57 58 6e 4a 6a 4c 38 31 62 53 72 32 57 31 79 50 63 53 7a 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 2f 74 74 70 77 70 2f 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 74 74 70 2d 61 70 70 3e 3c 2f 74 74 70 2d 61 70 70 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 74 74 70 77 70 2f 72 65 73 6f 75 72 63 65 73 2f 72 75 6e 74 69 6d 65 2e 30 65 63 62 65 36 37 62 32 64 36 39 63 66 37 34 61 38 31 35 2e 6a 73 22 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 74 74 70 77 70 2f 72 65 73 6f 75 72 63 65 73 2f 70 6f 6c 79 66 69 6c 6c 73 2d 65 73 35 2e 30 65 63 62 65 36 37 62 32 64 36 39 63 66 37 34 61 38 31 35 2e 6a 73 22 20 Data Ascii: QBkUUAAAAAAV4E_GtGWXnJjL81bSr2W1yPcSz';</script> <base href="/ttpwp/"></head><body><ttp-app></ttp-app><script src="/ttpwp/resources/runtime.0ecbe67b2d69cf74a815.js" defer></script><script src="/ttpwp/resources/polyfills-es5.0ecbe67b2d69cf74a815.js"
2025-04-28 18:18:31 UTC	552	OUT	GET /ttpwp/resources/runtime.0ecbe67b2d69cf74a815.js HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:31 UTC	538	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:31 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 1492 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 21 Jan 2025 15:13:30 GMT ETag: W/"5d4-194896d0190" Vary: Accept-Encoding
2025-04-28 18:18:31 UTC	1460	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 72 29 7b 66 6f 72 28 76 61 72 20 6e 2c 6c 2c 70 3d 72 5b 30 5d 2c 66 3d 72 5b 31 5d 2c 69 3d 72 5b 32 5d 2c 63 3d 30 2c 73 3d 5b 5d 3b 63 3c 70 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 6c 3d 70 5b 63 5d 2c 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 6c 29 26 26 6f 5b 6c 5d 26 26 73 2e 70 75 73 68 28 6f 5b 6c 5d 5b 30 5d 29 2c 6f 5b 6c 5d 3d 30 3b 66 6f 72 28 6e 20 69 6e 20 66 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 66 2c 6e 29 26 26 28 65 5b 6e 5d 3d 66 5b 6e 5d 29 3b 66 6f 72 28 61 26 26 61 28 72 29 3b 73 2e 6c 65 6e 67 74 68 3b 29 73 2e 73 68 Data Ascii: !function(e){function r(r){for(var n,l,p=r[0],f=r[1],i=r[2],c=0,s=[];c<p.length;c++)l=p[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(a&&a(r);s.length;)s.sh
2025-04-28 18:18:31 UTC	32	IN	Data Raw: 74 68 3b 69 2b 2b 29 72 28 70 5b 69 5d 29 3b 76 61 72 20 61 3d 66 3b 74 28 29 7d 28 5b 5d 29 3b Data Ascii: th;i++)r(p[i]);var a=f;t()}([]);
2025-04-28 18:18:31 UTC	554	OUT	GET /ttpwp/resources/polyfills.0ecbe67b2d69cf74a815.js HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:31 UTC	541	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:31 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 95292 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 21 Jan 2025 15:13:30 GMT ETag: W/"1743c-194896d0190" Vary: Accept-Encoding
2025-04-28 18:18:31 UTC	1460	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 5d 2c 7b 22 30 54 57 70 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 2c 69 2c 6f 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 73 70 72 65 61 64 41 72 72 61 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 6e 7c 7c 32 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 72 2c 69 3d 30 2c 6f 3d 74 2e 6c 65 6e 67 74 68 3b 69 3c 6f 3b 69 2b 2b 29 21 72 26 26 69 20 69 6e 20 74 7c 7c 28 72 7c 7c 28 72 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 2c 30 2c Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[2],{"0TWp":function(e,t,n){"use strict";var r,i,o=this&&this.__spreadArray\|\|function(e,t,n){if(n\|\|2===arguments.length)for(var r,i=0,o=t.length;i<o;i++)!r&&i in t\|\|(r\|\|(r=Array.prototype.slice.call(t,0,
2025-04-28 18:18:31 UTC	1460	IN	Data Raw: 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 43 2e 7a 6f 6e 65 7d 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 31 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 63 75 72 72 65 6e 74 54 61 73 6b 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4d 7d 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 31 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 2c 74 2e 5f 5f 6c 6f 61 64 5f 70 61 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 69 2c 6f 2c 73 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 73 26 26 28 73 3d 21 31 29 2c 52 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 69 29 29 7b 69 66 28 21 73 26 26 61 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 41 6c 72 65 61 64 79 Data Ascii: nction(){return C.zone},enumerable:!1,configurable:!0}),Object.defineProperty(t,"currentTask",{get:function(){return M},enumerable:!1,configurable:!0}),t.__load_patch=function(i,o,s){if(void 0===s&&(s=!1),R.hasOwnProperty(i)){if(!s&&a)throw Error("Already
2025-04-28 18:18:31 UTC	1460	IN	Data Raw: 6f 74 6f 74 79 70 65 2e 72 75 6e 54 61 73 6b 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 65 2e 7a 6f 6e 65 21 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 41 20 74 61 73 6b 20 63 61 6e 20 6f 6e 6c 79 20 62 65 20 72 75 6e 20 69 6e 20 74 68 65 20 7a 6f 6e 65 20 6f 66 20 63 72 65 61 74 69 6f 6e 21 20 28 43 72 65 61 74 69 6f 6e 3a 20 22 2b 28 65 2e 7a 6f 6e 65 7c 7c 62 29 2e 6e 61 6d 65 2b 22 3b 20 45 78 65 63 75 74 69 6f 6e 3a 20 22 2b 74 68 69 73 2e 6e 61 6d 65 2b 22 29 22 29 3b 69 66 28 65 2e 73 74 61 74 65 21 3d 3d 54 7c 7c 65 2e 74 79 70 65 21 3d 3d 44 26 26 65 2e 74 79 70 65 21 3d 3d 4f 29 7b 76 61 72 20 72 3d 65 2e 73 74 61 74 65 21 3d 45 3b 72 26 26 65 2e 5f 74 72 61 6e 73 69 74 69 6f 6e 54 6f 28 45 2c 77 29 2c Data Ascii: ototype.runTask=function(e,t,n){if(e.zone!=this)throw new Error("A task can only be run in the zone of creation! (Creation: "+(e.zone\|\|b).name+"; Execution: "+this.name+")");if(e.state!==T\|\|e.type!==D&&e.type!==O){var r=e.state!=E;r&&e._transitionTo(E,w),
2025-04-28 18:18:31 UTC	1460	IN	Data Raw: 2c 69 29 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 6e 63 65 6c 54 61 73 6b 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 2e 7a 6f 6e 65 21 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 41 20 74 61 73 6b 20 63 61 6e 20 6f 6e 6c 79 20 62 65 20 63 61 6e 63 65 6c 6c 65 64 20 69 6e 20 74 68 65 20 7a 6f 6e 65 20 6f 66 20 63 72 65 61 74 69 6f 6e 21 20 28 43 72 65 61 74 69 6f 6e 3a 20 22 2b 28 65 2e 7a 6f 6e 65 7c 7c 62 29 2e 6e 61 6d 65 2b 22 3b 20 45 78 65 63 75 74 69 6f 6e 3a 20 22 2b 74 68 69 73 2e 6e 61 6d 65 2b 22 29 22 29 3b 65 2e 5f 74 72 61 6e 73 69 74 69 6f 6e 54 6f 28 53 2c 77 2c 45 29 3b 74 72 79 7b 74 68 69 73 2e 5f 7a 6f 6e 65 44 65 6c 65 67 61 74 65 2e 63 61 6e 63 65 6c 54 61 73 6b 28 74 68 69 73 2c 65 29 7d 63 Data Ascii: ,i))},t.prototype.cancelTask=function(e){if(e.zone!=this)throw new Error("A task can only be cancelled in the zone of creation! (Creation: "+(e.zone\|\|b).name+"; Execution: "+this.name+")");e._transitionTo(S,w,E);try{this._zoneDelegate.cancelTask(this,e)}c
2025-04-28 18:18:31 UTC	1460	IN	Data Raw: 53 3d 6e 26 26 28 6e 2e 6f 6e 48 61 6e 64 6c 65 45 72 72 6f 72 3f 6e 3a 74 2e 5f 68 61 6e 64 6c 65 45 72 72 6f 72 5a 53 29 2c 74 68 69 73 2e 5f 68 61 6e 64 6c 65 45 72 72 6f 72 44 6c 67 74 3d 6e 26 26 28 6e 2e 6f 6e 48 61 6e 64 6c 65 45 72 72 6f 72 3f 74 3a 74 2e 5f 68 61 6e 64 6c 65 45 72 72 6f 72 44 6c 67 74 29 2c 74 68 69 73 2e 5f 68 61 6e 64 6c 65 45 72 72 6f 72 43 75 72 72 5a 6f 6e 65 3d 6e 26 26 28 6e 2e 6f 6e 48 61 6e 64 6c 65 45 72 72 6f 72 3f 74 68 69 73 2e 7a 6f 6e 65 3a 74 2e 5f 68 61 6e 64 6c 65 45 72 72 6f 72 43 75 72 72 5a 6f 6e 65 29 2c 74 68 69 73 2e 5f 73 63 68 65 64 75 6c 65 54 61 73 6b 5a 53 3d 6e 26 26 28 6e 2e 6f 6e 53 63 68 65 64 75 6c 65 54 61 73 6b 3f 6e 3a 74 2e 5f 73 63 68 65 64 75 6c 65 54 61 73 6b 5a 53 29 2c 74 68 69 73 2e 5f Data Ascii: S=n&&(n.onHandleError?n:t._handleErrorZS),this._handleErrorDlgt=n&&(n.onHandleError?t:t._handleErrorDlgt),this._handleErrorCurrZone=n&&(n.onHandleError?this.zone:t._handleErrorCurrZone),this._scheduleTaskZS=n&&(n.onScheduleTask?n:t._scheduleTaskZS),this._
2025-04-28 18:18:33 UTC	664	OUT	GET /ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2 HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive Origin: https://security-us.m.mimecastprotect.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://security-us.m.mimecastprotect.com/ttpwp Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:33 UTC	492	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:33 GMT Content-Type: font/woff2 Content-Length: 137104 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 21 Jan 2025 15:13:30 GMT ETag: W/"21790-194896d0190"
2025-04-28 18:18:34 UTC	599	OUT	GET /ttpwp/resources/images/favicon.ico HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:34 UTC	513	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:34 GMT Content-Type: image/x-icon Content-Length: 1150 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 21 Jan 2025 15:13:31 GMT ETag: W/"47e-194896d0578" Vary: Accept-Encoding
2025-04-28 18:18:44 UTC	682	OUT	POST /api/ttp/url/enroll-user HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive Content-Length: 94 x-context-route: ttpwp sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/json sec-ch-ua-mobile: ?0 Origin: https://security-us.m.mimecastprotect.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:44 UTC	539	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:44 GMT Content-Type: application/json; charset=utf-8 Content-Length: 192 Connection: keep-alive cache-control: no-store pragma: no-cache X-Robots-Tag: noindex, nofollow content-encoding: gzip x-mc-req-id: 4927a987-e27e-4e1a-bedd-7d60dcb78e7b x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ETag: W/"c0-BxjaoPdeYzoLJCQF8yB9Af/291w"
2025-04-28 18:18:57 UTC	682	OUT	POST /api/ttp/url/enroll-user HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive Content-Length: 94 x-context-route: ttpwp sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/json sec-ch-ua-mobile: ?0 Origin: https://security-us.m.mimecastprotect.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:57 UTC	539	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:57 GMT Content-Type: application/json; charset=utf-8 Content-Length: 192 Connection: keep-alive cache-control: no-store pragma: no-cache X-Robots-Tag: noindex, nofollow content-encoding: gzip x-mc-req-id: 90832f59-e497-4b0b-b125-a8f73c3d669e x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ETag: W/"c0-BxjaoPdeYzoLJCQF8yB9Af/291w"
2025-04-28 18:19:07 UTC	682	OUT	POST /api/ttp/url/enroll-user HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive Content-Length: 94 x-context-route: ttpwp sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/json sec-ch-ua-mobile: ?0 Origin: https://security-us.m.mimecastprotect.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:19:07 UTC	539	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:19:07 GMT Content-Type: application/json; charset=utf-8 Content-Length: 192 Connection: keep-alive cache-control: no-store pragma: no-cache X-Robots-Tag: noindex, nofollow content-encoding: gzip x-mc-req-id: f8873ee3-3a4f-4e48-ae1c-8e209a9561f2 x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ETag: W/"c0-BxjaoPdeYzoLJCQF8yB9Af/291w"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49699	170.10.132.89	443	1548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 18:18:31 UTC	551	OUT	GET /ttpwp/resources/styles.0ecbe67b2d69cf74a815.js HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:32 UTC	542	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:31 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 410447 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 21 Jan 2025 15:13:30 GMT ETag: W/"6434f-194896d0190" Vary: Accept-Encoding
