Edit tour

Windows Analysis Report
https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/index.html?phone=%201-844-324-0016

Overview

General Information

Sample URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/index.html?phone=%201-844-324-0016
Analysis ID:	1427687
Infos:

Detection

TechSupportScam

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected TechSupportScam

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5900 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2176,i,5963614580776725438,16288755853899356505,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/index.html?phone=%201-844-324-0016" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_96	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security

HTML

Source	Rule	Description	Author
0.1.pages.csv	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security
0.0.pages.csv	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security
0.3.pages.csv	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security
0.2.pages.csv	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/index.html?phone=%201-844-324-0016

SlashNext: detection malicious, Label: Scareware type: Phishing & Social Engineering

Phishing

Yara detected TechSupportScam

Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.3.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_96, type: DROPPED

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49756 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.5:49746 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49756 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /jquery-1.4.4.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?lang=en HTTP/1.1Host: ipwho.isConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://i18usgwgwrtjcshghwg.z13.web.core.windows.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?lang=en HTTP/1.1Host: ipwho.isConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: unknown

DNS traffic detected: queries for: code.jquery.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713392560879&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: chromecache_99.1.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_99.1.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_99.1.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_96.1.dr	String found in binary or memory: https://code.jquery.com/jquery-1.4.4.min.js
Source: chromecache_77.1.dr	String found in binary or memory: https://ezgif.com/optimize
Source: chromecache_96.1.dr	String found in binary or memory: https://ipwho.is/?lang=en

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.5:49746 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected TechSupportScam

Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.3.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_96, type: DROPPED

Source: classification engine

Classification label: mal56.phis.win@16/63@8/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2176,i,5963614580776725438,16288755853899356505,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/index.html?phone=%201-844-324-0016"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2176,i,5963614580776725438,16288755853899356505,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/index.html?phone=%201-844-324-0016	100%	SlashNext	Scareware type: Phishing & Social Engineering

Source	Detection	Scanner	Label	Link
https://ipwho.is/?lang=en	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
ipwho.is	15.204.213.5	true	false	unknown
code.jquery.com	151.101.66.137	true	false	high
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.48.36	true	false	unknown
www.google.com	74.125.138.103	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipwho.is/?lang=en	false	URL Reputation: safe	unknown
https://code.jquery.com/jquery-1.4.4.min.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://jquery.org/license	chromecache_99.1.dr	false	high
https://ezgif.com/optimize	chromecache_77.1.dr	false	high
http://jquery.com/	chromecache_99.1.dr	false	high
http://sizzlejs.com/	chromecache_99.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.138.103	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
15.204.213.5	ipwho.is	United States	71	HP-INTERNET-ASUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427687
Start date and time:	2024-04-18 00:22:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/index.html?phone=%201-844-324-0016
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@16/63@8/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 64.233.185.94, 172.217.215.139, 172.217.215.100, 172.217.215.102, 172.217.215.138, 172.217.215.101, 172.217.215.113, 172.217.215.84, 34.104.35.123, 52.239.221.231, 20.12.23.50, 199.232.214.172, 192.229.211.108, 20.242.39.171, 13.85.23.206, 142.250.9.94, 217.20.48.36
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/index.html?phone=%201-844-324-0016

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 21:22:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9840390050722485
Encrypted:	false
SSDEEP:	48:8PPd8jT0sgfHmidAKZdA19ehwiZUklqehAy+3:8PijPgE/y
MD5:	13B22A6E7FDD6CD24114909C1ED71B8E
SHA1:	2145303BD50DDB4A47241A0D4AAB7B67830FE300
SHA-256:	C77B208BC1770E47FD77AFDB84898ABCC94E17EAEAB09CC1989D60B1371BE8D2
SHA-512:	03CF79F0934F786514E64D8097488BA77DE7781E426A725988C432AF1193AF0D43A62F809948E5112FCCB861198FBF834C7D2F759F62EE6E6174400485256BE4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......>.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........N..,.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 21:22:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.998702433923115
Encrypted:	false
SSDEEP:	48:8id8jT0sgfHmidAKZdA1weh/iZUkAQkqehvy+2:8pjPg29Q+y
MD5:	839DF370DFED7B00F8D76C20AD05E3D9
SHA1:	A4CD98694C6A18E95E589AEFA5BF75DC3F25EA3E
SHA-256:	A173717750FA7EA363D9A45CEF136AAFD3EF25734A25DA7C4A8863D7FDA61195
SHA-512:	77323D5C44383890F86BAC3C2CF516E057EEAB43FBBBEFC0677F62D00FD9B262FDBD35C724390246A3C390C67E347A29B6CD81BB1C784A82C2F0839BF548FA02
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......0.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........N..,.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.010029491805288
Encrypted:	false
SSDEEP:	48:8xld8jT0ssHmidAKZdA14tseh7sFiZUkmgqeh7sVy+BX:8xEjPPnLy
MD5:	1C78E2F3875C8B29068FF3684B93C8CA
SHA1:	099B7C1DDA29493C471637BB00427F4BAEE8F9AD
SHA-256:	D308F1DADA1657119A43A5E0A133696EF3099D76E22AEB600FDBE850CDB42EF3
SHA-512:	493BC6C54A0D4C4077AEFC5331823E9E05C62595D89B09727B4BFB0BF5F938E15B7A981B93E2037ABF6563C36568BF6F25369AF2310796DAB2E785221C6CF845
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........N..,.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 21:22:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9949248580516463
Encrypted:	false
SSDEEP:	48:8nd8jT0sgfHmidAKZdA1vehDiZUkwqehjy+R:8qjPgdty
MD5:	4A578E66F56549155001B8AAC083FA93
SHA1:	312A769882C58797BEAA6BABE4A2B5B4FB97A45E
SHA-256:	3897E73687179DFBFD86ECBFBB89B314DE6A09A52CB0F522A942DDA6232988E9
SHA-512:	80FE3494FFEABF7B3D67930703C49CE1669258E3256480F1A36281B17667D1EAE46C5A630B2AA219DA4AA1708BAE677B7EE255DC63C943E73A250E3945CD8ACB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....kk).....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........N..,.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 21:22:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9875170215968034
Encrypted:	false
SSDEEP:	48:8Id8jT0sgfHmidAKZdA1hehBiZUk1W1qehBy+C:8zjPg99hy
MD5:	ACABC03BB450B8E6AC981BB4D4C806D7
SHA1:	9E9928D38257310746888A60BADA52BAF0B6B343
SHA-256:	D6EA25C39D553653EA802EA82BF8757FFB875253E62CF240DCF24E398683BBD8
SHA-512:	2F177BA5B7E720DA2A476B4954F8CDC447CE6665ABFFDC546F1A26F75211445B70805C933D22D41414F96ADC82041E0E2B12679D0B5B142D73A3FD886423FBFF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......7.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........N..,.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 21:22:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.998829654963778
Encrypted:	false
SSDEEP:	48:8lSd8jT0sgfHmidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8PjPgBT/TbxWOvTbLy7T
MD5:	BBB81FADFF0BC61A92A71F6590E22B5F
SHA1:	5327665DC5F11620127C581E4ED110AC5096DA9D
SHA-256:	9C28022B811894B51976078CC636C59AFED7C5580BE8DDCC7ADCD4442313DD2A
SHA-512:	C3A9473BBD21E8E502DDFF616B18778D7EFCDD30850516521F960BD7455C8AF03161B9A1D5B2E74AAC5EFC2D4F53C63313FDE43BB8E457A5A5A917F7A26062A1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........N..,.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (321), with no line terminators
Category:	downloaded
Size (bytes):	321
Entropy (8bit):	5.061856762173377
Encrypted:	false
SSDEEP:	6:haxU0H2rKRHX96TdzRHxhgR0zY2i21sasPrK5YWOpUVQddRR2p04pWCFE:hax0rKRHkhzRH/Un2i2GprK5YWOpUue+
MD5:	66E20E0E1D93AF6642714549A2080FF9
SHA1:	3403D19B3DA9AA34B8A2CA43278A9D582FCADCDB
SHA-256:	C11FE1C1D5CAD5BFF0A1F3A5BD4C18541459A4090C35C82F2F42DED2B0C11564
SHA-512:	CCBACFC26FD02A82A27A7549EAA1FD6A5029DE80B0429D2900701248EBDF374BAD34C0F64E57108C0339D27CBA21D2DC394A8F681E7297BECCD3566DC8D7FA77
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/w3.png
Preview:	<!DOCTYPE html><html><head><title>WebContentNotFound</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>RequestId : 6b7e10ad-e01e-0051-5f15-915513000000</li><li>TimeStamp : 2024-04-17T22:23:03.4116465Z</li></ul></p></body></html>