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 5d 2c 7b 34 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 6f 29 7b 6e 2e 65 78 70 6f 72 74 73 3d 6f 28 22 6c 45 75 68 22 29 7d 2c 4a 50 73 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 3d 5b 5d 3b 72 65 74 75 72 6e 20 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6f 3d 6e 28 65 29 3b 72 65 74 75 72 6e 20 65 5b 32 5d 3f 22 40 6d 65 64 69 61 20 22 2e 63 6f 6e 63 Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[4],{4:function(n,e,o){n.exports=o("lEuh")},JPst:function(n,e,o){"use strict";n.exports=function(n){var e=[];return e.toString=function(){return this.map(function(e){var o=n(e);return e[2]?"@media ".conc
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 3d 61 28 6e 2e 69 6e 73 65 72 74 7c 7c 22 68 65 61 64 22 29 3b 69 66 28 21 63 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 43 6f 75 6c 64 6e 27 74 20 66 69 6e 64 20 61 20 73 74 79 6c 65 20 74 61 72 67 65 74 2e 20 54 68 69 73 20 70 72 6f 62 61 62 6c 79 20 6d 65 61 6e 73 20 74 68 61 74 20 74 68 65 20 76 61 6c 75 65 20 66 6f 72 20 74 68 65 20 27 69 6e 73 65 72 74 27 20 70 61 72 61 6d 65 74 65 72 20 69 73 20 69 6e 76 61 6c 69 64 2e 22 29 3b 63 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 7d 72 65 74 75 72 6e 20 65 7d 76 61 72 20 66 2c 64 3d 28 66 3d 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 29 7b 72 65 74 75 72 6e 20 66 5b 6e 5d 3d 65 2c 66 2e 66 69 6c 74 65 72 28 42 6f 6f 6c 65 61 6e 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 7d 29 3b 66 75 6e 63 74 69 Data Ascii: =a(n.insert\|\|"head");if(!c)throw new Error("Couldn't find a style target. This probably means that the value for the 'insert' parameter is invalid.");c.appendChild(e)}return e}var f,d=(f=[],function(n,e){return f[n]=e,f.filter(Boolean).join("\n")});functi
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 66 28 6e 3d 6e 7c 7c 5b 5d 2c 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d 22 3d 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 6e 29 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 6f 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 7b 76 61 72 20 61 3d 63 28 6f 5b 74 5d 29 3b 72 5b 61 5d 2e 72 65 66 65 72 65 6e 63 65 73 2d 2d 7d 66 6f 72 28 76 61 72 20 69 3d 6c 28 6e 2c 65 29 2c 66 3d 30 3b 66 3c 6f 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 7b 76 61 72 20 64 3d 63 28 6f 5b 66 5d 29 3b 30 3d 3d 3d 72 5b 64 5d 2e 72 65 66 65 72 65 6e 63 65 73 26 26 28 72 5b 64 5d 2e 75 70 64 61 74 65 72 28 29 2c 72 2e 73 70 6c 69 63 65 28 64 2c 31 29 29 7d 6f 3d 69 7d 7d Data Ascii: e);return function(n){if(n=n\|\|[],"[object Array]"===Object.prototype.toString.call(n)){for(var t=0;t<o.length;t++){var a=c(o[t]);r[a].references--}for(var i=l(n,e),f=0;f<o.length;f++){var d=c(o[f]);0===r[d].references&&(r[d].updater(),r.splice(d,1))}o=i}}
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 5c 27 29 3b 5c 6e 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 5c 6e 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 5c 6e 7d 5c 6e 2f 2a 20 43 68 72 6f 6d 65 20 68 61 63 6b 3a 20 53 56 47 20 69 73 20 72 65 6e 64 65 72 65 64 20 6d 6f 72 65 20 73 6d 6f 6f 74 68 20 69 6e 20 57 69 6e 64 6f 7a 7a 65 2e 20 31 30 30 25 20 6d 61 67 69 63 2c 20 75 6e 63 6f 6d 6d 65 6e 74 20 69 66 20 79 6f 75 20 6e 65 65 64 20 69 74 2e 20 2a 2f 5c 6e 2f 2a 20 4e 6f 74 65 2c 20 74 68 61 74 20 77 69 6c 6c 20 62 72 65 61 6b 20 68 69 6e 74 69 6e 67 21 20 49 6e 20 6f 74 68 65 72 20 4f 53 2d 65 73 20 66 6f 6e 74 20 77 69 6c 6c 20 62 65 20 6e 6f 74 20 61 73 20 73 68 61 72 70 20 61 73 20 69 74 20 63 6f 75 6c 64 20 62 65 20 2a 2f 5c 6e 2f 2a 5c 6e 40 6d Data Ascii: \');\n font-weight: normal;\n font-style: normal;\n}\n/* Chrome hack: SVG is rendered more smooth in Windozze. 100% magic, uncomment if you need it. /\n/ Note, that will break hinting! In other OS-es font will be not as sharp as it could be /\n/\n@m
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 5c 27 5c 75 65 38 30 30 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 77 6f 72 64 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 30 31 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 30 31 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 7a 69 70 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 30 32 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 30 32 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 6d 69 6d 65 63 61 73 74 2d 6c 6f 67 6f 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 30 33 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 30 33 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 73 65 63 75 72 65 2d 6d 65 73 73 61 67 69 6e 67 Data Ascii: \'\ue800\' /\n.mc-icon-word:before {\n content: \'\\e801\';\n}\n/ \'\ue801\' /\n.mc-icon-zip:before {\n content: \'\\e802\';\n}\n/ \'\ue802\' /\n.mc-icon-mimecast-logo:before {\n content: \'\\e803\';\n}\n/ \'\ue803\' */\n.mc-icon-secure-messaging
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 31 33 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 31 33 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 6d 75 6c 74 69 70 6c 65 2d 75 73 65 72 73 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 31 34 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 31 34 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 73 61 76 65 64 2d 73 65 61 72 63 68 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 31 35 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 31 35 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 6c 61 72 67 65 2d 66 69 6c 65 2d 72 65 69 63 65 76 65 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c Data Ascii: n content: \'\\e813\';\n}\n/* \'\ue813\' /\n.mc-icon-multiple-users:before {\n content: \'\\e814\';\n}\n/ \'\ue814\' /\n.mc-icon-saved-search:before {\n content: \'\\e815\';\n}\n/ \'\ue815\' */\n.mc-icon-large-file-reiceve:before {\n content: \'\\
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 5c 5c 65 38 32 35 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 32 35 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 61 76 64 61 6e 63 65 64 2d 73 65 61 72 63 68 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 32 36 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 32 36 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 72 65 63 65 6e 74 2d 73 65 61 72 63 68 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 32 37 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 32 37 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 73 65 61 72 63 68 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 32 38 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 32 38 5c Data Ascii: \\e825\';\n}\n/* \'\ue825\' /\n.mc-icon-avdanced-search:before {\n content: \'\\e826\';\n}\n/ \'\ue826\' /\n.mc-icon-recent-search:before {\n content: \'\\e827\';\n}\n/ \'\ue827\' /\n.mc-icon-search:before {\n content: \'\\e828\';\n}\n/ \'\ue828\
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 63 2d 69 63 6f 6e 2d 63 6f 6e 6e 65 63 74 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 33 37 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 33 37 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 69 6c 6c 75 73 74 72 61 74 69 6f 6e 2d 6c 66 73 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 33 38 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 33 38 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 61 63 63 6f 75 6e 74 2d 68 69 65 72 61 72 63 68 79 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 33 39 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 33 39 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 72 65 76 69 65 77 65 72 2d 74 61 67 3a Data Ascii: c-icon-connect:before {\n content: \'\\e837\';\n}\n/* \'\ue837\' /\n.mc-icon-illustration-lfs:before {\n content: \'\\e838\';\n}\n/ \'\ue838\' /\n.mc-icon-account-hierarchy:before {\n content: \'\\e839\';\n}\n/ \'\ue839\' */\n.mc-icon-reviewer-tag:
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 2a 20 5c 27 5c 75 65 38 34 39 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 74 61 62 2d 68 69 73 74 6f 72 79 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 34 61 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 34 61 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 74 61 62 2d 68 74 6d 6c 2d 6d 65 73 73 61 67 65 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 34 62 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 34 62 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 74 61 62 2d 70 6c 61 69 6e 74 65 78 74 2d 6d 65 73 73 61 67 65 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 34 63 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 34 63 5c 27 Data Ascii: * \'\ue849\' /\n.mc-icon-tab-history:before {\n content: \'\\e84a\';\n}\n/ \'\ue84a\' /\n.mc-icon-tab-html-message:before {\n content: \'\\e84b\';\n}\n/ \'\ue84b\' /\n.mc-icon-tab-plaintext-message:before {\n content: \'\\e84c\';\n}\n/ \'\ue84c\'
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 77 65 72 2d 63 6f 6d 70 6c 69 61 6e 63 65 2d 31 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 35 64 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 35 64 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 73 68 69 65 6c 64 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 36 30 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 36 30 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 73 6f 72 74 2d 6e 65 77 2d 6f 6c 64 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 63 6f 6e 74 65 6e 74 3a 20 5c 27 5c 5c 65 38 37 32 5c 27 3b 5c 6e 7d 5c 6e 2f 2a 20 5c 27 5c 75 65 38 37 32 5c 27 20 2a 2f 5c 6e 2e 6d 63 2d 69 63 6f 6e 2d 73 6f 72 74 2d 6e 65 77 2d 6f 6c 64 2d 75 70 3a 62 65 66 6f 72 65 20 7b 5c 6e Data Ascii: wer-compliance-1:before {\n content: \'\\e85d\';\n}\n/* \'\ue85d\' /\n.mc-icon-shield:before {\n content: \'\\e860\';\n}\n/ \'\ue860\' /\n.mc-icon-sort-new-old:before {\n content: \'\\e872\';\n}\n/ \'\ue872\' */\n.mc-icon-sort-new-old-up:before {\n
2025-04-28 18:18:33 UTC	605	OUT	GET /ttpwp/resources/images/mimecast-logo.png HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:33 UTC	488	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:33 GMT Content-Type: image/png Content-Length: 4228 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 21 Jan 2025 15:13:31 GMT ETag: W/"1084-194896d0578"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49697	170.10.132.89	443	1548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 18:18:31 UTC	549	OUT	GET /ttpwp/resources/main.0ecbe67b2d69cf74a815.js HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:32 UTC	544	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:31 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 1057448 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 21 Jan 2025 15:13:30 GMT ETag: W/"1022a8-194896d0190" Vary: Accept-Encoding
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 5d 2c 7b 22 2b 62 72 33 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 65 2e 64 65 66 69 6e 65 4c 6f 63 61 6c 65 28 22 65 75 22 2c 7b 6d 6f 6e 74 68 73 3a 22 75 72 74 61 72 72 69 6c 61 5f 6f 74 73 61 69 6c 61 5f 6d 61 72 74 78 6f 61 5f 61 70 69 72 69 6c 61 5f 6d 61 69 61 74 7a 61 5f 65 6b 61 69 6e 61 5f 75 7a 74 61 69 6c 61 5f 61 62 75 7a 74 75 61 5f 69 72 61 69 6c 61 5f 75 72 72 69 61 5f 61 7a 61 72 6f 61 5f 61 62 65 6e 64 75 61 22 2e 73 70 6c 69 74 28 22 5f 22 29 2c 6d 6f 6e 74 68 73 53 68 6f 72 74 3a 22 75 72 Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[1],{"+br3":function(e,t,n){!function(e){"use strict";e.defineLocale("eu",{months:"urtarrila_otsaila_martxoa_apirila_maiatza_ekaina_uztaila_abuztua_iraila_urria_azaroa_abendua".split("_"),monthsShort:"ur
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 39 34 30 22 2c 22 5c 75 30 39 32 35 5c 75 30 39 34 62 5c 75 30 39 32 31 5c 75 30 39 34 37 20 5c 75 30 39 33 38 5c 75 30 39 34 35 5c 75 30 39 31 35 5c 75 30 39 30 32 5c 75 30 39 32 31 22 5d 2c 73 73 3a 5b 65 2b 22 20 5c 75 30 39 33 38 5c 75 30 39 34 35 5c 75 30 39 31 35 5c 75 30 39 30 32 5c 75 30 39 32 31 5c 75 30 39 33 65 5c 75 30 39 30 32 5c 75 30 39 32 38 5c 75 30 39 34 30 22 2c 65 2b 22 20 5c 75 30 39 33 38 5c 75 30 39 34 35 5c 75 30 39 31 35 5c 75 30 39 30 32 5c 75 30 39 32 31 22 5d 2c 6d 3a 5b 22 5c 75 30 39 30 66 5c 75 30 39 31 35 5c 75 30 39 33 65 20 5c 75 30 39 32 65 5c 75 30 39 33 66 5c 75 30 39 32 33 5c 75 30 39 31 66 5c 75 30 39 33 65 5c 75 30 39 32 38 22 2c 22 5c 75 30 39 30 66 5c 75 30 39 31 35 20 5c 75 30 39 32 65 5c 75 30 39 33 66 5c 75 30 Data Ascii: 940","\u0925\u094b\u0921\u0947 \u0938\u0945\u0915\u0902\u0921"],ss:[e+" \u0938\u0945\u0915\u0902\u0921\u093e\u0902\u0928\u0940",e+" \u0938\u0945\u0915\u0902\u0921"],m:["\u090f\u0915\u093e \u092e\u093f\u0923\u091f\u093e\u0928","\u090f\u0915 \u092e\u093f\u0
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 30 39 31 37 5c 75 30 39 33 38 5c 75 30 39 34 64 5c 75 30 39 31 66 5f 5c 75 30 39 33 38 5c 75 30 39 32 61 5c 75 30 39 34 64 5c 75 30 39 31 66 5c 75 30 39 34 37 5c 75 30 39 30 32 5c 75 30 39 32 63 5c 75 30 39 33 30 5f 5c 75 30 39 31 31 5c 75 30 39 31 35 5c 75 30 39 34 64 5c 75 30 39 31 66 5c 75 30 39 34 62 5c 75 30 39 32 63 5c 75 30 39 33 30 5f 5c 75 30 39 32 38 5c 75 30 39 34 62 5c 75 30 39 33 35 5c 75 30 39 34 64 5c 75 30 39 33 39 5c 75 30 39 34 37 5c 75 30 39 30 32 5c 75 30 39 32 63 5c 75 30 39 33 30 5f 5c 75 30 39 32 31 5c 75 30 39 33 66 5c 75 30 39 33 38 5c 75 30 39 34 37 5c 75 30 39 30 32 5c 75 30 39 32 63 5c 75 30 39 33 30 22 2e 73 70 6c 69 74 28 22 5f 22 29 2c 66 6f 72 6d 61 74 3a 22 5c 75 30 39 31 63 5c 75 30 39 33 65 5c 75 30 39 32 38 5c 75 30 39 Data Ascii: 0917\u0938\u094d\u091f_\u0938\u092a\u094d\u091f\u0947\u0902\u092c\u0930_\u0911\u0915\u094d\u091f\u094b\u092c\u0930_\u0928\u094b\u0935\u094d\u0939\u0947\u0902\u092c\u0930_\u0921\u093f\u0938\u0947\u0902\u092c\u0930".split("_"),format:"\u091c\u093e\u0928\u09
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 61 63 74 3a 21 30 2c 77 65 65 6b 64 61 79 73 3a 22 5c 75 30 39 30 36 5c 75 30 39 32 66 5c 75 30 39 32 34 5c 75 30 39 33 65 5c 75 30 39 33 30 5f 5c 75 30 39 33 38 5c 75 30 39 34 62 5c 75 30 39 32 65 5c 75 30 39 33 65 5c 75 30 39 33 30 5f 5c 75 30 39 32 65 5c 75 30 39 30 32 5c 75 30 39 31 37 5c 75 30 39 33 33 5c 75 30 39 33 65 5c 75 30 39 33 30 5f 5c 75 30 39 32 63 5c 75 30 39 34 31 5c 75 30 39 32 37 5c 75 30 39 33 35 5c 75 30 39 33 65 5c 75 30 39 33 30 5f 5c 75 30 39 32 63 5c 75 30 39 33 66 5c 75 30 39 33 30 5c 75 30 39 34 37 5c 75 30 39 33 38 5c 75 30 39 34 64 5c 75 30 39 32 34 5c 75 30 39 33 65 5c 75 30 39 33 30 5f 5c 75 30 39 33 38 5c 75 30 39 34 31 5c 75 30 39 31 35 5c 75 30 39 34 64 5c 75 30 39 33 30 5c 75 30 39 33 65 5c 75 30 39 33 30 5f 5c 75 30 39 Data Ascii: act:!0,weekdays:"\u0906\u092f\u0924\u093e\u0930_\u0938\u094b\u092e\u093e\u0930_\u092e\u0902\u0917\u0933\u093e\u0930_\u092c\u0941\u0927\u0935\u093e\u0930_\u092c\u093f\u0930\u0947\u0938\u094d\u0924\u093e\u0930_\u0938\u0941\u0915\u094d\u0930\u093e\u0930_\u09
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 6e 28 65 2c 74 29 7b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 22 44 22 3a 72 65 74 75 72 6e 20 65 2b 22 5c 75 30 39 33 35 5c 75 30 39 34 37 5c 75 30 39 33 30 22 3b 64 65 66 61 75 6c 74 3a 63 61 73 65 22 4d 22 3a 63 61 73 65 22 51 22 3a 63 61 73 65 22 44 44 44 22 3a 63 61 73 65 22 64 22 3a 63 61 73 65 22 77 22 3a 63 61 73 65 22 57 22 3a 72 65 74 75 72 6e 20 65 7d 7d 2c 77 65 65 6b 3a 7b 64 6f 77 3a 30 2c 64 6f 79 3a 33 7d 2c 6d 65 72 69 64 69 65 6d 50 61 72 73 65 3a 2f 5c 75 30 39 33 30 5c 75 30 39 33 65 5c 75 30 39 32 34 5c 75 30 39 34 30 7c 5c 75 30 39 33 38 5c 75 30 39 31 35 5c 75 30 39 33 65 5c 75 30 39 33 33 5c 75 30 39 34 30 5c 75 30 39 30 32 7c 5c 75 30 39 32 36 5c 75 30 39 32 38 5c 75 30 39 32 61 5c 75 30 39 33 65 5c 75 30 39 33 30 5c 75 30 39 33 Data Ascii: n(e,t){switch(t){case"D":return e+"\u0935\u0947\u0930";default:case"M":case"Q":case"DDD":case"d":case"w":case"W":return e}},week:{dow:0,doy:3},meridiemParse:/\u0930\u093e\u0924\u0940\|\u0938\u0915\u093e\u0933\u0940\u0902\|\u0926\u0928\u092a\u093e\u0930\u093
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 5b 68 6f 78 65 20 22 2b 28 31 21 3d 3d 74 68 69 73 2e 68 6f 75 72 73 28 29 3f 22 5c 78 65 31 73 22 3a 22 5c 78 65 31 22 29 2b 22 5d 20 4c 54 22 7d 2c 6e 65 78 74 44 61 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 5b 6d 61 5c 78 66 31 5c 78 65 31 20 22 2b 28 31 21 3d 3d 74 68 69 73 2e 68 6f 75 72 73 28 29 3f 22 5c 78 65 31 73 22 3a 22 5c 78 65 31 22 29 2b 22 5d 20 4c 54 22 7d 2c 6e 65 78 74 57 65 65 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 64 64 64 64 20 5b 22 2b 28 31 21 3d 3d 74 68 69 73 2e 68 6f 75 72 73 28 29 3f 22 5c 78 65 31 73 22 3a 22 61 22 29 2b 22 5d 20 4c 54 22 7d 2c 6c 61 73 74 44 61 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 5b 6f 6e 74 65 Data Ascii: function(){return"[hoxe "+(1!==this.hours()?"\xe1s":"\xe1")+"] LT"},nextDay:function(){return"[ma\xf1\xe1 "+(1!==this.hours()?"\xe1s":"\xe1")+"] LT"},nextWeek:function(){return"dddd ["+(1!==this.hours()?"\xe1s":"a")+"] LT"},lastDay:function(){return"[onte
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 36 5c 75 30 36 34 32 22 2c 22 25 64 20 5c 75 30 36 32 66 5c 75 30 36 34 32 5c 75 30 36 34 61 5c 75 30 36 34 32 5c 75 30 36 32 39 22 2c 22 25 64 20 5c 75 30 36 32 66 5c 75 30 36 34 32 5c 75 30 36 34 61 5c 75 30 36 34 32 5c 75 30 36 32 39 22 5d 2c 68 3a 5b 22 5c 75 30 36 32 33 5c 75 30 36 34 32 5c 75 30 36 34 34 20 5c 75 30 36 34 35 5c 75 30 36 34 36 20 5c 75 30 36 33 33 5c 75 30 36 32 37 5c 75 30 36 33 39 5c 75 30 36 32 39 22 2c 22 5c 75 30 36 33 33 5c 75 30 36 32 37 5c 75 30 36 33 39 5c 75 30 36 32 39 20 5c 75 30 36 34 38 5c 75 30 36 32 37 5c 75 30 36 32 64 5c 75 30 36 32 66 5c 75 30 36 32 39 22 2c 5b 22 5c 75 30 36 33 33 5c 75 30 36 32 37 5c 75 30 36 33 39 5c 75 30 36 32 61 5c 75 30 36 32 37 5c 75 30 36 34 36 22 2c 22 5c 75 30 36 33 33 5c 75 30 36 32 37 Data Ascii: 6\u0642","%d \u062f\u0642\u064a\u0642\u0629","%d \u062f\u0642\u064a\u0642\u0629"],h:["\u0623\u0642\u0644 \u0645\u0646 \u0633\u0627\u0639\u0629","\u0633\u0627\u0639\u0629 \u0648\u0627\u062d\u062f\u0629",["\u0633\u0627\u0639\u062a\u0627\u0646","\u0633\u0627
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 30 36 34 38 5c 75 30 36 34 61 5c 75 30 36 34 34 5c 75 30 36 34 61 5c 75 30 36 32 39 22 2c 22 5c 75 30 36 32 33 5c 75 30 36 34 38 5c 75 30 36 32 61 22 2c 22 5c 75 30 36 33 33 5c 75 30 36 32 38 5c 75 30 36 32 61 5c 75 30 36 34 35 5c 75 30 36 32 38 5c 75 30 36 33 31 22 2c 22 5c 75 30 36 32 33 5c 75 30 36 34 33 5c 75 30 36 32 61 5c 75 30 36 34 38 5c 75 30 36 32 38 5c 75 30 36 33 31 22 2c 22 5c 75 30 36 34 36 5c 75 30 36 34 38 5c 75 30 36 34 31 5c 75 30 36 34 35 5c 75 30 36 32 38 5c 75 30 36 33 31 22 2c 22 5c 75 30 36 32 66 5c 75 30 36 34 61 5c 75 30 36 33 33 5c 75 30 36 34 35 5c 75 30 36 32 38 5c 75 30 36 33 31 22 5d 3b 65 2e 64 65 66 69 6e 65 4c 6f 63 61 6c 65 28 22 61 72 2d 64 7a 22 2c 7b 6d 6f 6e 74 68 73 3a 69 2c 6d 6f 6e 74 68 73 53 68 6f 72 74 3a 69 2c Data Ascii: 0648\u064a\u0644\u064a\u0629","\u0623\u0648\u062a","\u0633\u0628\u062a\u0645\u0628\u0631","\u0623\u0643\u062a\u0648\u0628\u0631","\u0646\u0648\u0641\u0645\u0628\u0631","\u062f\u064a\u0633\u0645\u0628\u0631"];e.defineLocale("ar-dz",{months:i,monthsShort:i,
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 30 36 32 66 20 5c 75 30 36 32 37 5c 75 30 36 34 34 5c 75 30 36 33 33 5c 75 30 36 32 37 5c 75 30 36 33 39 5c 75 30 36 32 39 5d 20 4c 54 22 2c 6c 61 73 74 57 65 65 6b 3a 22 64 64 64 64 20 5b 5c 75 30 36 33 39 5c 75 30 36 34 36 5c 75 30 36 32 66 20 5c 75 30 36 32 37 5c 75 30 36 34 34 5c 75 30 36 33 33 5c 75 30 36 32 37 5c 75 30 36 33 39 5c 75 30 36 32 39 5d 20 4c 54 22 2c 73 61 6d 65 45 6c 73 65 3a 22 4c 22 7d 2c 72 65 6c 61 74 69 76 65 54 69 6d 65 3a 7b 66 75 74 75 72 65 3a 22 5c 75 30 36 32 38 5c 75 30 36 33 39 5c 75 30 36 32 66 20 25 73 22 2c 70 61 73 74 3a 22 5c 75 30 36 34 35 5c 75 30 36 34 36 5c 75 30 36 33 30 20 25 73 22 2c 73 3a 72 28 22 73 22 29 2c 73 73 3a 72 28 22 73 22 29 2c 6d 3a 72 28 22 6d 22 29 2c 6d 6d 3a 72 28 22 6d 22 29 2c 68 3a 72 28 22 Data Ascii: 062f \u0627\u0644\u0633\u0627\u0639\u0629] LT",lastWeek:"dddd [\u0639\u0646\u062f \u0627\u0644\u0633\u0627\u0639\u0629] LT",sameElse:"L"},relativeTime:{future:"\u0628\u0639\u062f %s",past:"\u0645\u0646\u0630 %s",s:r("s"),ss:r("s"),m:r("m"),mm:r("m"),h:r("
2025-04-28 18:18:32 UTC	1460	IN	Data Raw: 64 69 6e 61 6c 50 61 72 73 65 3a 2f 5c 64 7b 31 2c 32 7d 28 65 72 7c 65 29 2f 2c 6f 72 64 69 6e 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 73 77 69 74 63 68 28 74 29 7b 64 65 66 61 75 6c 74 3a 63 61 73 65 22 4d 22 3a 63 61 73 65 22 51 22 3a 63 61 73 65 22 44 22 3a 63 61 73 65 22 44 44 44 22 3a 63 61 73 65 22 64 22 3a 72 65 74 75 72 6e 20 65 2b 28 31 3d 3d 3d 65 3f 22 65 72 22 3a 22 65 22 29 3b 63 61 73 65 22 77 22 3a 63 61 73 65 22 57 22 3a 72 65 74 75 72 6e 20 65 2b 28 31 3d 3d 3d 65 3f 22 72 65 22 3a 22 65 22 29 7d 7d 7d 29 7d 28 6e 28 22 38 4d 63 61 22 29 29 7d 2c 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 28 22 7a 55 6e 62 22 29 7d 2c 22 30 64 2f 6a 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 Data Ascii: dinalParse:/\d{1,2}(er\|e)/,ordinal:function(e,t){switch(t){default:case"M":case"Q":case"D":case"DDD":case"d":return e+(1===e?"er":"e");case"w":case"W":return e+(1===e?"re":"e")}}})}(n("8Mca"))},0:function(e,t,n){e.exports=n("zUnb")},"0d/j":function(e,t,n)
2025-04-28 18:18:33 UTC	620	OUT	GET /ttpwp/resources/languages/en.json HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive x-context-route: ttpwp sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/json sec-ch-ua-mobile: ?0 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:33 UTC	534	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:33 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 17216 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 21 Jan 2025 15:13:30 GMT ETag: W/"4340-194896d0190" Vary: Accept-Encoding

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49698	170.10.132.89	443	1548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 18:18:33 UTC	675	OUT	GET /ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273 HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive Origin: https://security-us.m.mimecastprotect.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://security-us.m.mimecastprotect.com/ttpwp Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:33 UTC	490	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:33 GMT Content-Type: font/woff2 Content-Length: 37608 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 21 Jan 2025 15:13:30 GMT ETag: W/"92e8-194896d0190"
2025-04-28 18:18:33 UTC	1460	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 92 e8 00 0b 00 00 00 01 2f b0 00 00 92 95 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 54 06 56 00 91 4e 0a 84 ad 78 83 b8 53 0b 81 7e 00 01 36 02 24 03 83 78 04 20 05 85 32 07 90 55 1b 43 f3 07 54 27 ca 61 d0 df b9 21 00 c4 2a b7 7b b5 31 b3 11 15 6c 1c 24 1e 0c ec 0b a6 db 7c 10 e8 ad 8a f4 28 18 55 f6 ff ff 3d 41 8d 31 84 a7 0e 50 6b 59 d3 10 4e 14 95 2a 93 14 74 97 2b 50 60 8c d9 4b 70 c9 3a 6e 1e 7f 8b cb a3 da 88 d7 70 1d fb b5 c2 1e 9b 7e 8b e1 b0 a6 fd 93 2e 03 ef a1 2d 2e 87 98 8e 60 3b 44 f9 76 75 cc bd 70 d8 4e 91 74 a6 02 90 10 05 95 5d 75 e3 f6 1b dc 6d 19 19 b8 cf 48 6c 6e b7 de 61 d3 af 78 07 d6 4e d5 67 6c fd 97 1f 27 5b 60 db f0 56 92 9c 4c 7b 8f e7 cd ed 7f 66 ce 39 b7 6c c9 de Data Ascii: wOF2/TVNxS~6$x 2UCT'a!{1l$\|(U=A1PkYNt+P`Kp:np~.-.`;DvupNt]umHlnaxNgl'[`VL{f9l