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.680136089269079
Encrypted:	false
SSDEEP:	24:7XNLWAtaN83Jfmtr2erK2fvrQbqUbFdJisxYx6qwOBZSA:7XNW2aKPSK2fvrdYbJisCMqwOp
MD5:	9CA63ACA84998195AD11AA8DFDD6917C
SHA1:	3892A01ABF5D26F56AB18C25C112807EEB281DAC
SHA-256:	FBF40F97EBEA4450C81E612BA3A54B9CE04538F15F5F5913FC569A673C62D4A9
SHA-512:	4FED1ACAA414B6A3653231B62DAE16EF45B9AFC3A17B39C85069964DDF0E9F2B8326AC9CA011E2DE131AD903EFEBF141AB4B7A061697AFF300DF293BDB85E2D9
Malicious:	false
Reputation:	low
Preview:	{. "About Us": "https:\/\/ipwhois.io",. "ip": "81.181.57.52",. "success": true,. "type": "IPv4",. "continent": "North America",. "continent_code": "NA",. "country": "United States",. "country_code": "US",. "region": "Georgia",. "region_code": "GA",. "city": "Atlanta",. "latitude": 33.7489954,. "longitude": -84.3879824,. "is_eu": false,. "postal": "30303",. "calling_code": "1",. "capital": "Washington D.C.",. "borders": "CA,MX",. "flag": {. "img": "https:\/\/cdn.ipwhois.io\/flags\/us.svg",. "emoji": "\ud83c\uddfa\ud83c\uddf8",. "emoji_unicode": "U+1F1FA U+1F1F8". },. "connection": {. "asn": 212238,. "org": "Binbox Global Services SRL",. "isp": "Datacamp Limited",. "domain": "cogentco.com". },. "timezone": {. "id": "America\/New_York",. "abbr": "EDT",. "is_dst": true,. "offset": -14400,. "utc": "-04:00",. "current_time": "2024-04-

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 100 x 100, 1-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	332
Entropy (8bit):	6.871743379185684
Encrypted:	false
SSDEEP:	6:6v/lhP8SsClmDlhK7/6TmMUnl/iIntVNqCsCja6K97kCuQKQZ99z/p7WMFbip:6v/7NLlWhE/6TmLnl/vtiC068A3/IVxs
MD5:	9D8A90A63D20F05D27E5D6ABB35E0CD0
SHA1:	5873B4007E9D55B4D891A4C427B3735ED23DBFE8
SHA-256:	7DF9F467D23EE1887EDB2123CCA10A1A9C4624CDCF7199C64E78A8430031F9F5
SHA-512:	DE64196F0A8E375DB6E4EFFF5F53AD2E77B9336D045C937C81CE1F1DED039844AB0E9F66B1599301CAF795532C9F03F0A6FD45A0117233C4BF2862419C280CC6
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/dm.png
Preview:	.PNG........IHDR...d...d.....J,......PLTE.......g......tRNS.@..f....pHYs.................IDATx^..1n. ..`#...@.r.N.U.I.9.G..22 Sp..A^U.c..O.0...e}h[..}....9.L...Q.@'..%I.a.F.X.P`....cu.oD...}.K.wP....e}.....'~..2..."...N..M.5.Ep...E>I5.".hg..6.e...)...H...l.!7.bXX.p.'..I../RI."_...K.QJiB..3x.~....z.;..#....5W.....IEND.B`.

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 800 x 455, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	25288
Entropy (8bit):	7.95276769980914
Encrypted:	false
SSDEEP:	768:Z8B3CUsd1z0SiGLJnjaj4G9xzTXg+7F97YcOt:Z8NCUm1zDi+J+zpch
MD5:	38AB4E4A2DF49047C71FF96553A3EC05
SHA1:	7CCFCDC72611E9134790E555D1FEEEE63D8C8121
SHA-256:	5E0506E9F5736D25677B197CB223B3C6DE29D52D06DA4AA9A4B2006B28D5039A
SHA-512:	63219379A95A41AFFBFF327C5162B766237F167B4B0A2754DC6B82C6F3ECD4BB06F959BA69220458EEAF5842B00DA0B45F578D2828B72AEB487B25D0FA78C3A8
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... .........pp.I...,PLTE....b..P..x.Jr.XL....y..)..(..\a..{.g.."o.%.....R.....6l.9X.kT.nP....W..D.........@.IAb.+v....5....7..z..5..%..&..h.......2..F].Fx.b].(\|....K.....6..TQ....s.x...l..2r.P..rU.(b.$..(..GI.JZ.3..W....C....Vn............................SSS...oopccc?@@///.......................R...Q#...~.....#...z......pHYs...............aBIDATx^..n.;...y...}.,).t.....a......s.c...b.P.%..(E..<u:.....t.r:..@N.3.....d....d.....?N.. 1.L~m ...m..gM\|..L\| &..K..a./..o..}....~./8..\|&s.}f ...&x&..r:..._C........k.`#.2<.....3.......@....E...r.>1.........{.f.3H........I...+.3"...\.h.h.6.:V.\|+<.....!...F\.........\|...6<.Dd....{......q...!M^].D....V./..."./..m.H....`..@XZ{PY.Z.Ze..JTq..U..g...d.Bp.A..L.H......g.r..&...L.. !i.C.P.c .t`...mx....x+.6..&6P.6.....XHd.-..P{..@ ....Q{...^[.^..5Us`.J)e..w.".....9&..+.....M<...Qa...........i.I...H...Nc.............?...m.\.fG.@J!s%J..W.+`..P.@..@....u.y].E......K .Z.....l...].0..5....2j$...9

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Audio file with ID3 version 2.3.0, contains:\012- MPEG ADTS, layer III, v2, 64 kbps, 22.05 kHz, Monaural
Category:	downloaded
Size (bytes):	200832
Entropy (8bit):	7.695958183565904
Encrypted:	false
SSDEEP:	6144:4lsFCVxSmdxiWKwHtlYMKrXFTNRp+TSAU1M:4lHVx5ihwHvYrDRhAU2
MD5:	0116152611DD51432E852781F8CC7E82
SHA1:	2408D3D281B25649894F78A4E19F7F8A8AC735F9
SHA-256:	FC59BBB18F923747B9CD3F3B23537FF09C5AD2FDFC1505A4800A3F269A234E65
SHA-512:	4378F49A8E77BA6F34DC8B0F738B1FDBFA1E686CFB60C07E83B9D76F4EAB1CCF444785FEE5B9932DA77E42FA189BB14FFCAFAC3D9C9965CBF276C2D06AA94CB0
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/jfbvd737nn.mp3:2f74e894a93ef0:0
Preview:	ID3.....ITPE1...&...IVONA Reader - Microsoft Zira DesktopTIT2.......Important SecurityTALB.......WarningCOMM...........License: UnknownTRCK.......1APIC.......image/png..IVONA Reader..PNG........IHDR...d...d.....p.T...OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1....

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 166 x 92, 4-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1270
Entropy (8bit):	6.670080953747829
Encrypted:	false
SSDEEP:	24:Y70L1hSWwjx82lY2T3wQV/duYWXN6yJ3VmhW9/G4LF3+F5daOZt2gwF:YoBNn2cQNyXHJ3L9TFuFaW2go
MD5:	05CDF1A2C2FC8F07BEA0A8F4F9356637
SHA1:	B7BBD626D1D6C832509E820CAE1D971B34F625E6
SHA-256:	AFE332157F4EFE355F3181284E99F4331C4D19703ED1678B5316D2933F95E98E
SHA-512:	D8F168BBEE250FAC06382AA8FA52B6AD72AF44C760E474BC0F3E6DA94BA1677F90B543EC582A345BD8DEC45BD1705A81DEE797E718D028E47FCFF9044D4200E6
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/pcm.png
Preview:	.PNG........IHDR.......\........;....gAMA......a.....sRGB........#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Windows)" xmpMM:InstanceID="xmp.iid:F17B94CFCABF11EBBAB7FB721269615E" xmpMM:DocumentID="xmp.did:F17B94D0CABF11EBBAB7FB721269615E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F17B94CDCABF11EBBAB7FB721269615E" stRef:documentID="xmp.did:F17B94CECABF11EBBAB7FB721269615E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..F.....tEXtSoftware.Adobe ImageReadyq.e<....PLTELiq..............nz....}&[}....tRNS.z.r.N.....IDATX.....@.E..o1.B........b..