2025-04-28 18:18:33 UTC	1460	IN	Data Raw: d7 65 60 55 5f 97 83 1b fa fa 34 58 dd d7 67 c1 8d 7d 7d fe 87 9b ee e9 1f 04 fe 43 cc d6 72 a7 85 b7 0d 26 df a1 67 3b 7d 24 64 76 d4 0b 1c 7a 3f 4b a0 7c 1e d2 40 04 67 80 a2 4a 39 97 0c e9 90 cf f1 b0 f7 c7 80 80 03 9b e9 81 0c 08 40 85 0e 41 1c 9f 6d f0 06 c6 16 a0 4a 43 33 e6 51 aa d8 33 98 cc 4b f0 12 50 40 b7 43 4c a8 16 f4 0b 44 b9 1a 70 ce 1b 19 01 17 64 81 4e 0c 28 0e 32 c9 0a cc 86 18 60 4a 83 6c fd 87 12 68 c4 0a 55 15 67 cf 7c 38 e3 ca f4 33 92 5e 6a 49 e1 01 c9 82 38 04 f1 d4 91 93 9b f6 eb fc 54 ea 77 76 c1 7a d9 35 02 8a 90 0a ca 1d 21 a2 96 d2 53 0f 3d 46 84 75 44 d2 07 b4 46 50 6c 3b de ad 3b 1d b2 d9 58 e6 55 39 87 65 d9 76 be 98 ca ad aa e4 d1 3d 57 cf ac 15 7f 8c 85 1b 29 c7 72 00 8c a5 d0 f9 5b b1 1d 4e 49 f7 aa 54 73 45 8b 33 e3 17 Data Ascii: e`U_4Xg}}Cr&g;}$dvz?K\|@gJ9@AmJC3Q3KP@CLDpdN(2`JlhUg\|83^jI8Twvz5!S=FuDFPl;;XU9ev=W)r[NITsE3
2025-04-28 18:18:33 UTC	1460	IN	Data Raw: 95 c3 8f a6 e6 e8 bb 9c 0d 8b 2e 07 e9 44 97 6a 3f d1 08 d9 f5 6e 90 46 71 97 a1 c9 02 93 c1 4f 87 15 7c ea 60 79 09 2f 43 69 85 f0 08 c9 ef f7 7e 9c 2f 80 61 0e ec 81 9b 01 81 62 7d 97 0f 10 fe 41 65 f7 9c b5 65 e5 ce 9d 17 dd 4a 12 d9 bd 8c 74 6f d6 39 0d c0 96 44 f1 87 3a 0e cf 1f e8 d5 da 0e 79 60 27 cf 4d ab f7 14 5b a6 da 9d 9c eb fc 35 c5 cc ab c3 77 a6 d3 07 08 96 b0 de b7 08 b5 c5 81 2a 36 10 4c 14 ff dc 20 85 54 2a 94 a6 90 05 b0 e1 a3 ab db 5d ae 0c 75 f4 ed 65 08 35 ca 30 b0 5e 1a 64 f5 ba 00 c6 79 2b 5a 2b 77 b7 db b3 78 8e c1 2d d1 3c 2a 5c 70 a7 5e 10 3e 3b 8e a2 49 de 07 56 88 af c7 de 3e 6f 45 d4 6a f5 be 18 7e 73 ee 7c bf 06 2b 32 83 5c d1 ab 82 48 34 8b 21 86 9f 5a 32 d3 10 5a d0 e1 01 42 ab ef 63 12 d9 04 3b 5e 0f 6a 58 5a 6a 3c d6 38 Data Ascii: .Dj?nFqO\|`y/Ci~/ab}AeeJto9D:y`'M[5w6L T]ue50^dy+Z+wx-<*\p^>;IV>oEj~s\|+2\H4!Z2ZBc;^jXZj<8
2025-04-28 18:18:33 UTC	1460	IN	Data Raw: da b9 6b cb a8 5d 75 93 41 24 65 03 1b 29 e1 d5 26 e3 34 fd 7c f4 29 27 33 b1 7e 9d 68 fe ed 8a 28 ea dc 19 53 d2 a3 e6 fe 39 23 da 23 6d 90 f5 de f8 7a 64 8b 1e 68 c7 66 8e e5 b0 11 9e 3e 6e 59 9f db 5b b0 29 d7 26 3d 17 3d 49 cf 45 64 5b cc 07 b5 88 ee 17 56 6c 9c bc 3d 5e 8c af 02 11 a5 ec e7 e1 6d b9 fa c7 89 62 c8 d5 fe 76 63 a5 08 f4 38 6e db e0 96 1c 99 8c 09 32 d3 0b bc f2 dc b4 2c cf f9 e0 90 19 41 a3 5c 6c 1b f9 cc 68 d2 93 44 4e 11 61 67 34 1f 0c 59 aa 8a 57 e9 51 bd 1c 37 36 e3 7f f6 d4 9c 7d b7 f1 ab b9 cf 71 48 6f 99 1a b4 75 a1 bf 84 0e 1a 92 71 73 7f 46 18 5c 03 a6 06 17 0c 93 11 53 78 21 35 de ce 2b 73 e9 68 8b 23 a3 06 2c 83 0f e5 e0 01 62 23 26 0f e5 f9 07 2d ac a9 68 1e 37 9a e6 2f 17 0d 72 36 a9 a0 6f c4 ff 93 33 13 0d 5a 49 0f cd 08 Data Ascii: k]uA$e)&4\|)'3~h(S9##mzdhf>nY[)&==IEd[Vl=^mbvc8n2,A\lhDNag4YWQ76}qHouqsF\Sx!5+sh#,b#&-h7/r6o3ZI
2025-04-28 18:18:33 UTC	1460	IN	Data Raw: 25 aa ab 15 24 6c 55 56 58 e7 b2 50 ca e2 31 c8 49 8a b6 75 b3 48 59 c7 58 96 b7 f5 c8 b4 f8 e4 d5 0e 55 62 46 fb a2 65 1a dd 8d 5a 76 1e 1c 18 1f 5e 86 a6 f9 bb 10 d6 b6 6d 2a 09 3e 59 04 56 89 30 19 12 e8 80 53 58 1d 84 fa 42 7c 2c 57 2b e8 56 75 3b b7 a9 d4 ce 4a 35 56 f4 3d 9a 6d b4 31 6f 84 1a ab da 22 7c 15 f1 bb 68 d8 88 62 5c 42 b3 88 75 88 d5 a2 56 34 a9 b7 cf 92 9c e5 69 ee c6 77 16 a2 71 c9 c7 a8 73 20 63 05 bc 88 bf b1 ce bf ae 2b bc 5e a5 f6 02 ba ce fa d7 6c 56 70 df c6 cd c2 a0 41 e0 35 dc 8a c0 c2 93 a2 fb d6 72 21 d0 8e 72 4f 16 d1 24 c9 22 5a c7 d1 96 86 0d 9b bb f7 a7 72 3b 04 ae 13 6d 01 f6 59 d0 39 74 43 31 83 c3 67 49 04 2d 43 cc d1 87 85 e8 43 82 be f2 3e 7c 5c e7 fb 02 12 2c 3b 54 88 20 aa 1a 10 42 8b 32 ec 85 98 22 5a 2b a7 34 28 Data Ascii: %$lUVXP1IuHYXUbFeZv^m*>YV0SXB\|,W+Vu;J5V=m1o"\|hb\BuV4iwqs c+^lVpA5r!rO$"Zr;mY9tC1gI-CC>\|\,;T B2"Z+4(
2025-04-28 18:18:33 UTC	1460	IN	Data Raw: b3 67 34 89 cd 97 ac a2 cc 40 67 50 a4 05 cc ad 52 b7 ca 57 2b 22 d1 c2 f6 5e 6d 80 14 57 54 ed 31 2b 10 de 10 22 02 28 6a 46 64 13 f3 b9 60 15 a6 17 3e 78 56 97 63 52 e7 04 a4 5b 8c 5a 6a e1 18 0c bc 5f 39 b5 6f e5 fa 22 b4 56 3d 3b 34 82 56 07 25 c2 58 7b 9d 6c 52 5b 7e 31 8f 24 0d b4 63 7c 21 55 40 aa e4 2f ae ad 20 cc 5e 05 09 da bb d9 8f e0 44 e6 ab b3 42 04 ed 32 6e 4b d3 5b 0a 61 94 97 8d 3c fe b2 ae ed a4 7b f4 58 8e 86 47 fb ae 9d 4f 8f 32 07 a2 81 ec 55 f6 ec ad b2 dc 51 56 9f a2 ef 1b 76 d4 e6 7c ef 65 29 9c cd ce 77 d3 e8 b9 bd f5 db bf fe f0 23 eb bb 0e 85 db 55 4a 66 52 5f aa c5 05 10 27 18 c7 71 99 54 14 a7 2a 1c d2 9d 93 c8 87 49 32 ce 72 a1 a6 44 12 66 f5 55 48 f9 0f a9 0e 31 e1 53 dd 18 09 c9 2b a5 70 cc eb c4 18 fa 81 b0 bc 82 90 5e 1e Data Ascii: g4@gPRW+"^mWT1+"(jFd`>xVcR[Zj_9o"V=;4V%X{lR[~1$c\|!U@/ ^DB2nK[a<{XGO2UQVv\|e)w#UJfR_'qT*I2rDfUH1S+p^
2025-04-28 18:18:33 UTC	1460	IN	Data Raw: f3 a3 d3 f5 41 56 be 7e e7 62 db 68 1c 70 b9 fe d4 47 bf 3a 29 46 a3 80 43 3b 7c fe 1b f3 0d 93 41 65 ee 5e 5b 7d 33 c9 a4 e2 32 23 d8 4e 27 28 94 76 3c 75 67 3c ac 6b 9d d5 6e c1 40 d3 e3 a4 46 42 c1 32 bf fa 77 f4 0a 13 5d b5 68 c5 3f 81 5b b5 fa e6 76 ce ba d1 3f d0 2c 89 e4 3e ba a3 fa b0 0c 6c f8 2e 55 1a 80 b6 cc 40 77 00 eb 5c 0c af f6 85 ab 4e 88 7a 03 b2 8c 05 b8 a1 d8 b6 7a ff 2f 0b d2 aa df 4b 99 1d da 34 67 a4 65 88 6d 27 2c 5a e6 ef 01 c2 eb 05 60 ad 18 e2 23 91 80 91 03 10 44 84 80 8c a1 b2 30 99 13 d4 42 cd 38 bd c2 4a 16 c2 36 74 89 c1 e9 f9 1f 9c 63 7c de dc c0 19 e3 09 0e 93 da 9d 04 ba 63 4c db 20 00 c9 58 4f 48 66 20 f7 8f f6 93 8c 22 a5 f1 8d f7 52 7b 5b 4d 94 a5 04 67 f8 1d 2f 37 5a 73 60 de ac 02 fa 9c 1d 13 e5 a7 69 32 00 b4 c8 f5 Data Ascii: AV~bhpG:)FC;\|Ae^[}32#N'(v<ug<kn@FB2w]h?[v?,>l.U@w\Nzz/K4gem',Z`#D0B8J6tc\|cL XOHf "R{[Mg/7Zs`i2
2025-04-28 18:18:33 UTC	1460	IN	Data Raw: d9 0a 97 bb 35 ac 0e fa 6b 3a 36 82 4b b5 0b 3e 5d 6d c4 3e 5f ab 7d 57 28 d7 85 48 51 fd db 8e 5a 94 7b e0 9f 6f fb ee 73 ae 7f be 74 7c bb 99 f4 9e cf ba 95 b7 14 1f 99 9a 1e de 3e ee 0f 9c 6e a9 e7 c6 ac 09 ea cd 35 b2 fb 85 1b cc 63 e9 58 1c 94 7b af 46 8a 46 cc 49 03 ae 78 1c ff 5d 4c f6 7e 9b 87 8a 02 36 dd 79 22 dd a3 a3 73 98 14 5f ef f9 73 cd f8 fa ce b7 f4 de ef 75 df 62 17 0a 57 6a 17 78 24 e4 c4 66 fb f2 fb fa ee f5 14 df 5c 2e 58 6e 98 17 8d 2f b6 41 7d dd d3 ad bb da eb 69 f3 d8 2d 10 dd 5e c3 2b 9d 8a b6 01 23 67 55 f0 d7 d2 aa e0 cf f9 79 b9 0c 97 4a c9 a3 23 f1 da d5 0d 86 63 35 60 c6 f0 c4 7c 26 22 ac 51 2b 6e 4f 85 d1 65 93 28 fa 36 74 e0 82 2f da 9e 6c 33 34 3d ac 3e f3 70 7c 09 cb af 3c fd e4 cf 1b 3b a3 1b 9d 8f 19 9d 56 bc 3b 32 d3 Data Ascii: 5k:6K>]m>_}W(HQZ{ost\|>n5cX{FFIx]L~6y"s_subWjx$f\.Xn/A}i-^+#gUyJ#c5`\|&"Q+nOe(6t/l34=>p\|<;V;2
2025-04-28 18:18:33 UTC	1460	IN	Data Raw: 15 54 8b 2a 0c 12 68 b7 65 84 b6 34 f4 a0 3c ad 10 11 8b c8 ac 43 c0 40 73 7a 29 5a c6 1e fa 32 a6 10 0b 77 34 48 0a 69 0e 43 3a 6a 35 85 0d 89 92 4d 48 2a 44 0d c7 86 fd 3e 2b bf b3 21 3c d1 1c 9b 04 b9 6c 46 c1 27 4c 10 45 67 89 e3 08 96 86 36 29 89 a2 03 b4 3b 79 52 44 a8 f0 8e d4 5d 65 9b d4 55 e3 02 ac 1a 62 91 38 40 aa fb 59 54 6b d1 5c 1e 6f fb c3 00 a9 ee 4f 22 44 af 81 1a 11 50 8f 02 1b 7d dd 6c cc 97 56 4c 66 ab b4 b8 40 67 a5 89 24 6b be 46 8f ab 01 e0 be 2a e0 b5 16 b0 24 41 68 86 4f 07 fd ca d3 ae 59 14 21 23 82 c8 93 01 fd 99 bc 19 21 58 18 10 c3 67 82 41 6e 68 78 77 02 73 d3 b2 25 6d 4b 55 9b 38 26 0f f4 df c1 26 5d bb 6d 6a 28 ef 52 33 f7 61 4d 6d db 8e b2 77 43 f2 b8 1a d8 e0 59 48 6b ed f5 17 fa b7 1b fb e7 c1 78 4a b8 b9 b9 47 ce 98 be Data Ascii: The4<C@sz)Z2w4HiC:j5MHD>+!<lF'LEg6);yRD]eUb8@YTk\oO"DP}lVLf@g$kF*$AhOY!#!XgAnhxws%mKU8&&]mj(R3aMmwCYHkxJG
2025-04-28 18:18:33 UTC	1460	IN	Data Raw: 0e 34 3e 22 9d 33 31 39 96 ba 13 fd a2 db bd dd 6b 33 53 d4 b1 98 be 57 fd 0e 86 4f 4f 08 9f db 3b 8f b3 b3 9e 08 93 f0 3c df ba e1 15 83 91 f9 d1 e0 e3 8b 3e 8c 4c 0c d2 77 b5 13 39 ee 3d f3 c2 e1 d5 c6 6a e7 05 f2 66 9f 16 ae b6 b9 7a ae 22 48 8c a8 d5 dc 64 b5 c1 a7 ef 78 7e f9 89 e1 f3 c3 cf bc bc af d6 75 52 a3 3b 4c a0 29 dc 11 1a 6f 86 7c b7 3f 33 3a f6 f6 a8 0c 54 85 1c ac 42 4c 6b e5 77 f7 bf 71 8f 6f d9 22 c8 5f 19 56 3c 32 f3 f8 e1 c1 a1 cd dd b1 b2 97 f1 d2 2b 38 e4 96 d5 ad e1 f5 fa 59 49 23 69 10 5d 22 2e 55 61 97 b6 b4 4b 1f 74 9b 70 6c 5d 3d b8 8a 18 f5 10 57 4f b4 7f 96 d6 54 e6 96 26 11 f5 b4 2d 84 ce ce 77 2d 63 70 14 c2 94 72 07 39 c2 83 aa 1c f0 49 ea 38 f6 dc 03 e6 e1 f9 ab 01 89 e4 58 6a 52 00 50 46 a4 ae fc 85 9d e7 69 31 8a 1b df Data Ascii: 4>"319k3SWOO;<>Lw9=jfz"Hdx~uR;L)o\|?3:TBLkwqo"_V<2+8YI#i]".UaKtpl]=WOT&-w-cpr9I8XjRPFi1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49701	170.10.132.89	443	1548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 18:18:34 UTC	430	OUT	GET /ttpwp/resources/languages/en.json HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:34 UTC	534	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:34 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 17216 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 21 Jan 2025 15:13:30 GMT ETag: W/"4340-194896d0190" Vary: Accept-Encoding
2025-04-28 18:18:34 UTC	1460	IN	Data Raw: 7b 22 44 45 43 49 53 49 4f 4e 5f 57 49 4c 4c 5f 42 45 5f 4c 4f 47 47 45 44 22 3a 22 59 6f 75 72 20 64 65 63 69 73 69 6f 6e 20 77 69 6c 6c 20 62 65 20 6c 6f 67 67 65 64 20 66 6f 72 20 74 72 61 63 6b 69 6e 67 20 61 6e 64 20 61 75 64 69 74 20 70 75 72 70 6f 73 65 73 2e 22 2c 22 49 4e 5f 50 52 49 56 41 54 45 5f 42 52 4f 57 53 45 52 5f 4d 4f 44 45 5f 57 41 52 4e 49 4e 47 22 3a 22 50 6c 65 61 73 65 20 6c 65 61 76 65 20 7b 7b 62 72 6f 77 73 65 72 7d 7d 20 74 6f 20 63 6f 6d 70 6c 65 74 65 20 64 65 76 69 63 65 20 65 6e 72 6f 6c 6c 6d 65 6e 74 2e 22 2c 22 49 4e 5f 50 52 49 56 41 54 45 5f 43 48 52 4f 4d 45 22 3a 22 49 6e 63 6f 67 6e 69 74 6f 20 6d 6f 64 65 22 2c 22 49 4e 5f 50 52 49 56 41 54 45 5f 46 49 52 45 46 4f 58 22 3a 22 50 72 69 76 61 74 65 20 42 72 6f 77 73 Data Ascii: {"DECISION_WILL_BE_LOGGED":"Your decision will be logged for tracking and audit purposes.","IN_PRIVATE_BROWSER_MODE_WARNING":"Please leave {{browser}} to complete device enrollment.","IN_PRIVATE_CHROME":"Incognito mode","IN_PRIVATE_FIREFOX":"Private Brows
2025-04-28 18:18:34 UTC	1460	IN	Data Raw: 5f 52 41 4e 47 45 5f 43 4f 4e 46 49 47 5f 4c 41 42 45 4c 5f 50 41 53 54 5f 37 5f 44 41 59 53 22 3a 22 50 61 73 74 20 37 20 64 61 79 73 22 2c 22 24 49 31 38 4e 5f 44 41 54 45 5f 52 41 4e 47 45 5f 43 4f 4e 46 49 47 5f 4c 41 42 45 4c 5f 50 41 53 54 5f 33 30 5f 44 41 59 53 22 3a 22 50 61 73 74 20 33 30 20 64 61 79 73 22 2c 22 24 49 31 38 4e 5f 44 41 54 45 5f 52 41 4e 47 45 5f 43 4f 4e 46 49 47 5f 4c 41 42 45 4c 5f 54 4f 44 41 59 22 3a 22 54 6f 64 61 79 22 2c 22 24 49 31 38 4e 5f 44 41 54 45 5f 52 41 4e 47 45 5f 43 4f 4e 46 49 47 5f 4c 41 42 45 4c 5f 59 45 53 54 45 52 44 41 59 22 3a 22 59 65 73 74 65 72 64 61 79 22 2c 22 24 49 31 38 4e 5f 44 41 54 45 5f 52 41 4e 47 45 5f 43 4f 4e 46 49 47 5f 4c 41 42 45 4c 5f 31 5f 57 45 45 4b 22 3a 22 31 20 57 65 65 6b 22 2c Data Ascii: _RANGE_CONFIG_LABEL_PAST_7_DAYS":"Past 7 days","$I18N_DATE_RANGE_CONFIG_LABEL_PAST_30_DAYS":"Past 30 days","$I18N_DATE_RANGE_CONFIG_LABEL_TODAY":"Today","$I18N_DATE_RANGE_CONFIG_LABEL_YESTERDAY":"Yesterday","$I18N_DATE_RANGE_CONFIG_LABEL_1_WEEK":"1 Week",
2025-04-28 18:18:34 UTC	1460	IN	Data Raw: 5f 4e 4f 54 5f 41 50 50 4c 49 43 41 42 4c 45 22 3a 22 4e 2f 41 22 2c 22 53 45 41 52 43 48 5f 42 59 22 3a 22 53 65 61 72 63 68 20 62 79 22 2c 22 53 45 41 52 43 48 22 3a 22 53 65 61 72 63 68 22 2c 22 48 41 53 48 5f 43 41 4c 43 55 4c 41 54 4f 52 5f 41 52 45 41 5f 43 4f 4d 50 4f 4e 45 4e 54 22 3a 7b 22 44 52 4f 50 5f 41 52 45 41 22 3a 22 44 72 6f 70 20 66 69 6c 65 20 68 65 72 65 22 2c 22 43 41 4e 43 45 4c 5f 42 54 4e 22 3a 22 43 61 6e 63 65 6c 22 2c 22 43 4f 4d 50 4c 45 54 45 5f 50 52 4f 47 52 45 53 53 22 3a 22 43 6f 6d 70 6c 65 74 65 22 2c 22 45 52 52 4f 52 53 22 3a 7b 22 45 58 43 45 45 44 5f 53 49 5a 45 22 3a 22 54 68 65 20 6d 61 78 69 6d 75 6d 20 66 69 6c 65 20 73 69 7a 65 20 69 73 20 7b 7b 20 73 69 7a 65 20 7d 7d 2e 22 2c 22 46 4f 4c 44 45 52 5f 4e 4f 54 Data Ascii: _NOT_APPLICABLE":"N/A","SEARCH_BY":"Search by","SEARCH":"Search","HASH_CALCULATOR_AREA_COMPONENT":{"DROP_AREA":"Drop file here","CANCEL_BTN":"Cancel","COMPLETE_PROGRESS":"Complete","ERRORS":{"EXCEED_SIZE":"The maximum file size is {{ size }}.","FOLDER_NOT
2025-04-28 18:18:34 UTC	1460	IN	Data Raw: 6c 6c 22 2c 22 43 4c 45 41 52 41 4c 4c 5f 42 55 54 54 4f 4e 22 3a 22 43 6c 65 61 72 20 41 6c 6c 22 2c 22 50 41 4e 45 4c 5f 46 49 4c 54 45 52 42 59 22 3a 22 46 69 6c 74 65 72 20 62 79 22 2c 22 41 50 50 4c 59 5f 42 55 54 54 4f 4e 22 3a 22 41 70 70 6c 79 22 2c 22 43 41 4e 43 45 4c 5f 42 55 54 54 4f 4e 22 3a 22 43 61 6e 63 65 6c 22 2c 22 43 4c 45 41 52 5f 42 55 54 54 4f 4e 22 3a 22 43 6c 65 61 72 22 7d 2c 22 24 49 31 38 4e 5f 43 4f 4c 55 4d 4e 5f 56 41 4c 55 45 5f 53 49 4e 47 4c 45 5f 53 45 4c 45 43 54 22 3a 7b 22 53 45 4c 45 43 54 5f 41 4c 4c 22 3a 22 41 6c 6c 22 7d 2c 22 24 49 31 38 4e 5f 54 41 42 4c 45 5f 50 4c 55 47 49 4e 5f 43 4f 4c 55 4d 4e 5f 56 41 4c 55 45 53 5f 46 49 4c 54 45 52 5f 46 49 45 4c 44 22 3a 7b 22 41 50 50 4c 59 5f 42 55 54 54 4f 4e 22 3a Data Ascii: ll","CLEARALL_BUTTON":"Clear All","PANEL_FILTERBY":"Filter by","APPLY_BUTTON":"Apply","CANCEL_BUTTON":"Cancel","CLEAR_BUTTON":"Clear"},"$I18N_COLUMN_VALUE_SINGLE_SELECT":{"SELECT_ALL":"All"},"$I18N_TABLE_PLUGIN_COLUMN_VALUES_FILTER_FIELD":{"APPLY_BUTTON":
2025-04-28 18:18:34 UTC	1460	IN	Data Raw: 20 46 69 6c 65 20 45 78 74 65 6e 73 69 6f 6e 22 2c 22 44 45 46 41 55 4c 54 5f 45 4e 43 52 59 50 54 49 4f 4e 22 3a 22 44 65 66 61 75 6c 74 20 45 6e 63 72 79 70 74 69 6f 6e 22 2c 22 44 45 54 45 43 54 45 44 5f 43 48 49 4c 44 22 3a 22 44 65 74 65 63 74 65 64 20 43 68 69 6c 64 22 2c 22 44 49 53 47 55 49 53 45 44 5f 4c 49 4e 4b 22 3a 22 44 69 73 67 75 69 73 65 64 20 4c 69 6e 6b 22 2c 22 44 4f 57 4e 4c 4f 41 44 5f 46 41 49 4c 55 52 45 22 3a 22 44 6f 77 6e 6c 6f 61 64 20 46 61 69 6c 75 72 65 22 2c 22 44 56 43 22 3a 22 44 56 43 22 2c 22 45 4e 43 52 59 50 54 45 44 22 3a 22 45 6e 63 72 79 70 74 65 64 22 2c 22 45 53 44 22 3a 22 45 53 44 22 2c 22 45 58 43 45 45 44 45 44 5f 52 45 54 52 49 45 53 22 3a 22 45 78 63 65 65 64 65 64 20 52 65 74 72 69 65 73 22 2c 22 45 58 43 Data Ascii: File Extension","DEFAULT_ENCRYPTION":"Default Encryption","DETECTED_CHILD":"Detected Child","DISGUISED_LINK":"Disguised Link","DOWNLOAD_FAILURE":"Download Failure","DVC":"DVC","ENCRYPTED":"Encrypted","ESD":"ESD","EXCEEDED_RETRIES":"Exceeded Retries","EXC
2025-04-28 18:18:34 UTC	1460	IN	Data Raw: 20 53 69 74 65 73 22 2c 22 53 55 53 50 45 43 54 45 44 4a 53 22 3a 22 53 75 73 70 65 63 74 65 64 20 4a 61 76 61 53 63 72 69 70 74 22 2c 22 53 50 4f 4f 46 49 4e 47 22 3a 22 53 70 6f 6f 66 69 6e 67 22 2c 22 54 41 47 53 43 52 49 50 54 22 3a 22 54 61 67 53 63 72 69 70 74 22 2c 22 54 4f 4f 5f 44 45 45 50 22 3a 22 54 6f 6f 20 44 65 65 70 22 2c 22 55 4e 56 45 52 49 46 49 45 44 5f 53 49 47 4e 41 54 55 52 45 22 3a 22 55 6e 76 65 72 69 66 69 65 64 20 53 69 67 6e 61 74 75 72 65 22 2c 22 55 4e 4b 4e 4f 57 4e 5f 43 48 49 4c 44 22 3a 22 55 6e 6b 6e 6f 77 6e 20 43 68 69 6c 64 22 2c 22 55 4e 53 55 50 50 4f 52 54 45 44 5f 50 52 4f 54 4f 43 4f 4c 22 3a 22 55 6e 73 75 70 70 6f 72 74 65 64 20 50 72 6f 74 6f 63 6f 6c 22 2c 22 55 52 4c 22 3a 22 55 52 4c 22 2c 22 55 52 4c 5f 42 Data Ascii: Sites","SUSPECTEDJS":"Suspected JavaScript","SPOOFING":"Spoofing","TAGSCRIPT":"TagScript","TOO_DEEP":"Too Deep","UNVERIFIED_SIGNATURE":"Unverified Signature","UNKNOWN_CHILD":"Unknown Child","UNSUPPORTED_PROTOCOL":"Unsupported Protocol","URL":"URL","URL_B
2025-04-28 18:18:34 UTC	1460	IN	Data Raw: 49 4f 4e 5f 44 45 56 22 3a 22 4d 69 6d 65 63 61 73 74 20 49 6e 74 65 72 6e 61 6c 20 28 44 45 56 29 22 2c 22 24 49 31 38 4e 5f 4f 4e 42 4f 41 52 44 49 4e 47 5f 53 4d 41 52 54 5f 48 4f 53 54 53 5f 52 45 47 49 4f 4e 5f 4c 4f 43 41 4c 22 3a 22 4d 69 6d 65 63 61 73 74 20 49 6e 74 65 72 6e 61 6c 20 28 4c 4f 43 41 4c 29 22 2c 22 24 49 31 38 4e 5f 4f 4e 42 4f 41 52 44 49 4e 47 5f 53 4d 41 52 54 5f 48 4f 53 54 53 5f 52 45 47 49 4f 4e 5f 54 45 53 54 22 3a 22 47 6c 6f 62 61 6c 20 28 69 6e 63 6c 75 64 65 73 20 61 6c 6c 20 74 68 65 20 61 62 6f 76 65 29 22 2c 22 4c 49 56 45 5f 42 55 54 54 4f 4e 5f 45 4e 52 4f 4c 4c 4d 45 4e 54 22 3a 7b 22 47 45 54 5f 43 4f 44 45 22 3a 22 47 65 74 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 43 6f 64 65 22 2c 22 45 4e 52 4f 4c 4c 5f Data Ascii: ION_DEV":"Mimecast Internal (DEV)","$I18N_ONBOARDING_SMART_HOSTS_REGION_LOCAL":"Mimecast Internal (LOCAL)","$I18N_ONBOARDING_SMART_HOSTS_REGION_TEST":"Global (includes all the above)","LIVE_BUTTON_ENROLLMENT":{"GET_CODE":"Get Authentication Code","ENROLL_
2025-04-28 18:18:34 UTC	1460	IN	Data Raw: 52 4d 46 55 4c 22 3a 22 49 74 27 73 20 48 61 72 6d 66 75 6c 22 2c 22 42 52 4f 57 53 45 52 5f 49 53 4f 4c 41 54 49 4f 4e 22 3a 22 4f 70 65 6e 20 73 61 66 65 6c 79 22 7d 2c 22 55 53 45 52 5f 43 48 41 4c 4c 45 4e 47 45 22 3a 7b 22 4c 49 4e 4b 5f 43 4c 49 43 4b 45 44 22 3a 22 4c 69 6e 6b 20 43 6c 69 63 6b 65 64 22 2c 22 4d 45 53 53 41 47 45 5f 53 55 42 4a 45 43 54 22 3a 22 4d 65 73 73 61 67 65 20 53 75 62 6a 65 63 74 22 2c 22 4d 45 53 53 41 47 45 5f 53 45 4e 44 45 52 22 3a 22 4d 65 73 73 61 67 65 20 53 65 6e 64 65 72 22 2c 22 45 4d 41 49 4c 5f 41 44 44 52 45 53 53 22 3a 22 45 6d 61 69 6c 20 41 64 64 72 65 73 73 22 7d 2c 22 41 57 41 52 45 4e 45 53 53 22 3a 7b 22 57 45 4c 4c 5f 44 4f 4e 45 5f 53 41 46 45 22 3a 22 57 65 6c 6c 20 64 6f 6e 65 2c 20 74 68 69 73 20 Data Ascii: RMFUL":"It's Harmful","BROWSER_ISOLATION":"Open safely"},"USER_CHALLENGE":{"LINK_CLICKED":"Link Clicked","MESSAGE_SUBJECT":"Message Subject","MESSAGE_SENDER":"Message Sender","EMAIL_ADDRESS":"Email Address"},"AWARENESS":{"WELL_DONE_SAFE":"Well done, this
2025-04-28 18:18:34 UTC	1460	IN	Data Raw: 65 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 63 6f 6e 74 69 6e 75 65 3f 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 22 7d 2c 22 42 4c 4f 43 4b 45 44 22 3a 7b 22 53 54 41 54 55 53 22 3a 22 54 68 69 73 20 6c 69 6e 6b 20 64 6f 77 6e 6c 6f 61 64 73 20 61 20 70 6f 74 65 6e 74 69 61 6c 6c 79 20 68 61 72 6d 66 75 6c 20 66 69 6c 65 22 2c 22 49 4e 46 4f 22 3a 22 53 6f 72 72 79 2c 20 74 68 65 20 64 6f 77 6e 6c 6f 61 64 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 22 Data Ascii: e you want to continue? For more information, please contact your administrator."},"BLOCKED":{"STATUS":"This link downloads a potentially harmful file","INFO":"Sorry, the download has been blocked. For more information, please contact your administrator."
2025-04-28 18:18:34 UTC	1460	IN	Data Raw: 65 6d 61 69 6c 2c 20 77 65 20 63 68 65 63 6b 20 74 68 65 20 73 69 74 65 20 66 6f 72 20 6d 61 6c 69 63 69 6f 75 73 20 61 6e 64 20 73 70 65 61 72 2d 70 68 69 73 68 69 6e 67 20 63 6f 6e 74 65 6e 74 2e 20 4f 6e 20 74 68 69 73 20 6f 63 63 61 73 69 6f 6e 2c 20 77 65 20 63 6f 75 6c 64 6e 27 74 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 73 65 63 75 72 69 74 79 20 63 68 65 63 6b 2c 20 61 6e 64 20 63 6f 6e 73 65 71 75 65 6e 74 6c 79 20 77 65 20 63 61 6e 27 74 20 65 6e 73 75 72 65 20 74 68 65 20 73 61 66 65 74 79 20 6f 66 20 74 68 69 73 20 73 69 74 65 2e 22 2c 22 52 45 43 4f 4d 4d 45 4e 44 41 54 49 4f 4e 22 3a 22 52 65 63 6f 6d 6d 65 6e 64 61 74 69 6f 6e 3a 22 2c 22 52 45 43 4f 4d 4d 45 4e 44 41 54 49 4f 4e 5f 49 54 45 4d 5f 31 22 3a 22 43 6f 6e 74 61 63 74 20 79 6f Data Ascii: email, we check the site for malicious and spear-phishing content. On this occasion, we couldn't complete the security check, and consequently we can't ensure the safety of this site.","RECOMMENDATION":"Recommendation:","RECOMMENDATION_ITEM_1":"Contact yo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49702	170.10.132.89	443	1548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 18:18:34 UTC	437	OUT	GET /ttpwp/resources/images/mimecast-logo.png HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:34 UTC	488	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:34 GMT Content-Type: image/png Content-Length: 4228 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 21 Jan 2025 15:13:31 GMT ETag: W/"1084-194896d0578"
2025-04-28 18:18:34 UTC	1460	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 fe 00 00 00 78 08 06 00 00 00 d2 7f 4f 94 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 06 9c 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 Data Ascii: PNGIHDRxOpHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RD
2025-04-28 18:18:34 UTC	1460	IN	Data Raw: 22 2f 3e 20 3c 72 64 66 3a 6c 69 20 73 74 45 76 74 3a 61 63 74 69 6f 6e 3d 22 73 61 76 65 64 22 20 73 74 45 76 74 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 65 35 39 62 30 32 37 32 2d 39 66 38 34 2d 64 30 34 32 2d 62 36 31 30 2d 34 39 31 31 34 65 65 37 32 62 63 63 22 20 73 74 45 76 74 3a 77 68 65 6e 3d 22 32 30 32 31 2d 31 31 2d 30 32 54 31 35 3a 32 38 3a 33 31 5a 22 20 73 74 45 76 74 3a 73 6f 66 74 77 61 72 65 41 67 65 6e 74 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 30 20 28 57 69 6e 64 6f 77 73 29 22 20 73 74 45 76 74 3a 63 68 61 6e 67 65 64 3d 22 2f 22 2f 3e 20 3c 2f 72 64 66 3a 53 65 71 3e 20 3c 2f 78 6d 70 4d 4d 3a 48 69 73 74 6f 72 79 3e 20 3c 2f 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 3e 20 3c 2f 72 64 Data Ascii: "/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:e59b0272-9f84-d042-b610-49114ee72bcc" stEvt:when="2021-11-02T15:28:31Z" stEvt:softwareAgent="Adobe Photoshop 21.0 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> </rdf:Description> </rd
2025-04-28 18:18:34 UTC	1308	IN	Data Raw: db 75 d1 e4 ad b2 25 71 6c af 6d d8 76 4d cd b6 bf 90 74 3c 50 b7 fd 8b ce b7 cb 2b b6 a9 73 d1 0b 23 e2 ea 54 65 24 4d 01 df ad 59 3c 8f e2 8a ff fa 69 ef a7 3e e7 d5 11 f1 a9 54 99 83 88 88 67 81 5b 87 d8 f4 c6 f2 ba cf 91 35 cb eb ae 5f a4 8e ed 8e 88 f8 f4 10 75 19 d4 ba ba ef 57 97 c6 b6 a9 1f 11 ff 6c 58 65 b7 5e 2a d2 9d 54 47 8f aa 63 6b ea d8 f2 74 8b 32 9b 3e d3 9d 5b d6 65 ab 27 5b 94 d9 97 41 3f 4f 48 df b6 5b 37 7c 55 c6 df d8 06 bf 85 e4 6d 2f 1b 99 3e 7b 6b f6 ed df 89 65 07 f5 56 8b 59 30 a7 46 e7 65 6e f7 16 a7 1e bb f7 51 91 09 f2 60 62 d9 41 92 ae 06 ae 01 fe 08 fc a5 aa bb f7 a4 72 f0 e7 8e ba 73 f7 89 54 de 46 fc 08 f0 76 e0 75 14 cd f5 54 af cd d4 18 8d 3a 37 91 be 35 7c 72 f9 02 78 5e d2 03 14 bf 04 1e a0 b8 f8 ba 7a 94 63 04 fa e4 Data Ascii: u%qlmvMt<P+s#Te$MY<i>Tg[5_uWlXe^*TGckt2>[e'[A?OH[7\|Um/>{keVY0FenQ`bArsTFvuT:75\|rx^zc
2025-04-28 18:18:34 UTC	431	OUT	GET /ttpwp/resources/images/favicon.ico HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:34 UTC	513	IN	HTTP/1.1 200 OK Date: Mon, 28 Apr 2025 18:18:34 GMT Content-Type: image/x-icon Content-Length: 1150 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 21 Jan 2025 15:13:31 GMT ETag: W/"47e-194896d0578" Vary: Accept-Encoding
2025-04-28 18:18:34 UTC	1150	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 13 0b 00 00 13 0b 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 7c 6b 57 a2 7c 6b 57 83 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 7c 6b 57 1a 7c 6b 57 b3 7c 6b 57 f3 7c 6b 57 ea 7c 6b 57 a4 7c 6b 57 13 ff ff ff 00 7c 6b 57 83 7c 6b 57 32 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff Data Ascii: h( \|kW\|kW\|kW\|kW\|kW\|kW\|kW\|kW\|kW\|kW2
2025-04-28 18:18:44 UTC	420	OUT	GET /api/ttp/url/enroll-user HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:44 UTC	444	IN	HTTP/1.1 404 Not Found Date: Mon, 28 Apr 2025 18:18:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 180 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U" Vary: Accept-Encoding
2025-04-28 18:18:44 UTC	180	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 3e 53 6f 72 72 79 2c 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0a 3c 70 3e 57 65 20 63 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head> <title></title></head><body><h1>Error 404</h1><h2>Sorry, page not found.</h2><p>We could not find the page you requested.</p></body></html>