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 31 x 30, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	168
Entropy (8bit):	5.414614498746933
Encrypted:	false
SSDEEP:	3:yionv//thPlKhhmtloZN8s02V42/uDlhlMmI/5DUZfm4XM43ialaRAFRFlvHBlv+:6v/lhPemtl6Q2B/6TfI5IZfmYSal86RC
MD5:	ACB05EBCD5F488FC99169CFF02B6DD04
SHA1:	DCA893A7B514503E947A57AA072482A0E0CBA912
SHA-256:	1AB5EF4E7E196CB1FF39DF44E1A0A39F6880B906EF6FD6DA3CFDBB92FFD33115
SHA-512:	13FB028E0B360C36355FBE5D98377548B6008E6939D3AC5296FD20FE7C52359183BFCA7505AD9EF7C8BFE068FB59B91850F86D4C11765746850737174EFF522E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............&......sRGB...,.....pHYs.................PLTE.P!............]2.....tRNS......../...!IDATx.c`..A%..`........1...@......"@M........IEND.B`.

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (503), with CRLF line terminators
Category:	downloaded
Size (bytes):	12813
Entropy (8bit):	5.275225965210271
Encrypted:	false
SSDEEP:	384:/K+GYrCNfT6nlQnJndnzcL1RcLQkcLRkcLakcLMkcLpkcLCkcLtkcLQkcLRkcLaG:gVaRUPwQnMZUPwus
MD5:	CE26B8B0A094F1A9F302B953D697991D
SHA1:	8C818F1A0B0A07F63FB3D84AF1A93D5484DAB917
SHA-256:	CC08D065767FB67D7CF06796B66DD14C2FF20250A1B16A9AA9CAF1530C0F82C7
SHA-512:	84E91C38E7B73AFC990E4669098EB3C936C30D1BA50680C8B4AD348A6D2D3E9368C97E1D7C3B9316AEDCD76A5B10F523A8BD3F1DC52AD2323EDD131CA1140891
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/asd.js
Preview:	document.getElementById('pro_box2').innerHTML = `<div class="pro_box_header">..<div class="row">...<div class="col-md-12">....<div class="minimize">.....<ul>......<li>.......<a href="#">........<img src="mnc.png" />.......</a>......</li>.....</ul>....</div>...</div>...<div class="col-md-4">....<div class="logo">.....<img src="msmm.png" />.....<span>Windows security</span>....</div>...</div>...<div class="col-md-8">....<div class="activate_lic">.....<ul>......<li>.......<a href="#">........<button>Activate the license</button>.......</a>......</li>......<li>.......<a href="#">........<img src="bel.png" />.......</a>......</li>......<li>.......<a href="#">........<img src="set.png" />.......</a>......</li>......<li>.......<a href="#">........<img.........src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAA0AAAANCAIAAAD9iXMrAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAP9JREFUeNqMUTEORUAQZbIUalESpTNoVEqJSuIKjuMUCiRKnQtoKSRCKRp0JPJf/iYbv/iJKdZ47+3smxl533fpG9d1dV03z/O6rrqum6bpOI6iKJ

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 520 x 520, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	7.104642717027869
Encrypted:	false
SSDEEP:	48:YCCiUUMR6p8vP/DjQ2aMGRXRXRXRXRXRXRXRXRXyBQ1FIyDCiiiiiiinrzMxAJl:LVUBvQfMGZZZZZZZZZLFISrQx2l
MD5:	B01A30D354BFCF51EDF33E0B0EA07402
SHA1:	C421359518D1AE258237BF501C563B7F059F8B9B
SHA-256:	B67A7C07A045D7CB0F2E216A557AEC0D99405E17C36D1A6B1FF3E2733AA35348
SHA-512:	D5424C1A03F03B72A5EE1F6F1962F07BDF9EFCEAA71299965F1EA28CD2E52AD899C1D8AE327754D5B39B355904EF7C9F26E724EA29C30B76074F87443416B3DA
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............<".Q...]PLTE.....................................................................................................tRNS..e.zQ..H^3.o....(.......7...en....IDATx.....@.D.V@...f...?.4A3..u.......c..i..*.M.c.uM...:~...........G..V....C...G.!.N.o....+J$8.\.....6..^...N.t(#..Uvp../.m ....b...q.H.jtp..b.Hpj.At.....r.]>.....}..".l.t..c.>"..i.qY..%$.4..........8X4i.B.Cs..)!.(...F..H0J8@.Q.......`.p.....$.%. .(...F..H0J8@.Q.......`.p.....$.%. .(...F..H0J8@.Q.......`.p.....$.%. .(...F..H0J8@.Q.......`.p.....$.%. .(...F..H0J8@.Q.......`...H0..$X..$....$.}......@.......A..^.............Z.......V..M.......L....L....L..&.L........L.....u...........`...L87..g.<0...&......f=0.i.L.m...~....o3...i.....}`...Lx.......L........................................................................................0..@..........M..L..L..L..L..L..L..L..L..L..L..L..L...1......b..1....AL. &x..<......b..1....AL. &x..<......b..1....AL. &x..<......b..1....AL. &x..<.....

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 140 x 30, 1-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	187
Entropy (8bit):	6.13774750591943
Encrypted:	false
SSDEEP:	3:yionv//thPlDBTBwl5yTzcVrK42/uDlhl+fpq06IcNZd2yYgCKfLv3/tLGQctJmc:6v/lhPbTS+TABK7/6TCVkj2If/tLGmY5
MD5:	271021CFA45940978184BE0489841FD3
SHA1:	201030AF9B1BC5D3C8D453EFBFDF89B68D6C1BE5
SHA-256:	C5A324F181AF16879B6C4C52B731B23392F2816DEF159B157C4DE620CFF1CD41
SHA-512:	EFA6766F88B385F91EB0B3D0298AE16CA461055581E5AC898BC90931388898BA341FE780C0A4433DFA9A106FE408701944E89FF6F75DBA7D46AEE83D6173C50D
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/mnc.png
Preview:	.PNG........IHDR..............d5....PLTEvvv.../.......pHYs................[IDAT(.....@...&....;......!8D....P@..&h./..5....e..%:.h)@.E'..st.......*..iq.5.A...w......piK.G....IEND.B`.

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text, with very long lines (324), with CRLF line terminators
Category:	downloaded
Size (bytes):	18100
Entropy (8bit):	4.8559449937955845
Encrypted:	false
SSDEEP:	192:T5pyua9kzmx5XO0CfsXLruzG61fMDOe1tFpFabFGY5xrsJoqSr2VrqODz7frYY+O:VpyusXrJm3gGCr
MD5:	61B8B80C330B89CC536FA4FC8AFB3EB5
SHA1:	F3ECEA02C164CDDC93D278B39434B224541407BC
SHA-256:	22B2C21CD86FF8E53B784C5E40608872A0666F3682D1331829EB8A643F50B3E4
SHA-512:	4770CB82FF23ED4985EB0A44C51C4439678D48691925F5B2D0861EAE60122B2BF1D9883AAD47106C49366D5249E4F9506690C665A7FD9FD2D1518051CF671927
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/12tapa.css
Preview:	.table,label {.. max-width: 100%..}.....btn:focus,.btn:hover,body {.. color: #333..}....#txtintro,.row:after {.. clear: both..}....#bottom ul,.mar_top ul,.total_detail ul,.total_detail_scan ul {.. list-style-type: none..}....#footer,#poptxt,.btn,[role=button],button {.. cursor: pointer..}....@-webkit-keyframes progress-bar-stripes {.. 0% {.. background-position: 40px 0.. }.... to {.. background-position: 0 0.. }..}....@-o-keyframes progress-bar-stripes {.. 0% {.. background-position: 40px 0.. }.... to {.. background-position: 0 0.. }..}....@keyframes progress-bar-stripes {.. 0% {.. background-position: 40px 0.. }.... to {.. background-position: 0 0.. }..}....@keyframes rotate {.. 0% {.. transform: rotate(0).. }.... to {.. transform: rotate(360deg).. }..}....@keyframes zoominoutsinglefeatured {.. 0%,to {.. transform: scale(1,1).. }.... 50% {.. tra

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 193 x 71
Category:	downloaded
Size (bytes):	14751
Entropy (8bit):	7.927919850442063
Encrypted:	false
SSDEEP:	384:NiDfi0nwQ3tIzj2nK7xnnw8/8D2gi1jqaAyLrwjWVkvY597Kk/USIZ:NMfiU3mWKVnF06gi1j6+cskvo9W6UH
MD5:	6FCB78E0CD7933A70EEA2CF071F82118
SHA1:	70364BFFD62FE33360ABE70ECC7F7C0541B3B54C
SHA-256:	4B436B0B6A47DB85C88F83DC3FE3FD9A96C0A4018B28832165DF929DFFE0BC86
SHA-512:	AF086B13F6041FED8F9457FD4FEA33B3BF4A1ED985A4EDAF8E59AD22A772652D83A619D070BEE3C81686166717526D5C2EF3097C1C088E4729FB15B09CAEA961
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/re.gif
Preview:	GIF89a..G............d....;.........z..\|...........d..{.......p`.r.m^.{.........cqa..........u......dsc.......v.rb.{....a.........s...`.........qe.{........u...b...sh.{.........v.{..pi.......u.qi....t.ph..........r...api.z..........r.oh........z.}..{....coj.......s.{....bmn.....mp.......y...`mt.{....................................................................!..NETSCAPE2.0.....!.)Optimized with https://ezgif.com/optimize.!.......,......G......I..8...`(.di.h..l.p,.tm.x..\|....pH,...r.l:..tJ.Z..v..z..xL....z.n.....w#..z[N..~.....................................m....W......i....X.........D.........G.../.....!...............F.............. .V......Kwo`9...]1....u.#......(..xQ.....#z..R...%....J&([.{YC@0..i..sb...z.<)......R..)...:..t.T.6..m.3...l..V....G[....,.j.UG..V.U...:.l.....+T0.]...&.8.....;f..1.....I ....v6.:oi"..l........K.,al.............N<x..!.......,......6......I..8...`.0ai.h..,...+.tm....\|..!.n....H[.8L:.P...Z.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 800 x 455, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	25288
Entropy (8bit):	7.95276769980914
Encrypted:	false
SSDEEP:	768:Z8B3CUsd1z0SiGLJnjaj4G9xzTXg+7F97YcOt:Z8NCUm1zDi+J+zpch
MD5:	38AB4E4A2DF49047C71FF96553A3EC05
SHA1:	7CCFCDC72611E9134790E555D1FEEEE63D8C8121
SHA-256:	5E0506E9F5736D25677B197CB223B3C6DE29D52D06DA4AA9A4B2006B28D5039A
SHA-512:	63219379A95A41AFFBFF327C5162B766237F167B4B0A2754DC6B82C6F3ECD4BB06F959BA69220458EEAF5842B00DA0B45F578D2828B72AEB487B25D0FA78C3A8
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/12bg4.png
Preview:	.PNG........IHDR... .........pp.I...,PLTE....b..P..x.Jr.XL....y..)..(..\a..{.g.."o.%.....R.....6l.9X.kT.nP....W..D.........@.IAb.+v....5....7..z..5..%..&..h.......2..F].Fx.b].(\|....K.....6..TQ....s.x...l..2r.P..rU.(b.$..(..GI.JZ.3..W....C....Vn............................SSS...oopccc?@@///.......................R...Q#...~.....#...z......pHYs...............aBIDATx^..n.;...y...}.,).t.....a......s.c...b.P.%..(E..<u:.....t.r:..@N.3.....d....d.....?N.. 1.L~m ...m..gM\|..L\| &..K..a./..o..}....~./8..\|&s.}f ...&x&..r:..._C........k.`#.2<.....3.......@....E...r.>1.........{.f.3H........I...+.3"...\.h.h.6.:V.\|+<.....!...F\.........\|...6<.Dd....{......q...!M^].D....V./..."./..m.H....`..@XZ{PY.Z.Ze..JTq..U..g...d.Bp.A..L.H......g.r..&...L.. !i.C.P.c .t`...mx....x+.6..&6P.6.....XHd.-..P{..@ ....Q{...^[.^..5Us`.J)e..w.".....9&..+.....M<...Qa...........i.I...H...Nc.............?...m.\.fG.@J!s%J..W.+`..P.@..@....u.y].E......K .Z.....l...].0..5....2j$...9

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 1-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	722
Entropy (8bit):	7.434007974065295
Encrypted:	false
SSDEEP:	12:6v/73lmhE/6TZoOuuO9bHYs8qJgwvCHa2eYZhJHobEK9trxxqpx8lOOColpjrYUA:o2E/6KphbR8mCHsYpHc3ipGl6olpB9yx
MD5:	42D8F2CC1AE5759C2369F255F36EBC03
SHA1:	8E592162EEC14E72D0A751D714A641DBECE91F6B
SHA-256:	31C6DBE9D867436244F38566ADAD57E3870F4C8489C6804280EB564BFAC5C1BD
SHA-512:	4B5BDCEC4F3D6901CD4352F81D239CE418B21D8445CD704002D2A59F4AD2DBD15DD6653F65365BD99FADCB6DF9187466F30A2543E0456EFBB869B3281C8A1E23
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................PLTE.......g......tRNS.@..f....pHYs................eIDATx^..n.0..)..:E}.......+e.p....c^IA.....Y..a.<Q.....l..(...r..^....p....3.[.uI.....w..U...#./,...a\ ."."tdmz.;ps.#u....0..Xb....R....~.....8u0..{\...eAl.z. ...>.B.4.M...e..A...`...t..(g).......@....`.g..b.Y./....,......D...~..<..M....8.Y.;\|.../c..q...@_.qO..G.....Y@..&.be...../....yN....:x..8.....<W..........e......^^ .4..V..9.......v..>......^7.~.._.O.o.@...o).....i...&........`..P.]...@.(....{.......M......;...o..P...H.9yzv8..A.....}(#@..e...[.5.Nu.0..V.#6 I..8.4-.4-.{...G.R..I...%.)....+T...L..2..lK.6.....G.rlS.m.66..ls......a.a.;.6^....Q`...'v..d...kv...h.......}....N..g..lN....IEND.B`.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1388)
Category:	downloaded
Size (bytes):	1389
Entropy (8bit):	5.224877497830799
Encrypted:	false
SSDEEP:	24:cnrtRRk8PGrWaeTg7jCK9BUQ00aKM9HQlUANQ8IvIHIM0xJVtZ4bgy5p29pz:aXPGreToTeHQlUZc0xJV3Ly5p29Z
MD5:	80D369914D99DB44AC4AA60024ADF5F8
SHA1:	74F20B735E0A88954A1A69CCC7AF4C78E4D9C494
SHA-256:	5A1BC6EE4CC04B8E259BB929BB29D87E8B7EB540F2DC67CBD3BB7DBBE57FD28F
SHA-512:	997FFA5CFF703F2DCAA8DF49A71A4F1A1DAAB877F2BCC6C02A2863AFE0189F0F322542689B24AE04725953BA769FF0091E52E5B5486B2CF2D359AFFECE73FD65
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/12script.compat.js
Preview:	!function(){"use strict";var t,a=window.location,o=window.document,r=o.getElementById("plausible"),l=r.getAttribute("data-api")\|\|(t=(t=r).src.split("/"),u=t[0],t=t[2],u+"//"+t+"/api/event");function s(t,e){t&&console.warn("Ignoring Event: "+t),e&&e.callback&&e.callback()}function e(t,e){if(/^localhost$\|^127(\.[0-9]+){0,2}\.[0-9]+$\|^\[::1?\]$/.test(a.hostname)\|\|"file:"===a.protocol)return s("localhost",e);if(window._phantom\|\|window.__nightmare\|\|window.navigator.webdriver\|\|window.Cypress)return s(null,e);try{if("true"===window.localStorage.plausible_ignore)return s("localStorage flag",e)}catch(t){}var i={},n=(i.n=t,i.u=a.href,i.d=r.getAttribute("data-domain"),i.r=o.referrer\|\|null,e&&e.meta&&(i.m=JSON.stringify(e.meta)),e&&e.props&&(i.p=e.props),new XMLHttpRequest);n.open("POST",l,!0),n.setRequestHeader("Content-Type","text/plain"),n.send(JSON.stringify(i)),n.onreadystatechange=function(){4===n.readyState&&e&&e.callback&&e.callback()}}var i=window.plausible&&window.plausible.q\|\|[];window.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2055), with no line terminators
Category:	downloaded
Size (bytes):	2055
Entropy (8bit):	5.026061101680606
Encrypted:	false
SSDEEP:	48:W/iGbnd2lcCB2/GxUH3Mu+Rh9FNGDzjJYx7u9rDTlRSg40:Y9d2ldWEEy7MDE0
MD5:	6EBCBED0DC957CD9298E2629E35A0139
SHA1:	E1603B3E92C0828DAEBD15B2DDD12C22CEED5B20
SHA-256:	73310AA233204005C5D97CCD8B6C8C06DDA83205F1DE6571AA798400FB5BEDEB
SHA-512:	4A2AC5188B3849C257C4C5497CFEE04DA591A02095EBFBCD51A37FACB4D53D956623549875E4D5F1801CBD7DB6C0DA2D6705FBF1958E794C92915FDC1F37C1D0
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/12nvidia.js
Preview:	function toggleFullScreen(e){var n=document.body;e instanceof HTMLElement&&(n=e);var t=document.webkitIsFullScreen\|\|document.mozFullScreen\|\|!1;n.requestFullScreen=n.requestFullScreen\|\|n.webkitRequestFullScreen\|\|n.mozRequestFullScreen\|\|function(){return!1},document.cancelFullScreen=document.cancelFullScreen\|\|document.webkitCancelFullScreen\|\|document.mozCancelFullScreen\|\|function(){return!1},t?document.cancelFullScreen():n.requestFullScreen()}function addEvent(e,n,t){e.addEventListener?e.addEventListener(n,t,!1):e.attachEvent&&e.attachEvent("on"+n,t)}$(document).ready(function(){var e=document.createElement("audio");e.setAttribute("src","ai2.mp3"),e.addEventListener("ended",function(){this.play()},!1),$(".map").click(function(){e.play()}),$(".black").click(function(){e.play()}),$("#footer").click(function(){e.play()}),$("#poptxt").click(function(){e.play()})}),$(document).ready(function(){$("body").mouseover(function(){$("#footer").fadeIn("").css({bottom:-20,position:"fixed"}).animate({b