2025-04-28 18:18:57 UTC	420	OUT	GET /api/ttp/url/enroll-user HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:18:57 UTC	444	IN	HTTP/1.1 404 Not Found Date: Mon, 28 Apr 2025 18:18:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 180 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U" Vary: Accept-Encoding
2025-04-28 18:18:57 UTC	180	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 3e 53 6f 72 72 79 2c 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0a 3c 70 3e 57 65 20 63 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head> <title></title></head><body><h1>Error 404</h1><h2>Sorry, page not found.</h2><p>We could not find the page you requested.</p></body></html>
2025-04-28 18:19:07 UTC	420	OUT	GET /api/ttp/url/enroll-user HTTP/1.1 Host: security-us.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 18:19:07 UTC	444	IN	HTTP/1.1 404 Not Found Date: Mon, 28 Apr 2025 18:19:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 180 Connection: keep-alive x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U" Vary: Accept-Encoding
2025-04-28 18:19:07 UTC	180	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 3e 53 6f 72 72 79 2c 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0a 3c 70 3e 57 65 20 63 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head> <title></title></head><body><h1>Error 404</h1><h2>Sorry, page not found.</h2><p>We could not find the page you requested.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49704	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2025-04-28 18:18:37 UTC	309	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+xRgKUt2EEo17GM&MD=KwFEC7z6 HTTP/1.1 host: slscr.update.microsoft.com accept: / user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 accept-encoding: identity
2025-04-28 18:18:37 UTC	541	IN	HTTP/1.1 200 OK cache-control: no-cache pragma: no-cache content-type: application/octet-stream expires: -1 last-modified: Mon, 01 Jan 0001 00:00:00 GMT etag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" ms-correlationid: 71825cdc-61b6-4f63-92b8-75d1a7e73c1c ms-requestid: 7ff7fc65-bfcc-4cda-a0fe-76a96f445f25 ms-cv: m2jJtpGrP061e5Mi.0 x-microsoft-slsclientcache: 2880 content-disposition: attachment; filename=environment.cab x-content-type-options: nosniff date: Mon, 28 Apr 2025 18:18:36 GMT content-length: 24490
2025-04-28 18:18:37 UTC	1460	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2025-04-28 18:18:37 UTC	1460	IN	Data Raw: c7 c3 8f 06 b6 24 05 3c f9 2c cb e0 99 86 1a f8 03 ca b3 04 d8 16 f0 f9 32 7f 28 14 e1 08 d8 03 b6 5f ca 00 2c ca e8 4f 1f 06 4e 31 f0 2f 3c 0e 0b 50 12 26 c4 00 85 7e 42 c0 00 c8 0f fa 0d c7 c3 a0 90 23 e5 21 63 33 1e a7 e6 2a f9 c3 ee 4b 69 ce 94 9b 68 c7 7b df ba c7 eb c3 55 b3 50 05 c8 b4 a7 ea a2 5e 5e cd 3a a2 aa 75 43 4b 97 f4 bd 25 ec 55 81 8f 48 6a d4 2b fb 61 52 86 d0 3b 01 14 b0 69 f4 31 7a b6 35 59 f1 51 9b 07 06 22 e9 3b 54 1f 1c 09 53 6c 08 99 9d 74 59 32 ad 33 42 5a f5 2c 05 bf b7 e9 cf 8f 5d 2c 89 c9 8a 5f 6c 65 4c 0c 6d 6a 3f 83 6c b8 bf a3 10 39 92 ad fd bc d8 94 f7 ca 6b ef 90 4b eb 87 76 34 1d 50 f6 0b 7d 4a 62 19 4b 92 ae d4 3f 79 3c 37 e1 2d 6c bc f7 fc 95 94 bd 9c f5 56 86 da 39 b9 b3 67 4c 1a 17 d4 27 59 97 fa bb 03 e7 1b 32 9c 5f Data Ascii: $<,2(_,ON1/<P&~B#!c3*Kih{UP^^:uCK%UHj+aR;i1z5YQ";TSltY23BZ,],_leLmj?l9kKv4P}JbK?y<7-lV9gL'Y2_
2025-04-28 18:18:37 UTC	1460	IN	Data Raw: 99 5f f0 57 d3 49 7b b2 e4 e5 c0 9e f2 e2 b5 17 92 26 2b c1 a3 c2 60 60 5d 36 2c de 60 61 ea e8 98 df 55 7a a8 91 e4 a9 84 e0 3b 6e 95 89 91 fc a7 0f 95 af 35 36 d1 a7 99 9e 88 5e 1c 90 6f 76 55 35 c9 a6 7b 9c 57 31 1c 7d 98 8c a5 d0 5c 66 01 23 08 79 a0 ac fd 28 e3 66 c4 5d bc 06 ed c2 ac 2e 85 85 1d 2c f9 63 f9 ae 62 0a e0 dc fd 65 e4 07 da 27 83 27 db 54 2f 30 4f ab 57 35 d0 e3 25 bc 3a 8a 0f 18 ab 06 65 1d c3 c6 d7 dc 20 e5 92 42 df 59 3a dd 99 b4 1e 33 04 f5 9c 31 69 0f ec 13 9b b8 7c 93 51 3a 5b 90 33 78 d9 c2 f9 a0 e5 54 1d b7 41 12 7c ea 48 f9 8b 32 9d cb 22 59 19 02 65 dd 61 fc 1e b6 2d 6d 85 1b 49 c9 9e 9d a6 e3 15 82 bd e8 4e 07 0a 96 41 09 6c 7a 91 fe 23 c6 ec 81 c3 34 b3 bc bd 6d 1b a2 f9 9d 9a 55 ad 27 0b b3 da 0d 82 7c 98 8d 2d 3b d6 c6 13 Data Ascii: _WI{&+``]6,`aUz;n56^ovU5{W1}\f#y(f].,cbe''T/0OW5%:e BY:31i\|Q:[3xTA\|H2"Yea-mINAlz#4mU'\|-;
2025-04-28 18:18:37 UTC	1460	IN	Data Raw: 2d 5f d0 00 d0 07 f4 72 f6 e6 e8 44 69 fd 25 5f 10 dc 3f 70 f7 40 41 25 f8 69 80 38 20 27 0e a0 36 fd 40 ab 6d 7e e0 7e 60 1f a0 bb cd 0f 54 fd d7 fc c0 df e9 fb c7 c8 07 c3 96 47 48 09 90 7f f5 08 49 7f e5 05 82 72 c3 a4 de 98 91 55 c3 ea 10 ce a3 13 c3 f7 12 97 f6 c4 ce d7 c2 d9 28 f3 83 ce ec 99 14 4b d4 be 03 9e 48 26 e8 06 e4 1c e3 a4 41 09 dd e2 d3 84 db 86 e8 d2 f6 fb 0d f2 bb 63 cb fd 6b 48 cc 83 a9 85 16 0a 62 17 34 a2 dc b2 5c 8e 5a 11 11 25 46 bc 99 aa 15 3b c9 46 0f 5f 5e b9 9a fd a8 03 36 50 d9 0b 10 d7 86 2a ed 8c d3 6e 1f ed e9 f0 96 84 f7 3b dc 1d 9e 09 6e c5 df da 17 74 23 13 af d2 ac 85 dd 4d 74 ea 15 fd 52 cf 64 7f b7 fa f3 19 03 d1 3c 1d f9 9e 49 c6 ae 97 08 66 b1 ba 94 91 c7 2a c7 ee c7 ef 55 45 e4 5e a7 ed 2e 5d 46 59 44 0d 4b 8d 93 Data Ascii: -_rDi%_?p@A%i8 '6@m~~`TGHIrU(KH&AckHb4\Z%F;F_^6Pn;nt#MtRd<IfUE^.]FYDK
2025-04-28 18:18:37 UTC	1460	IN	Data Raw: f4 d2 5b 0d c4 46 f4 08 0d 64 b7 dd 0e 23 c4 4a be c6 2c 08 e4 15 96 43 0e 90 12 6e 83 93 e4 22 73 bf 9c 43 a3 72 7e 18 32 1c 87 83 10 55 1d 3d 13 70 78 a0 df ea 3e bc 8f 9c f3 c9 cd b2 63 9f 56 68 27 2f ce f2 f7 d1 be 1e 37 ef db 07 4d 38 19 d3 72 07 4b 21 bd e4 5a 22 2f df 9c d9 42 cd 28 ce 46 7d 02 5e c0 3a 7d 59 8f ba 2b d9 8a 6a ee ee 00 2f 1d b9 28 fd 40 78 e3 bc e0 27 36 dd fd 43 d9 6a 3e 0d 73 ca 91 ee 0f 3d a6 1a b5 25 8c d1 15 8a d7 f8 93 2e 54 ac df 56 e1 7f ed 19 54 17 27 34 90 14 e3 70 8c 6c 7f ff 7e 4f 51 14 1e 4e 05 72 47 b2 4d 89 4e f9 67 77 f4 77 a9 eb f6 50 12 1e aa 0b b0 6d 8f 25 51 7d 17 52 f8 55 b8 68 f5 90 ab 07 5f 36 1f f1 e4 1e e5 fb f3 73 97 9a e6 1d ab bb ee b9 59 5a f2 3c e8 6d 9f be 51 7b 02 c0 7d d8 d6 01 4c 12 85 7b 05 e0 5e Data Ascii: [Fd#J,Cn"sCr~2U=px>cVh'/7M8rK!Z"/B(F}^:}Y+j/(@x'6Cj>s=%.TVT'4pl~OQNrGMNgwwPm%Q}RUh_6sYZ<mQ{}L{^
2025-04-28 18:18:37 UTC	1460	IN	Data Raw: 17 7a 50 e3 3d 37 50 78 c6 9b 00 9e b1 6c 93 1f 64 fc 47 28 e5 6f 7b 2c 3f 66 9c 1b c0 91 91 7f f1 eb 59 11 28 38 61 06 ff bf 92 d0 14 5f 4d 0f e8 d9 e9 00 5a 30 6e 48 2f 23 03 13 4d 57 f0 f8 e5 8d 51 9b 88 0d f9 1d 57 58 98 cf e8 0b 8c f6 eb 9c da ff e4 4a 13 15 29 0c 69 75 94 79 e3 95 50 e5 48 e0 90 99 54 fe c5 90 26 13 97 27 85 89 ed 99 b4 32 69 b3 23 07 e3 9e fb e7 e2 e9 27 ff d9 3c 6e 78 48 c3 3d 4c b0 78 83 47 97 43 99 4b fa 65 6a 2b a5 20 16 23 d3 dd e2 46 1d 6b 79 16 e2 7b e7 3e e7 71 eb 7f c8 e3 4a 49 a0 64 7e e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 ff ab f3 b8 5d a3 0e 92 5e 1d d9 33 07 9d b4 5a 5b 1f 36 94 07 fb 31 44 46 72 24 1d af 77 ba 94 e6 6b df 96 Data Ascii: zP=7PxldG(o{,?fY(8a_MZ0nH/#MWQWXJ)iuyPHT&'2i#'<nxH=LxGCKej+ #Fky{>qJId~qqqqqqqqqqqqqqq]^3Z[61DFr$wk
2025-04-28 18:18:37 UTC	1460	IN	Data Raw: 72 61 74 69 6f 6e 73 20 50 75 65 72 74 6f 20 52 69 63 6f 31 16 30 14 06 03 55 04 05 13 0d 32 33 30 38 32 39 2b 34 35 34 32 33 37 30 1f 06 03 55 1d 23 04 18 30 16 80 14 ad 94 76 8f 83 ad 0e 03 a3 e8 3b b0 d7 34 68 d4 79 3a 7d dc 30 60 06 03 55 1d 1f 04 59 30 57 30 55 a0 53 a0 51 86 4f 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 6f 70 73 2f 63 72 6c 2f 4d 69 63 72 6f 73 6f 66 74 25 32 30 55 70 64 61 74 65 25 32 30 53 69 67 6e 69 6e 67 25 32 30 43 41 25 32 30 32 2e 31 2e 63 72 6c 30 6d 06 08 2b 06 01 05 05 07 01 01 04 61 30 5f 30 5d 06 08 2b 06 01 05 05 07 30 02 86 51 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 6f 70 73 2f 63 65 72 74 73 2f 4d 69 63 72 6f 73 6f 66 74 25 32 30 55 Data Ascii: rations Puerto Rico10U230829+4542370U#0v;4hy:}0`UY0W0USQOhttp://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl0m+a0_0]+0Qhttp://www.microsoft.com/pkiops/certs/Microsoft%20U
2025-04-28 18:18:37 UTC	1460	IN	Data Raw: 6c d5 21 c9 b8 50 68 05 c3 e4 09 c9 bd 51 c9 5f 6d 75 4f 8d 35 30 c5 8c c1 83 b2 1f 93 b5 72 6f d2 44 90 1d ed 7f 13 a9 7d 53 24 9c aa 46 c0 8f c5 c5 be bf c8 55 14 fe 87 35 fe cd d5 7e 02 d2 87 68 00 c9 b8 d7 44 cb 71 db a4 8b b3 e0 0e a6 0b ce 12 7d f6 68 dc c0 91 31 f8 59 2c 2c f5 d5 d1 2e 08 9d 2b 30 6a 6e aa ad 9e 16 4e 27 d0 ba 3b 1a 81 30 43 38 92 87 e1 6c 6f 43 3d 2d 4e 1f 0d 10 c1 f8 fa bc 84 c8 93 c3 9e 47 fc b6 fa d1 2f b6 af 39 3e 9c 3f 1c f1 4d a4 16 d3 0a e2 e7 4e f5 37 88 03 46 8e 1e cc 77 c1 47 d3 44 b7 e4 35 23 db eb 20 cb 2a f5 57 ae 2e 00 3b 6b e6 a3 6e 05 99 70 bb 76 3b d8 3c b4 76 f6 28 15 3a 25 d4 26 a4 08 9f d9 7e 7b 44 8a b7 15 8a c6 c5 78 2a 9d 32 c4 83 7b b9 6e 42 14 99 5d 49 7f 45 99 57 a7 33 77 44 1a ff 47 a3 71 b7 b0 b1 56 8a Data Ascii: l!PhQ_muO50roD}S$FU5~hDq}h1Y,,.+0jnN';0C8loC=-NG/9>?MN7FwGD5# W.;knpv;<v(:%&~{Dx2{nB]IEW3wDGqV
2025-04-28 18:18:37 UTC	1460	IN	Data Raw: 42 06 0a 2b 06 01 04 01 82 37 02 01 0c 31 34 30 32 a0 14 80 12 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 a1 1a 80 18 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 04 82 01 00 3d cd 0e 0a 7b 43 82 69 14 76 9b c2 1b 25 6c 3f 01 d0 b8 bb 6f e9 4d 62 55 f3 7a 5b c4 05 04 2e 09 48 41 fd e9 13 24 1e f0 71 f0 79 9e 8e a7 ea d7 72 49 9f 71 e8 41 4c 0a 8e 69 71 3c 8f e9 56 c5 9d a0 e6 3c df 48 88 1c cf 7f eb a0 34 f3 ff 37 ca 6d 9f c7 86 eb 12 35 0a 45 a5 81 a8 f8 53 6d c6 11 4e ef 37 77 2a 73 bf 08 f9 ee ba 8d b8 48 1a 93 32 44 3a cd 7c 41 2d e3 20 7e 34 a2 7c 2b 93 92 2f 0a 5f 17 c8 65 98 79 74 bb e7 1c 1a e2 6c a4 15 db cf ae 5b 18 f9 9a 82 ab 98 f5 13 93 f3 0f 89 71 a4 2f c0 7e Data Ascii: B+71402Microsofthttp://www.microsoft.com0H={Civ%l?oMbUz[.HA$qyrIqALiq<V<H47m5ESmN7wsH2D:\|A- ~4\|+/_eytl[q/~
2025-04-28 18:18:37 UTC	1460	IN	Data Raw: a3 82 01 1b 30 82 01 17 30 1d 06 03 55 1d 0e 04 16 04 14 ec 97 76 68 29 fe 13 4f cd 74 c6 25 18 f2 00 7c da 7d d7 a7 30 1f 06 03 55 1d 23 04 18 30 16 80 14 d5 63 3a 5c 8a 31 90 f3 43 7b 7c 46 1b c5 33 68 5a 85 6d 55 30 56 06 03 55 1d 1f 04 4f 30 4d 30 4b a0 49 a0 47 86 45 68 74 74 70 3a 2f 2f 63 72 6c 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 2f 63 72 6c 2f 70 72 6f 64 75 63 74 73 2f 4d 69 63 54 69 6d 53 74 61 50 43 41 5f 32 30 31 30 2d 30 37 2d 30 31 2e 63 72 6c 30 5a 06 08 2b 06 01 05 05 07 01 01 04 4e 30 4c 30 4a 06 08 2b 06 01 05 05 07 30 02 86 3e 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 2f 63 65 72 74 73 2f 4d 69 63 54 69 6d 53 74 61 50 43 41 5f 32 30 31 30 2d 30 37 2d 30 31 2e 63 72 74 30 0c 06 Data Ascii: 00Uvh)Ot%\|}0U#0c:\1C{\|F3hZmU0VUO0M0KIGEhttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z+N0L0J+0>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.9	49709	2.23.227.208	443

Timestamp	Bytes transferred	Direction	Data
2025-04-28 18:18:38 UTC	1460	OUT	POST /threshold/xls.aspx HTTP/1.1 host: www.bing.com origin: https://www.bing.com referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init accept: / accept-language: en-CH content-type: text/xml x-agent-deviceid: 01000A4109008071 x-bm-cbt: 1741354868 x-bm-dateformat: dd/MM/yyyy x-bm-devicedimensions: 784x984 x-bm-devicedimensionslogical: 784x984 x-bm-devicescale: 100 x-bm-dtz: 0 x-bm-market: CH x-bm-theme: 000000;0078d7 x-bm-windowsflights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12EC0B54,FX:12F0AC91,FX:12FF5D3C,FX:13083122,FX:13143E2F,FX:1318CA30,FX:1318CAEE,FX:1318CAEF,FX:1318CBED,FX:1318CBF1,FX:13214552,FX:13283A3B,FX:133A07C7,FX:133BFFE3,FX:13404069,FX:134128A5,FX:1342B470,FX:13499FAF,FX:134B0F33,FX:1355BA1D,FX:135DF0BB x-device-clientsession: A1A2AC28AE634D2FA6586B168043CEAB x-device-isoptin: false x-device-machineid: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} x-device-ossku: 48 x-device-touch: false x-deviceid: 01000A4109008071 x-msedge-externalexp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh x-msedge-externalexptype: JointCoord x-positionertype: Desktop x-search-appid: Microsoft.Windows.Cortana_cw5n1h2txyewy!