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	364
Entropy (8bit):	7.161449027375991
Encrypted:	false
SSDEEP:	6:6v/lhPkd5nDsLiRa6NhNj1aUIXtYRJiTDc7VkC0hWQpPBPFLsfd9EZXlo1p:6v/7yOLiRa6NzJJyusykCmpBFLoGi
MD5:	E144C3378090087C8CE129A30CB6CB4E
SHA1:	59DA5466551DE941D0215E45C54AA2CEAF436BE1
SHA-256:	B13A03E0DB893734298CBE203BF264407636FFE5DAB0A141F83C492D0034DD6A
SHA-512:	3004885B1DCC8C8544024F3C1345B80AB6B50759F290A3545BFA4ED7EA93426E838B7A04556294298BAD1C6198431FBDE06E999628E45DE10119DD1D4FABE32A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\...E@.....TB...-n$...(....5T.7.x.=ZQ...l(n#....WL....N..rY..WY.%I..0.UU/N....\|.,K...)...mEQ,.b].p.....8.u]..<....'...ih.....8`.8.........eY..^.o=..........4M..EQ?.B...a.v...q.e..A.^.W.E.4......e.}......+.0........+......m.TI\|...3MS0.,{.wq.w.$.>\|....0.u.{........IEND.B`.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 31 x 30, 4-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	168
Entropy (8bit):	5.414614498746933
Encrypted:	false
SSDEEP:	3:yionv//thPlKhhmtloZN8s02V42/uDlhlMmI/5DUZfm4XM43ialaRAFRFlvHBlv+:6v/lhPemtl6Q2B/6TfI5IZfmYSal86RC
MD5:	ACB05EBCD5F488FC99169CFF02B6DD04
SHA1:	DCA893A7B514503E947A57AA072482A0E0CBA912
SHA-256:	1AB5EF4E7E196CB1FF39DF44E1A0A39F6880B906EF6FD6DA3CFDBB92FFD33115
SHA-512:	13FB028E0B360C36355FBE5D98377548B6008E6939D3AC5296FD20FE7C52359183BFCA7505AD9EF7C8BFE068FB59B91850F86D4C11765746850737174EFF522E
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/msmm.png
Preview:	.PNG........IHDR.............&......sRGB...,.....pHYs.................PLTE.P!............]2.....tRNS......../...!IDATx.c`..A%..`........1...@......"@M........IEND.B`.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 13 x 13, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	276
Entropy (8bit):	5.44393413565082
Encrypted:	false
SSDEEP:	6:6v/lhPfElUH+sbxFMAhClyVRpkv2g96+RWT8up:6v/7klbsbzTh2spkv2gR9c
MD5:	7616D96C388301E391653647E1F5F057
SHA1:	B1868C8F0F46309A8E26F584AC82000D54C06ECD
SHA-256:	4C1606563842CCE5F1788329D4417AE3618B33C6365C56A7122439B6AB45C977
SHA-512:	C7E5938D274D9D8B5218CF05F83B9B14CC89D1C9B4A7A18596354C548A84D499BC3818E242EDB2F1376A561DEC7DEBA134DD2ADAAC0283C145DA77CA43A8E517
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............E5.N...NPLTE...fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff=u......tRNS..zS...G...j.."...)..m.....(....[IDATx.e.I.. .C......E..n...i..T..}.....M.jDCB....,.e.<lg@.O...:K.P.5J..C.g.[...k...W.s...1.t..r....IEND.B`.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32180)
Category:	downloaded
Size (bytes):	84272
Entropy (8bit):	5.369711660456133
Encrypted:	false
SSDEEP:	1536:iP1vk7i6GUHdXXeyQazBu+4HhiO2wd0uJO1z6/A4fGAub0i4ULgGiyz4npa98Hrr:Z4UdWJiz6UAIJ8pa98Hrr
MD5:	A8325A8DDDC75EB4CD78A4C9D207AAF3
SHA1:	5A956570FBFFD26B497F38EA3A28F0BC075D5EFC
SHA-256:	46B5242C5EB6B3B71EF2606F2D0D700142AE58B53C6D018E6BF06BAB62437E1B
SHA-512:	7C18B2C845561A84E23020D9B3079E6CE9428F5BE3B784F25DA163D770D34FC12316DAD34C74F6EB256539ED00F57CC70457F242C91AA673A2A3F311111FB26E
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/12noir.js
Preview:	!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.3",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(d.apply(thi

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 140 x 30, 1-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	187
Entropy (8bit):	6.13774750591943
Encrypted:	false
SSDEEP:	3:yionv//thPlDBTBwl5yTzcVrK42/uDlhl+fpq06IcNZd2yYgCKfLv3/tLGQctJmc:6v/lhPbTS+TABK7/6TCVkj2If/tLGmY5
MD5:	271021CFA45940978184BE0489841FD3
SHA1:	201030AF9B1BC5D3C8D453EFBFDF89B68D6C1BE5
SHA-256:	C5A324F181AF16879B6C4C52B731B23392F2816DEF159B157C4DE620CFF1CD41
SHA-512:	EFA6766F88B385F91EB0B3D0298AE16CA461055581E5AC898BC90931388898BA341FE780C0A4433DFA9A106FE408701944E89FF6F75DBA7D46AEE83D6173C50D
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............d5....PLTEvvv.../.......pHYs................[IDAT(.....@...&....;......!8D....P@..&h./..5....e..%:.h)@.E'..st.......*..iq.5.A...w......piK.G....IEND.B`.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	503
Entropy (8bit):	4.806069034061486
Encrypted:	false
SSDEEP:	6:dnPaKIGCRUJACRqSYP8B8PFCZrdEGCXaAVylvTGBi1fWBCE+ZQiGTGBC/ry1TGBD:dS7SsP3CTEGCbslvTWrBCV/lBC/TBC/Q
MD5:	CD6C33FBC221D0271C910AF910E6EBED
SHA1:	9B52F24D6F10B885BB19DB1C4B531469F96D2914
SHA-256:	318698AE5E67C32550D6B40AC09848D598F6317F51A8F09638BA925F6E7CC479
SHA-512:	13D12EE60E01EC4DDE5C1BED73A607A891D5CC857A6E161034E71159BD2A352A0F4AD8EF6038CCB2B5D7F23B8899BF9BCB97AA39EAFCC6AE985CDC835E061412
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/12jupiter.js
Preview:	function addEvent(obj, evt, fn) {.. if (obj.addEventListener) {.. obj.addEventListener(evt, fn, false);.. } else if (obj.attachEvent) {.. obj.attachEvent("on" + evt, fn);.. }..}....addEvent(document, 'mouseout', function(evt) {.. if (evt.toElement == null && evt.relatedTarget == null) {.. $('.lightbox').slideDown();.. };..});....$('a.close').click(function() {.. $('.lightbox').slideUp();..});..$('body').click(function() {.. $('.lightbox').slideUp();..});..

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 100 x 100, 1-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	332
Entropy (8bit):	6.871743379185684
Encrypted:	false
SSDEEP:	6:6v/lhP8SsClmDlhK7/6TmMUnl/iIntVNqCsCja6K97kCuQKQZ99z/p7WMFbip:6v/7NLlWhE/6TmLnl/vtiC068A3/IVxs
MD5:	9D8A90A63D20F05D27E5D6ABB35E0CD0
SHA1:	5873B4007E9D55B4D891A4C427B3735ED23DBFE8
SHA-256:	7DF9F467D23EE1887EDB2123CCA10A1A9C4624CDCF7199C64E78A8430031F9F5
SHA-512:	DE64196F0A8E375DB6E4EFFF5F53AD2E77B9336D045C937C81CE1F1DED039844AB0E9F66B1599301CAF795532C9F03F0A6FD45A0117233C4BF2862419C280CC6
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...d...d.....J,......PLTE.......g......tRNS.@..f....pHYs.................IDATx^..1n. ..`#...@.r.N.U.I.9.G..22 Sp..A^U.c..O.0...e}h[..}....9.L...Q.@'..%I.a.F.X.P`....cu.oD...}.K.wP....e}.....'~..2..."...N..M.5.Ep...E>I5.".hg..6.e...)...H...l.!7.bXX.p.'..I../RI."_...K.QJiB..3x.~....z.;..#....5W.....IEND.B`.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 193 x 71
Category:	dropped
Size (bytes):	14751
Entropy (8bit):	7.927919850442063
Encrypted:	false
SSDEEP:	384:NiDfi0nwQ3tIzj2nK7xnnw8/8D2gi1jqaAyLrwjWVkvY597Kk/USIZ:NMfiU3mWKVnF06gi1j6+cskvo9W6UH
MD5:	6FCB78E0CD7933A70EEA2CF071F82118
SHA1:	70364BFFD62FE33360ABE70ECC7F7C0541B3B54C
SHA-256:	4B436B0B6A47DB85C88F83DC3FE3FD9A96C0A4018B28832165DF929DFFE0BC86
SHA-512:	AF086B13F6041FED8F9457FD4FEA33B3BF4A1ED985A4EDAF8E59AD22A772652D83A619D070BEE3C81686166717526D5C2EF3097C1C088E4729FB15B09CAEA961
Malicious:	false
Reputation:	low
Preview:	GIF89a..G............d....;.........z..\|...........d..{.......p`.r.m^.{.........cqa..........u......dsc.......v.rb.{....a.........s...`.........qe.{........u...b...sh.{.........v.{..pi.......u.qi....t.ph..........r...api.z..........r.oh........z.}..{....coj.......s.{....bmn.....mp.......y...`mt.{....................................................................!..NETSCAPE2.0.....!.)Optimized with https://ezgif.com/optimize.!.......,......G......I..8...`(.di.h..l.p,.tm.x..\|....pH,...r.l:..tJ.Z..v..z..xL....z.n.....w#..z[N..~.....................................m....W......i....X.........D.........G.../.....!...............F.............. .V......Kwo`9...]1....u.#......(..xQ.....#z..R...%....J&([.{YC@0..i..sb...z.<)......R..)...:..t.T.6..m.3...l..V....G[....,.j.UG..V.U...:.l.....+T0.]...&.8.....;f..1.....I ....v6.:oi"..l........K.,al.............N<x..!.......,......6......I..8...`.0ai.h..,...+.tm....\|..!.n....H[.8L:.P...Z.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	364
Entropy (8bit):	7.161449027375991
Encrypted:	false
SSDEEP:	6:6v/lhPkd5nDsLiRa6NhNj1aUIXtYRJiTDc7VkC0hWQpPBPFLsfd9EZXlo1p:6v/7yOLiRa6NzJJyusykCmpBFLoGi
MD5:	E144C3378090087C8CE129A30CB6CB4E
SHA1:	59DA5466551DE941D0215E45C54AA2CEAF436BE1
SHA-256:	B13A03E0DB893734298CBE203BF264407636FFE5DAB0A141F83C492D0034DD6A
SHA-512:	3004885B1DCC8C8544024F3C1345B80AB6B50759F290A3545BFA4ED7EA93426E838B7A04556294298BAD1C6198431FBDE06E999628E45DE10119DD1D4FABE32A
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/set.png
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\...E@.....TB...-n$...(....5T.7.x.=ZQ...l(n#....WL....N..rY..WY.%I..0.UU/N....\|.,K...)...mEQ,.b].p.....8.u]..<....'...ih.....8`.8.........eY..^.o=..........4M..EQ?.B...a.v...q.e..A.^.W.E.4......e.}......+.0........+......m.TI\|...3MS0.,{.wq.w.$.>\|....0.u.{........IEND.B`.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 520 x 520, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	2681
Entropy (8bit):	7.104642717027869
Encrypted:	false
SSDEEP:	48:YCCiUUMR6p8vP/DjQ2aMGRXRXRXRXRXRXRXRXRXyBQ1FIyDCiiiiiiinrzMxAJl:LVUBvQfMGZZZZZZZZZLFISrQx2l
MD5:	B01A30D354BFCF51EDF33E0B0EA07402
SHA1:	C421359518D1AE258237BF501C563B7F059F8B9B
SHA-256:	B67A7C07A045D7CB0F2E216A557AEC0D99405E17C36D1A6B1FF3E2733AA35348
SHA-512:	D5424C1A03F03B72A5EE1F6F1962F07BDF9EFCEAA71299965F1EA28CD2E52AD899C1D8AE327754D5B39B355904EF7C9F26E724EA29C30B76074F87443416B3DA
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/cs.png
Preview:	.PNG........IHDR.............<".Q...]PLTE.....................................................................................................tRNS..e.zQ..H^3.o....(.......7...en....IDATx.....@.D.V@...f...?.4A3..u.......c..i..*.M.c.uM...:~...........G..V....C...G.!.N.o....+J$8.\.....6..^...N.t(#..Uvp../.m ....b...q.H.jtp..b.Hpj.At.....r.]>.....}..".l.t..c.>"..i.qY..%$.4..........8X4i.B.Cs..)!.(...F..H0J8@.Q.......`.p.....$.%. .(...F..H0J8@.Q.......`.p.....$.%. .(...F..H0J8@.Q.......`.p.....$.%. .(...F..H0J8@.Q.......`.p.....$.%. .(...F..H0J8@.Q.......`...H0..$X..$....$.}......@.......A..^.............Z.......V..M.......L....L....L..&.L........L.....u...........`...L87..g.<0...&......f=0.i.L.m...~....o3...i.....}`...Lx.......L........................................................................................0..@..........M..L..L..L..L..L..L..L..L..L..L..L..L...1......b..1....AL. &x..<......b..1....AL. &x..<......b..1....AL. &x..<......b..1....AL. &x..<.....

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 1-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	722
Entropy (8bit):	7.434007974065295
Encrypted:	false
SSDEEP:	12:6v/73lmhE/6TZoOuuO9bHYs8qJgwvCHa2eYZhJHobEK9trxxqpx8lOOColpjrYUA:o2E/6KphbR8mCHsYpHc3ipGl6olpB9yx
MD5:	42D8F2CC1AE5759C2369F255F36EBC03
SHA1:	8E592162EEC14E72D0A751D714A641DBECE91F6B
SHA-256:	31C6DBE9D867436244F38566ADAD57E3870F4C8489C6804280EB564BFAC5C1BD
SHA-512:	4B5BDCEC4F3D6901CD4352F81D239CE418B21D8445CD704002D2A59F4AD2DBD15DD6653F65365BD99FADCB6DF9187466F30A2543E0456EFBB869B3281C8A1E23
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/vsc.png
Preview:	.PNG........IHDR....................PLTE.......g......tRNS.@..f....pHYs................eIDATx^..n.0..)..:E}.......+e.p....c^IA.....Y..a.<Q.....l..(...r..^....p....3.[.uI.....w..U...#./,...a\ ."."tdmz.;ps.#u....0..Xb....R....~.....8u0..{\...eAl.z. ...>.B.4.M...e..A...`...t..(g).......@....`.g..b.Y./....,......D...~..<..M....8.Y.;\|.../c..q...@_.qO..G.....Y@..&.be...../....yN....:x..8.....<W..........e......^^ .4..V..9.......v..>......^7.~.._.O.o.@...o).....i...&........`..P.]...@.(....{.......M......;...o..P...H.9yzv8..A.....}(#@..e...[.5.Nu.0..V.#6 I..8.4-.4-.{...G.R..I...%.)....+T...L..2..lK.6.....G.rlS.m.66..ls......a.a.;.6^....Q`...'v..d...kv...h.......}....N..g..lN....IEND.B`.