2025-04-28 18:18:38 UTC	881	OUT	Data Raw: 43 6f 72 74 61 6e 61 55 49 0d 0a 78 2d 73 65 61 72 63 68 2d 63 6f 72 74 61 6e 61 61 76 61 69 6c 61 62 6c 65 63 61 70 61 62 69 6c 69 74 69 65 73 3a 20 4e 6f 6e 65 0d 0a 78 2d 73 65 61 72 63 68 2d 73 61 66 65 73 65 61 72 63 68 3a 20 4d 6f 64 65 72 61 74 65 0d 0a 78 2d 73 65 61 72 63 68 2d 74 69 6d 65 7a 6f 6e 65 3a 20 42 69 61 73 3d 30 3b 20 53 74 61 6e 64 61 72 64 42 69 61 73 3d 30 3b 20 54 69 6d 65 5a 6f 6e 65 4b 65 79 4e 61 6d 65 3d 47 4d 54 20 53 74 61 6e 64 61 72 64 20 54 69 6d 65 0d 0a 78 2d 75 73 65 72 61 67 65 63 6c 61 73 73 3a 20 55 6e 6b 6e 6f 77 6e 0d 0a 61 63 63 65 70 74 2d 65 6e 63 6f 64 69 6e 67 3a 20 69 64 65 6e 74 69 74 79 0d 0a 75 73 65 72 2d 61 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 Data Ascii: CortanaUIx-search-cortanaavailablecapabilities: Nonex-search-safesearch: Moderatex-search-timezone: Bias=0; StandardBias=0; TimeZoneKeyName=GMT Standard Timex-userageclass: Unknownaccept-encoding: identityuser-agent: Mozilla/5.0 (Windows NT 10
2025-04-28 18:18:38 UTC	511	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 51 46 50 65 72 66 50 69 6e 67 22 2c 22 53 54 22 3a 22 Data Ascii: <ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.QFPerfPing","ST":"
2025-04-28 18:18:38 UTC	565	IN	HTTP/1.1 204 No Content access-control-allow-origin: * x-ceto-ref: 680fc67e262f413d933ce4837274925e\|AFD:680fc67e262f413d933ce4837274925e\|2025-04-28T18:18:38.780Z accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref: Ref A: 09F59F85F8914F10A6CE8FFD4CC98277 Ref B: FRAEDGE1421 Ref C: 2025-04-28T18:18:38Z date: Mon, 28 Apr 2025 18:18:38 GMT alt-svc: h3=":443"; ma=93600 x-cdn-traceid: 0.d7c41402.1745864318.adc9b783

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49716	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2025-04-28 18:19:15 UTC	309	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+xRgKUt2EEo17GM&MD=KwFEC7z6 HTTP/1.1 host: slscr.update.microsoft.com accept: / user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 accept-encoding: identity
2025-04-28 18:19:15 UTC	541	IN	HTTP/1.1 200 OK cache-control: no-cache pragma: no-cache content-type: application/octet-stream expires: -1 last-modified: Mon, 01 Jan 0001 00:00:00 GMT etag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" ms-correlationid: 2dd2296d-0d64-4f44-8050-406a434534da ms-requestid: 8000eb51-3ae0-42f3-ae61-2824cb8e8021 ms-cv: PwzMqGTydUCDNRwh.0 x-microsoft-slsclientcache: 1440 content-disposition: attachment; filename=environment.cab x-content-type-options: nosniff date: Mon, 28 Apr 2025 18:19:14 GMT content-length: 30005
2025-04-28 18:19:15 UTC	1460	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2025-04-28 18:19:15 UTC	1460	IN	Data Raw: 25 dc 93 6a 9f d2 e0 c1 ea a0 79 31 c4 ab 34 9c e1 43 a8 b3 7e 55 3a 43 6e 5b 8c bc 1c ac b5 c5 db f6 d5 6b 9a 98 b7 61 91 ec 20 ed 8b 6b 6b 17 65 25 d4 6a aa b6 ca 84 bd 36 98 48 0e 5e cd 7c b0 80 4f 8a 29 1a bd 79 0a 95 15 94 2c 8d 46 d3 90 66 2a a1 20 71 50 9b 63 14 ba 66 53 25 93 57 c9 de 70 e3 0a f9 95 e5 f6 30 46 8b 99 e7 52 08 31 34 2a fb 7b 19 1f 7d d2 b0 1d 12 db 90 d7 13 2b 94 d3 2c 24 3c da 5c c7 eb 72 6a b9 b9 58 16 5c 90 d7 e5 cd 92 95 32 0d 6b cf 04 8d 4e 78 08 6b 05 10 2b 3f 35 f1 9b 05 cf 25 b3 f8 b8 80 45 47 a6 3f 98 fb 9d 6d bb 59 60 bf 35 2a 6a 71 da 05 32 46 9c 40 06 81 a2 d0 24 13 09 4e 44 ad c8 6d e0 34 6a 19 a9 18 60 e4 00 e9 b7 1d ae 08 07 c3 31 50 c7 68 68 e8 50 28 40 75 d8 01 17 46 0a 23 66 bd 70 60 ba 6d fe d2 9a c3 39 9c fb a0 Data Ascii: %jy14C~U:Cn[ka kke%j6H^\|O)y,Ff* qPcfS%Wp0FR14{}+,$<\rjX\2kNxk+?5%EG?mY`5jq2F@$NDm4j`1PhhP(@uF#fp`m9
2025-04-28 18:19:15 UTC	1460	IN	Data Raw: 88 13 d2 ca b4 06 b4 39 d4 f9 dc 75 86 ec f8 71 28 61 7c 4c c7 63 c8 ea 15 e7 75 7d 6d 29 70 2a 71 c0 e4 ec e9 97 37 59 2c ef da 63 ae b1 f3 e5 0b 3b cf df 39 d7 39 fa 82 03 6e ce 5d df 9a 7e b1 21 8c f5 e5 b9 a1 86 fb 42 cd 8f 80 65 85 b7 9b da 6d 66 ca ea e3 34 46 3b 0d 3a b7 43 5e 3d 7a 57 67 f5 fc 5c 06 83 b4 c2 d8 63 75 21 29 ed dd c1 86 8d 5d 43 f3 49 fd 3d 76 02 f5 6a 5c 57 4b 0c 0f 16 4c dc ae 2c 6b d6 f7 77 f2 a8 5d 45 e3 67 7b 15 83 04 9a 73 32 62 e8 67 d8 7e c1 4c 27 14 66 da 01 f8 70 cc af 50 49 02 86 a1 cc 11 74 0c 24 7f 15 ad 28 be 9d 40 0c 81 9d a0 c6 02 69 80 3c 40 a6 20 29 90 04 80 7d 78 26 1e ec 70 98 20 80 f0 1b 08 60 00 70 d4 d7 e1 d0 c7 a1 d0 95 43 18 82 b8 25 55 45 8c a6 3c b1 98 db 86 78 7d 26 94 17 d0 3b 82 42 0d 40 0d 50 49 53 4a Data Ascii: 9uq(a\|Lcu}m)p*q7Y,c;99n]~!Bemf4F;:C^=zWg\cu!)]CI=vj\WKL,kw]Eg{s2bg~L'fpPIt$(@i<@ )}x&p `pC%UE<x}&;B@PISJ
2025-04-28 18:19:15 UTC	1460	IN	Data Raw: 9e 4c 48 88 5f 1b 99 a2 79 07 02 1f 96 7e 0e 91 7d ff 94 85 f8 7a 67 50 22 aa 5f 9d b1 ea a1 e7 40 3d e0 af d4 09 80 e0 46 08 01 02 dc 7c 87 51 31 df 61 b4 fc b5 f8 5f f9 9c 7e 37 d4 2e 33 2b bb ab b5 2d 61 e9 d4 86 25 79 97 ff 9e 60 01 ae e6 85 4f 0d 70 27 cb 1c ca cd c6 bb 4c ee e3 f1 e7 bd 04 1a c4 ed 5f ae e6 74 15 34 ce df 79 d8 bc c2 5b 3a 92 70 aa 60 87 34 ac 37 4f 07 1b c3 55 5a 75 15 93 ac 8f 49 e2 e4 eb 89 76 36 16 f0 83 b7 d5 bb 9f 67 2f 58 2c 57 77 4a 51 b7 7d ea c5 74 6c 12 68 7c 96 77 f7 76 81 a8 ad 31 99 b2 9b a5 fe 82 2e a8 87 5d 00 c3 8c c5 2b de 55 90 4a db 4b 20 93 f0 89 59 6d 27 da 83 c9 06 97 5b cf e2 8c 3a da b1 f1 9f 15 df ae f8 48 9f 72 16 a2 76 86 7d ce 3a 98 57 9f df 1b d0 21 92 e5 7e 21 70 a6 89 08 f9 40 7b 4f 81 e4 ad 37 f1 88 Data Ascii: LH_y~}zgP"_@=F\|Q1a_~7.3+-a%y`Op'L_t4y[:p`47OUZuIv6g/X,WwJQ}tlh\|wv1.]+UJK Ym'[:Hrv}:W!~!p@{O7
2025-04-28 18:19:15 UTC	1460	IN	Data Raw: ec 5b ba a1 ad f4 7e b4 36 22 6b 2a 3a ea b1 10 bb 5a d2 82 b3 0d ce 73 7e 0e e7 48 44 3b 1f 73 dd 54 69 30 7d cb f8 b3 28 bf 32 cd a8 91 6d 34 ad bb 0e d6 22 89 e7 eb 96 b3 8a bc 59 04 0a 5e bc 0b 94 99 3b ef f8 9c bb b7 31 08 30 50 61 9f 34 7d fc aa 6a 32 22 64 fa 76 01 58 be a6 de 25 8f 4c df ca 78 6c 2b 26 9a 9a 4a 74 8f a6 d3 ed aa 44 e2 79 8f 57 ad 97 78 47 09 43 fb f6 b2 69 ae fa ed 0e a6 c8 bc 2d 77 e5 1a be 7a c9 bf 7a 38 df 8f 7f 89 5f 71 93 cd f1 3e a1 da 7c 03 1a 34 f3 b5 5b 8e 92 80 7b dc 29 5e 24 de 2a fe 87 0a 59 f2 e5 dc f9 04 df 73 8a c3 c5 46 cd eb bd 03 6e a2 52 ca 4d 3c 42 8a 91 90 5a 49 6b 4e fc c5 eb 6a e7 27 5f d7 d9 92 eb 99 80 dd 9e 5b 65 18 f5 33 5f 86 4c f2 90 bb f6 e7 d2 ac 36 6f 13 62 f5 9b 39 9d 78 c6 6f 1e a6 9f 96 13 48 6b Data Ascii: [~6"k:Zs~HD;sTi0}(2m4"Y^;10Pa4}j2"dvX%Lxl+&JtDyWxGCi-wzz8_q>\|4[{)^$YsFnRM<BZIkNj'_[e3_L6ob9xoHk
2025-04-28 18:19:15 UTC	1460	IN	Data Raw: e0 22 b7 3c 63 7a e6 a3 86 23 e7 30 2c a5 42 31 a2 ae 1d 00 01 77 ff 02 a6 f0 eb 0b 87 ba f9 f4 b0 9c 8b e6 cf 6e 16 c7 b8 4c f1 8c b4 47 9e 54 c6 be 45 47 91 4e 78 c0 25 c3 da 17 f4 70 5a ff 27 b0 83 21 21 a0 e4 ae fa e7 11 5b d1 a2 1b 58 46 ba 4f bb ee 07 59 6e f4 ab 0a 81 03 c1 db 6d e1 39 50 02 d9 13 3a ab 49 21 bc e7 4b f7 77 6a 95 6b 49 fb ce 2e 4c aa 8c 55 4e a9 ed f2 4b ba 33 65 99 89 da 5f 69 11 cd d0 da 26 9d ba bf 75 33 7c 68 ce 52 23 f7 6e bc 71 bd c0 f4 4c 0b 5d 99 f0 e8 ca 66 97 be 7a a9 35 72 a3 de 49 98 95 65 3a c9 e6 ee 0c cd 45 69 a7 49 e7 1e fb 4f 4f 15 f7 a3 06 9f 47 bd ab 57 ad de 78 c8 98 dc 16 dc f3 dc dc 55 83 32 68 7c fe e1 8e ea 62 90 73 ac a2 96 77 af 48 45 bf 78 17 b3 09 a7 a0 ca 83 66 1e 5a d1 e5 90 4f 7e a6 0b 01 21 3a 95 a5 Data Ascii: "<cz#0,B1wnLGTEGNx%pZ'!![XFOYnm9P:I!KwjkI.LUNK3e_i&u3\|hR#nqL]fz5rIe:EiIOOGWxU2h\|bswHExfZO~!:
2025-04-28 18:19:15 UTC	1460	IN	Data Raw: 32 1b 0a 18 02 7a 78 07 ff b7 e4 2c d8 df 5c 0f 2a b6 bb 00 9c 87 d0 82 ba 63 31 84 2a c7 46 98 eb 69 7b ca ce 9c e6 4a 57 82 55 9d 16 93 e4 b5 57 d0 fa 9c 13 8a fb e0 26 aa cb 42 66 b1 8c b9 47 81 8f 78 e3 fb 48 3f d3 f1 e2 b2 3b da 37 b9 e7 72 09 2f 28 74 c5 3e 08 59 00 a5 23 c9 e2 00 24 d9 ad 9f 24 21 fe a8 3a df 1f 25 21 0e a8 2a 9b 7f 22 09 51 ff 59 12 22 01 43 82 45 51 0d 42 bf 2f 09 89 de 9f 4c c9 db 61 c0 ef 3e d3 70 fe f1 53 0b 5c 79 ac ed 1b 14 3c 55 e6 4d a6 39 95 45 ed 70 7c 08 dc 92 bb c1 42 6b e0 27 49 08 37 a7 00 02 f1 4d 12 f2 3a 2b a0 03 08 78 f1 a7 6c c7 af 6c 11 f6 71 b6 48 c2 c1 c2 15 65 9e c7 e2 24 04 13 c0 70 d4 8d da 51 c3 da c6 c2 de fc 1b fb 24 28 0d 00 1c 00 9f 0c c0 21 2d c4 2b f0 af 6b 41 16 01 24 3a 0d 80 44 c3 38 a6 05 59 7f Data Ascii: 2zx,\c1Fi{JWUW&BfGxH?;7r/(t>Y#$$!:%!*"QY"CEQB/La>pS\y<UM9Ep\|Bk'I7M:+xllqHe$pQ$(!-+kA$:D8Y
2025-04-28 18:19:15 UTC	1460	IN	Data Raw: 7c 24 f8 a0 ce fd 7a 40 64 78 d4 ba d0 e2 f2 bf a4 fc f8 e2 50 c0 60 d0 a5 93 cd 3c de 94 69 0f 58 bd 36 18 c4 18 88 b1 82 8a 48 29 e9 2a 82 cf 65 09 86 26 8b dc 0b 7d bc be 1c f4 58 aa f5 29 c8 ea 5a 78 49 52 be 34 5b fd 1e 8f 4e 87 e0 ce 85 57 93 e2 f3 cf 81 d3 11 8f a5 b2 a4 79 d3 68 e4 07 e8 4e 36 bd 4c 8d 0d 77 9b 0b de f5 6b e4 6f e1 7f cd 83 97 50 96 71 e7 35 a7 8f 91 df 93 06 62 9c c9 b1 75 aa 1e 01 c3 a0 d1 c7 1f 72 06 82 e0 58 00 02 d7 0a cd a4 eb a5 3e 5d c7 86 55 ab e9 22 f1 63 09 2d 9d 13 3e 49 38 57 5c d8 83 67 c1 75 c5 48 f3 65 71 9a a2 b0 a6 47 e8 32 13 f5 41 d5 cc 6d 22 a3 c4 bb 85 55 d2 db 8a a2 79 30 ce 1e a7 f3 90 19 ec 12 95 c4 54 46 a6 8f 96 54 04 f3 6d 0c 27 c7 22 b3 1e f0 47 da b5 bb ec 28 a7 bb 79 3e 7f 40 cc 97 48 c3 94 f8 d8 df Data Ascii: \|$z@dxP`<iX6H)*e&}X)ZxIR4[NWyhN6LwkoPq5burX>]U"c->I8W\guHeqG2Am"Uy0TFTm'"G(y>@H
2025-04-28 18:19:15 UTC	1460	IN	Data Raw: 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 a9 9d 26 b6 7a 21 ff 73 7a 7d 44 18 6d a3 7f b8 a4 78 23 38 6f 6b cd 97 ef 3f 75 99 b5 f5 2a e7 7c f9 a2 de ed d8 f1 6e 7b d7 b0 43 9c ac ff 11 e2 94 7d 61 09 b5 51 4e 0f 1b 03 13 b4 e1 92 7e 9e 6b d5 a1 e0 c3 e3 f1 92 12 81 23 1d 9e 5b 8c 83 b9 a6 f2 ce fc 34 44 06 ee 97 6a 1a ad 7a 2a 89 47 bd 67 a2 d1 1b 21 b0 95 e8 29 23 38 98 10 56 c4 12 82 e9 48 03 14 04 7f bf 70 42 b6 d9 b6 04 1b 03 9c 67 15 67 02 d2 9d 6a ae 97 5b 7d 39 7e 4d a2 c1 ac 9f 7c 54 6e 51 8b bf 3d a5 80 c1 91 a9 64 bb 20 52 b5 85 97 b4 95 50 0a 41 6e 51 f1 ca cb 97 e4 bf 2a 74 93 cf a7 ba 48 88 0c 5f 19 af 70 7d 15 f1 9f 24 d6 9c 85 c7 06 de 82 3c 2b c3 8b fc 4e 4e e9 0e fa 79 68 26 98 fa e0 d5 Data Ascii: "0H0&z!sz}Dmx#8ok?u\|n{C}aQN~k#[4DjzGg!)#8VHpBggj[}9~M\|TnQ=d RPAnQtH_p}$<+NNyh&