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 166 x 92, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1270
Entropy (8bit):	6.670080953747829
Encrypted:	false
SSDEEP:	24:Y70L1hSWwjx82lY2T3wQV/duYWXN6yJ3VmhW9/G4LF3+F5daOZt2gwF:YoBNn2cQNyXHJ3L9TFuFaW2go
MD5:	05CDF1A2C2FC8F07BEA0A8F4F9356637
SHA1:	B7BBD626D1D6C832509E820CAE1D971B34F625E6
SHA-256:	AFE332157F4EFE355F3181284E99F4331C4D19703ED1678B5316D2933F95E98E
SHA-512:	D8F168BBEE250FAC06382AA8FA52B6AD72AF44C760E474BC0F3E6DA94BA1677F90B543EC582A345BD8DEC45BD1705A81DEE797E718D028E47FCFF9044D4200E6
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......\........;....gAMA......a.....sRGB........#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Windows)" xmpMM:InstanceID="xmp.iid:F17B94CFCABF11EBBAB7FB721269615E" xmpMM:DocumentID="xmp.did:F17B94D0CABF11EBBAB7FB721269615E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F17B94CDCABF11EBBAB7FB721269615E" stRef:documentID="xmp.did:F17B94CECABF11EBBAB7FB721269615E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..F.....tEXtSoftware.Adobe ImageReadyq.e<....PLTELiq..............nz....}&[}....tRNS.z.r.N.....IDATX.....@.E..o1.B........b..

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (321), with no line terminators
Category:	downloaded
Size (bytes):	321
Entropy (8bit):	5.110915894832171
Encrypted:	false
SSDEEP:	6:haxU0H2rKRHX96TdzRHxhgR0zY2i21sasPrK5YWOcPypJIgbR2p04pWPcE:hax0rKRHkhzRH/Un2i2GprK5YWOgy7x/
MD5:	E135B88EFC2F02402C324D689CAA7610
SHA1:	94FBF6E9D7B814046D333790A9C92304C18CE13A
SHA-256:	4138C17BE18B19F532CB1A9E16147D67689BFC7C88207BCD0B20EDE6A6A134CA
SHA-512:	D4EDA443BF8155CF7145F10793FEE556AF28E65CA76060AB5AFD9F591AD0865439D6198C287E01E3ADAEEBBB45FF950DB27F10D1C1AB6F6EE3C1CF05C0EF69FB
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/ai2.mp3
Preview:	<!DOCTYPE html><html><head><title>WebContentNotFound</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>RequestId : 6959ff6f-801e-0078-1415-916b67000000</li><li>TimeStamp : 2024-04-17T22:23:02.5701610Z</li></ul></p></body></html>

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (321), with no line terminators
Category:	downloaded
Size (bytes):	321
Entropy (8bit):	5.061776290058229
Encrypted:	false
SSDEEP:	6:haxU0H2rKRHX96TdzRHxhgR0zY2i21sasPrK5YWOwQH+RR2p04pWRCrgE:hax0rKRHkhzRH/Un2i2GprK5YWONoeAK
MD5:	9976779095A0479592B8E52374E64D10
SHA1:	C0D3BC92C6913593F77C95E42B820209D69C86C6
SHA-256:	26F0B6E730BA71BE670D4A3E14C14EC59E454569AB138DD012EC668538A5C5D7
SHA-512:	2D9A6B6529D83EF282EF750F3081C573517008DAB1802CD7FF740DEE358B240852F60CDC8FB05CD641FBCAD6B5E0318A93DDDBF0FE58CE9594E41F596CA59ECA
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/w1.png
Preview:	<!DOCTYPE html><html><head><title>WebContentNotFound</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>RequestId : 6b7e139c-e01e-0051-1115-915513000000</li><li>TimeStamp : 2024-04-17T22:23:04.4270613Z</li></ul></p></body></html>

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1501)
Category:	downloaded
Size (bytes):	17295
Entropy (8bit):	5.439623743073583
Encrypted:	false
SSDEEP:	384:lU2vV/iJO2Oe/8/7NV/iJOQjtc2pktOTSArwtRwtOMKeabBlW7/KaDUvGtKItKDk:LdUSX4JQWYC8r1PjitfT
MD5:	052BC0DCB5622F50D1C1EB00250AF381
SHA1:	D61BE136DA9091D82D636257E85181356E59E084
SHA-256:	C692CD4EBE760C68002F1AE4E10773CE1245981304E18CD238EEAC4B58B21351
SHA-512:	2BB73512B363870487B98D030B69D2D999C1818F17D2F21399E995007446EAB4D7DA43F9E95EBAD87545D8E5CC6A6D12B3492AC53A1F3CD215DBD39F2B74E5C0
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/index.html?phone=%201-844-324-0016
Preview:	<html lang="en">..<head>...<meta charset="utf-8" />...<meta content="width=device-width,initial-scale=1" name="viewport" />...<meta content="noindex,nofollow" name="robots" />...<title>Computer Error 2V7HG0TVB</title>...<link href="msmm.png" rel="icon" id="favicon" type="image/png" />...<link href="12tapa.css" rel="stylesheet" />....<script>....const urlParams = new URLSearchParams(window.location.search);....const encodedPhoneParam = urlParams.get('phone');....const phone = encodedPhoneParam.startsWith(' ') ? '+' + encodedPhoneParam.slice(1) : encodedPhoneParam;...</script>.... End of Tawk.to Script-->...<script type="text/javascript" src="https://code.jquery.com/jquery-1.4.4.min.js"></script>...<script type="text/javascript">....//<![CDATA[....$(function () {.....$('body').bind('contextmenu', function (e) {......return false;.....});....}); // ...</script>....<script src="12noir.js"></script>...<script>....var t = new XMLHttpRequest();....t.onreadystatechange = function () {....

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 13 x 13, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	5.44393413565082
Encrypted:	false
SSDEEP:	6:6v/lhPfElUH+sbxFMAhClyVRpkv2g96+RWT8up:6v/7klbsbzTh2spkv2gR9c
MD5:	7616D96C388301E391653647E1F5F057
SHA1:	B1868C8F0F46309A8E26F584AC82000D54C06ECD
SHA-256:	4C1606563842CCE5F1788329D4417AE3618B33C6365C56A7122439B6AB45C977
SHA-512:	C7E5938D274D9D8B5218CF05F83B9B14CC89D1C9B4A7A18596354C548A84D499BC3818E242EDB2F1376A561DEC7DEBA134DD2ADAAC0283C145DA77CA43A8E517
Malicious:	false
Reputation:	low
URL:	https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/bel.png
Preview:	.PNG........IHDR.............E5.N...NPLTE...fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff=u......tRNS..zS...G...j.."...)..m.....(....[IDATx.e.I.. .C......E..n...i..T..}.....M.jDCB....,.e.<lg@.O...:K.P.5J..C.g.[...k...W.s...1.t..r....IEND.B`.