2025-04-28 18:19:15 UTC	1460	IN	Data Raw: 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f 66 74 20 55 70 64 61 74 65 20 53 69 67 6e 69 6e 67 20 43 41 20 32 2e 33 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ac 39 80 cb 34 50 ca 26 3f 5d 76 26 ca d3 8c c1 1d 5c eb 30 97 c6 66 86 26 a6 d5 5d 5f 4f cd 80 4c 0f 67 ec 25 0c bb 39 11 3b 6e 86 fd c7 21 27 60 fc 80 7c 01 89 ad e8 6e cd bd d0 47 5f 58 6d 00 3b 46 57 99 7d 16 b3 76 12 8b ca 9d 86 6c 1d 70 9a 69 d4 45 fe ce 72 ea ca ca 94 60 9d 7c 73 Data Ascii: 10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicrosoft Update Signing CA 2.30"0*H094P&?]v&\0f&]_OLg%9;n!'`\|nG_Xm;FW}vlpiEr`\|s

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

Target ID:	0
Start time:	14:18:20
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff721c30000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	14:18:21
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1924,i,8050775368731480592,5077760545141803960,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2012 /prefetch:3
Imagebase:	0x7ff721c30000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	14:18:27
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.us.m.mimecastprotect.com/s/7x7ICAD2XpCymA4RtG3TqX?domain=knightlaw.com"
Imagebase:	0x7ff721c30000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Source: https://security-us.m.mimecastprotect.com/ttpwp/#/enrollment?key=5092c046-e9c8-474f-b6dd-48227813a20d	HTTP Parser: No <meta name="author".. found
Source: https://security-us.m.mimecastprotect.com/ttpwp/#/enrollment?key=5092c046-e9c8-474f-b6dd-48227813a20d	HTTP Parser: No <meta name="author".. found
Source: https://security-us.m.mimecastprotect.com/ttpwp/#/enrollment?key=5092c046-e9c8-474f-b6dd-48227813a20d	HTTP Parser: No <meta name="author".. found
Source: https://security-us.m.mimecastprotect.com/ttpwp/#/enrollment?key=5092c046-e9c8-474f-b6dd-48227813a20d	HTTP Parser: No <meta name="author".. found

Source: https://security-us.m.mimecastprotect.com/ttpwp/#/enrollment?key=5092c046-e9c8-474f-b6dd-48227813a20d	HTTP Parser: No <meta name="copyright".. found
Source: https://security-us.m.mimecastprotect.com/ttpwp/#/enrollment?key=5092c046-e9c8-474f-b6dd-48227813a20d	HTTP Parser: No <meta name="copyright".. found
Source: https://security-us.m.mimecastprotect.com/ttpwp/#/enrollment?key=5092c046-e9c8-474f-b6dd-48227813a20d	HTTP Parser: No <meta name="copyright".. found
Source: https://security-us.m.mimecastprotect.com/ttpwp/#/enrollment?key=5092c046-e9c8-474f-b6dd-48227813a20d	HTTP Parser: No <meta name="copyright".. found

Source: global traffic	HTTP traffic detected: GET /r/lxdHSUknRdqT90_ZCVnHdy3p832Cw3Ei-dO0RXuhdy9OigFHoLpcQhthnfUVCbTsYqmEd97sd2Ey7hPmI1vTX9M4wT8r6q2t5uzeALmzDdReWFWbG8vTK-lRQJucJRcm63y-GYbpar4MaN4UfOICy1iIyxx3X5QTTLjrhU2cPKeej7X6Nh4jqhfiPoBaD_sG_Ao3Lov6oqrWZv1Msn0XbCxIRwPtxH_QZqUVq1_LbByoTK7hy_h9cO98moKivi4UyJlQbbGmz9MlxcVOonpqEj1hYYiwITpWtvbV6QfSYJ7AGTt9t99C8zGYNSCB5ktKIXIAzQ-YSVpitGKsi9sB7LKuaKV65Xj47BbQDceTORDEORr_SmFsjcq7_grkmWYMBBSz00ij9tWIqgGgIyWj-mKxvfY9wk1CCvbxfXkxeqxUsvoZncHYV9TVumAohWSRktiey0jntaRX5pryyR8jd0ctIkimvLUwbs6oL6Apu0QViGJ5Bs6JZvnnxxabIEvpTyEwxQpS7SbKFyKDMGpK5hlbSqQgNzpyF3D5BUq5_AVH3woYI0wYgDG0il63lrykSDsptzi9WeV7o5DXmth4W-WmX6r_lgKs0iTRMkMoW5JI3LKn1sG9xGO1E0LxJ4hugTvmd9TUUb2KqcEcE3dCiu1GTdRtXAFl5vgKIN8ZmCNa9HemotPyDiuUu36PRCqabsiFAH-THpcoJ1k5wqaovTW_n5e19WabTSw8w-ADLgnG8XJY2B9Nv9rTLrKxy5EcmPY4fjgzxE-ek77XzyVyjG73TtJMoBGieWrkWb_Gg7NRkGoJoNkJzog5jDupi_Ohp1yaHTwQJaOJUv3XwalezPlz-QBq5Ju-xEQ9FgEmTJIpusmtZd1ScyUP90tpRnPgHK--Ax67QRcLLLzfWJuhvUkKFm670l3pB5ZOgRxOKXgYF800ALf6-SDNZULi3HKwezgAzvJV6fIVBOFsZcYkTaxPXLT5z7Uh8mIrY5vuMBMs4yXcHa5EtK5CilIjZKFZouME5mu5tTbl4vI3r-hqhCwYToM9oc_qe4tuTdSTt6Jz5dgDlH79colkqMssIan0iV2dkpO950WpCiwxwFDsm1oOuK-IxRNzJPTnDqCMHMN8wa7DUiP6Vf4ATdUfADRMYP-yWrMEBrVzDP6vGSr1sFS80vftSNyO5oUn3ujTBmAgDffq3x9qDwTSRTRX6X6ANPWJrWhgSxJEjvrKc_Y5IUQ9X6jl3Ml8LftQVKmoy9Z6oMZTjgmkPISW56-E5T8M9LM3Y4TnGc728FK5ScujaofUc8nLyikYGHaed4zHzyCLw9dU1XpIxj4A5tPd6nnP6H-bN_etC1RJ1tDGzmMbzzOfpgbc9fi2mPn4xJIyhG7kCf9FKpiU1aLYiJXzlRncVeifO7DZTWLSiD1-qNFMkthuqI-M7kLBgxgyvMAuT1fiY
Source: global traffic	HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1host: www.bing.comorigin: https://www.bing.comreferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Initaccept: /accept-language: en-CHcontent-type: text/xmlx-agent-deviceid: 01000A4109008071x-bm-cbt: 1741354868x-bm-dateformat: dd/MM/yyyyx-bm-devicedimensions: 784x984x-bm-devicedimensionslogical: 784x984x-bm-devicescale: 100x-bm-dtz: 0x-bm-market: CHx-bm-theme: 000000;0078d7x-bm-windowsflights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12EC0B54,FX:12F0AC91,FX:12FF5D3C,FX:13083122,FX:13143E2F,FX:1318CA30,FX:1318CAEE,FX:1318CAEF,FX:1318CBED,FX:1318CBF1,FX:13214552,FX:13283A3B,FX:133A07C7,FX:133BFFE3,FX:13404069,FX:134128A5,FX:1342B470,FX:13499FAF,FX:134B0F33,FX:1355BA1D,FX:135DF0BBx-device-clientsession: A1A2AC28AE634D2FA6586B168043CEABx-device-isoptin: falsex-device-machineid: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}x-device-ossku: 48x-device-touch: falsex-deviceid: 01000A4109008071x-msedge-externalexp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshx-msedge-externalexptype: JointCoordx-positionertype: Desktopx-search-appid: Microsoft.Windows.Cortana_cw5n1h2txyewy!

Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.73.143
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.63
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 192.178.49.195
Source: unknown	TCP traffic detected without corresponding DNS query: 192.178.49.195
Source: unknown	TCP traffic detected without corresponding DNS query: 192.178.49.195
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 192.178.49.195
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: global traffic	HTTP traffic detected: GET /s/7x7ICAD2XpCymA4RtG3TqX?domain=knightlaw.com HTTP/1.1Host: url.us.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/lxdHSUknRdqT90_ZCVnHdy3p832Cw3Ei-dO0RXuhdy9OigFHoLpcQhthnfUVCbTsYqmEd97sd2Ey7hPmI1vTX9M4wT8r6q2t5uzeALmzDdReWFWbG8vTK-lRQJucJRcm63y-GYbpar4MaN4UfOICy1iIyxx3X5QTTLjrhU2cPKeej7X6Nh4jqhfiPoBaD_sG_Ao3Lov6oqrWZv1Msn0XbCxIRwPtxH_QZqUVq1_LbByoTK7hy_h9cO98moKivi4UyJlQbbGmz9MlxcVOonpqEj1hYYiwITpWtvbV6QfSYJ7AGTt9t99C8zGYNSCB5ktKIXIAzQ-YSVpitGKsi9sB7LKuaKV65Xj47BbQDceTORDEORr_SmFsjcq7_grkmWYMBBSz00ij9tWIqgGgIyWj-mKxvfY9wk1CCvbxfXkxeqxUsvoZncHYV9TVumAohWSRktiey0jntaRX5pryyR8jd0ctIkimvLUwbs6oL6Apu0QViGJ5Bs6JZvnnxxabIEvpTyEwxQpS7SbKFyKDMGpK5hlbSqQgNzpyF3D5BUq5_AVH3woYI0wYgDG0il63lrykSDsptzi9WeV7o5DXmth4W-WmX6r_lgKs0iTRMkMoW5JI3LKn1sG9xGO1E0LxJ4hugTvmd9TUUb2KqcEcE3dCiu1GTdRtXAFl5vgKIN8ZmCNa9HemotPyDiuUu36PRCqabsiFAH-THpcoJ1k5wqaovTW_n5e19WabTSw8w-ADLgnG8XJY2B9Nv9rTLrKxy5EcmPY4fjgzxE-ek77XzyVyjG73TtJMoBGieWrkWb_Gg7NRkGoJoNkJzog5jDupi_Ohp1yaHTwQJaOJUv3XwalezPlz-QBq5Ju-xEQ9FgEmTJIpusmtZd1ScyUP90tpRnPgHK--Ax67QRcLLLzfWJuhvUkKFm670l3pB5ZOgRxOKXgYF800ALf6-SDNZULi3HKwezgAzvJV6fIVBOFsZcYkTaxPXLT5z7Uh8mIrY5vuMBMs4yXcHa5EtK5CilIjZKFZouME5mu5tTbl4vI3r-hqhCwYToM9oc_qe4tuTdSTt6Jz5dgDlH79colkqMssIan0iV2dkpO950WpCiwxwFDsm1oOuK-IxRNzJPTnDqCMHMN8wa7DUiP6Vf4ATdUfADRMYP-yWrMEBrVzDP6vGSr1sFS80vftSNyO5oUn3ujTBmAgDffq3x9qDwTSRTRX6X6ANPWJrWhgSxJEjvrKc_Y5IUQ9X6jl3Ml8LftQVKmoy9Z6oMZTjgmkPISW56-E5T8M9LM3Y4TnGc728FK5ScujaofUc8nLyikYGHaed4zHzyCLw9dU1XpIxj4A5tPd6nnP6H-bN_etC1RJ1tDGzmMbzzOfpgbc9fi2mPn4xJIyhG7kCf9FKpiU1aLYiJXzlRncVeifO7DZTWLSiD1-qNFMkthuqI-M7kLBgxgyvMAuT1fiY
Source: global traffic	HTTP traffic detected: GET /ttpwp HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/runtime.0ecbe67b2d69cf74a815.js HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/polyfills.0ecbe67b2d69cf74a815.js HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/styles.0ecbe67b2d69cf74a815.js HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/main.0ecbe67b2d69cf74a815.js HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/languages/en.json HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-alivex-context-route: ttpwpsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, /sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/jsonsec-ch-ua-mobile: ?0Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/images/mimecast-logo.png HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2 HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-aliveOrigin: https://security-us.m.mimecastprotect.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://security-us.m.mimecastprotect.com/ttpwpAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273 HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-aliveOrigin: https://security-us.m.mimecastprotect.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://security-us.m.mimecastprotect.com/ttpwpAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/images/favicon.ico HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/languages/en.json HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/images/mimecast-logo.png HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/images/favicon.ico HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+xRgKUt2EEo17GM&MD=KwFEC7z6 HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33accept-encoding: identity
Source: global traffic	HTTP traffic detected: GET /api/ttp/url/enroll-user HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ttp/url/enroll-user HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ttp/url/enroll-user HTTP/1.1Host: security-us.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+xRgKUt2EEo17GM&MD=KwFEC7z6 HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33accept-encoding: identity
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: url.us.m.mimecastprotect.com
Source: global traffic	DNS traffic detected: DNS query: security-us.m.mimecastprotect.com

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://url.us.m.mimecastprotect.com/s/7x7ICAD2XpCymA4RtG3TqX?domain=knightlaw.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

Windows Analysis Report
https://url.us.m.mimecastprotect.com/s/7x7ICAD2XpCymA4RtG3TqX?domain=knightlaw.com