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	58
Entropy (8bit):	4.279552115444215
Encrypted:	false
SSDEEP:	3:YWQRAW6k3RAcy+yKLrSNMR4:YWQmyRqjKLrVO
MD5:	63E54B2D4991F8671CFCD27B0D0CDEE3
SHA1:	197D9BE7DCEC4C422D6A8158F5A3B597053E2F09
SHA-256:	DF55B8A88E51990519BCD5320B53ADE4CF8D9B778B267953A479F726C7036331
SHA-512:	A7AE671398DDE28766AE3079EC7055631340EF9B514F358C146EC6378CCA1FBB60D2AA20CB5D499F978216FCFF84762B505778D35F7D4C15276848B14DB43618
Malicious:	false
Reputation:	low
URL:	https://ipwho.is/?lang=en
Preview:	{"success":false,"message":"You've hit the monthly limit"}

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (820)
Category:	downloaded
Size (bytes):	78601
Entropy (8bit):	5.385907842723292
Encrypted:	false
SSDEEP:	1536:oqD4uWibfmaWWfiw7u/m9LofuENlx9TV6Z+T3VopklvQDPj10XQjdA4+9j:opzYf/t9s5vQD6X2dA4+9j
MD5:	73A9C334C5CA71D70D092B42064F6476
SHA1:	B75990598EE8D3895448ED9D08726AF63109F842
SHA-256:	517364F2D45162FB5037437B5B6CB953D00D9B2B3B79BA87D9FE57EA6EE6070C
SHA-512:	B5C7B19A6D0F05CFA33A7F54C1B8075698D922578429789FD4C0A4CE035F563857283C7062E9AB08EC61679B486971F3D83A44135E217E3167E49FADA5A1520A
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-1.4.4.min.js
Preview:	/!. jQuery JavaScript Library v1.4.4. * http://jquery.com/. . Copyright 2010, John Resig. * Dual licensed under the MIT or GPL Version 2 licenses.. * http://jquery.org/license. . Includes Sizzle.js. * http://sizzlejs.com/. * Copyright 2010, The Dojo Foundation. * Released under the MIT, BSD, and GPL Licenses.. . Date: Thu Nov 11 19:04:53 2010 -0500. */.(function(E,B){function ka(a,b,d){if(d===B&&a.nodeType===1){d=a.getAttribute("data-"+b);if(typeof d==="string"){try{d=d==="true"?true:d==="false"?false:d==="null"?null:!c.isNaN(d)?parseFloat(d):Ja.test(d)?c.parseJSON(d):d}catch(e){}c.data(a,b,d)}else d=B}return d}function U(){return false}function ca(){return true}function la(a,b,d){d[0].type=a;return c.event.handle.apply(b,d)}function Ka(a){var b,d,e,f,h,l,k,o,x,r,A,C=[];f=[];h=c.data(this,this.nodeType?"events":"__events__");if(typeof h==="function")h=.h.events;if(!(a.liveFired===this\|\|!h\|\|!h.live\|\|a.button&&a.type==="click")){if(a.namespace)A=RegExp("(^\|\\.)"+a.namespace.s

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 00:22:51.255496025 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:22:51.255877018 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:22:51.364737988 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:22:59.463231087 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.463324070 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.463476896 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.463656902 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.463682890 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.687886953 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.688154936 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.688213110 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.689393044 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.689529896 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.690846920 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.690916061 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.691013098 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.691030025 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.739129066 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.890784979 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.891362906 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.891423941 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.891477108 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.891555071 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.891694069 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.894949913 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.898029089 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.898046017 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.898089886 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.898106098 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.898161888 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.901674032 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.904855967 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.904913902 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.904927015 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.904944897 CEST	49717	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:22:59.905035973 CEST	443	49717	74.125.138.103	192.168.2.5
Apr 18, 2024 00:22:59.905119896 CEST	49717	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:22:59.905299902 CEST	49717	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:22:59.905324936 CEST	443	49717	74.125.138.103	192.168.2.5
Apr 18, 2024 00:22:59.908340931 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.908399105 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.908410072 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.912204027 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.912262917 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.912278891 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.915673971 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.915740013 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.915751934 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.919188023 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.919245958 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.919259071 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.922406912 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.922487974 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.922498941 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.925959110 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.926031113 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.926042080 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.933132887 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.933208942 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.935812950 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.935828924 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.935904026 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.936645985 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.984576941 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.995069981 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.996648073 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.996705055 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.996728897 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.996747971 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:22:59.996808052 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:22:59.999764919 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.003230095 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.003321886 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.003334999 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.006200075 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.006287098 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.006299019 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.009324074 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.009404898 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.009417057 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.011684895 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.011769056 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.011785030 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.014344931 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.014431000 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.014446020 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.017011881 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.017107010 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.017126083 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.019768953 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.019915104 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.019941092 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.035860062 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.035883904 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.035944939 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.035967112 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.036001921 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.036015987 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.036046982 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.036072969 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.036086082 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.036144972 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.040143967 CEST	49714	443	192.168.2.5	151.101.66.137
Apr 18, 2024 00:23:00.040178061 CEST	443	49714	151.101.66.137	192.168.2.5
Apr 18, 2024 00:23:00.129722118 CEST	443	49717	74.125.138.103	192.168.2.5
Apr 18, 2024 00:23:00.129951000 CEST	49717	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:23:00.129981995 CEST	443	49717	74.125.138.103	192.168.2.5
Apr 18, 2024 00:23:00.131640911 CEST	443	49717	74.125.138.103	192.168.2.5
Apr 18, 2024 00:23:00.131731987 CEST	49717	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:23:00.137669086 CEST	49717	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:23:00.137914896 CEST	443	49717	74.125.138.103	192.168.2.5
Apr 18, 2024 00:23:00.188509941 CEST	49717	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:23:00.188534975 CEST	443	49717	74.125.138.103	192.168.2.5
Apr 18, 2024 00:23:00.233669043 CEST	49717	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:23:00.516706944 CEST	49726	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:00.516763926 CEST	443	49726	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:00.516865969 CEST	49726	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:00.517126083 CEST	49726	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:00.517148972 CEST	443	49726	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:00.864762068 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:00.864824057 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:00.898964882 CEST	443	49726	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:00.899333000 CEST	49726	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:00.899354935 CEST	443	49726	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:00.900413036 CEST	443	49726	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:00.900480032 CEST	49726	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:00.902224064 CEST	49726	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:00.902292013 CEST	443	49726	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:00.902689934 CEST	49726	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:00.902704000 CEST	443	49726	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:00.956677914 CEST	49726	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:00.968147993 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:01.025625944 CEST	443	49726	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:01.025712013 CEST	443	49726	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:01.025754929 CEST	49726	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:01.108124018 CEST	49726	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:01.108150959 CEST	443	49726	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:01.372313023 CEST	49737	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:01.372344017 CEST	443	49737	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:01.372414112 CEST	49737	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:01.432794094 CEST	49737	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:01.432812929 CEST	443	49737	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:01.685317993 CEST	443	49737	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:01.685911894 CEST	49737	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:01.685925961 CEST	443	49737	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:01.690040112 CEST	443	49737	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:01.690155983 CEST	49737	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:01.691922903 CEST	49737	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:01.692132950 CEST	49737	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:01.692306995 CEST	443	49737	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:01.736159086 CEST	49737	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:01.736180067 CEST	443	49737	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:01.784145117 CEST	49737	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:01.942903996 CEST	49739	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:01.942940950 CEST	443	49739	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:01.943044901 CEST	49739	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:01.954349995 CEST	49739	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:01.954368114 CEST	443	49739	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:01.967755079 CEST	443	49737	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:01.967952967 CEST	443	49737	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:01.968010902 CEST	49737	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:02.147187948 CEST	49737	443	192.168.2.5	15.204.213.5
Apr 18, 2024 00:23:02.147228956 CEST	443	49737	15.204.213.5	192.168.2.5
Apr 18, 2024 00:23:02.175297976 CEST	443	49739	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.175376892 CEST	49739	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.186769962 CEST	49739	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.186789036 CEST	443	49739	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.187463999 CEST	443	49739	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.236227989 CEST	49739	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.334023952 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:02.334136963 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:02.371484041 CEST	49739	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.412151098 CEST	443	49739	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.477040052 CEST	443	49739	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.477195024 CEST	443	49739	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.477389097 CEST	49739	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.478126049 CEST	49739	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.478126049 CEST	49739	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.478187084 CEST	443	49739	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.478220940 CEST	443	49739	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.552901030 CEST	49746	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.552977085 CEST	443	49746	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.553061962 CEST	49746	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.553761005 CEST	49746	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.553797960 CEST	443	49746	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.772963047 CEST	443	49746	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.773058891 CEST	49746	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.823024988 CEST	49746	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.823113918 CEST	443	49746	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.824096918 CEST	443	49746	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.834178925 CEST	49746	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.876156092 CEST	443	49746	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.986529112 CEST	443	49746	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.986697912 CEST	443	49746	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.986789942 CEST	49746	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.987446070 CEST	49746	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.987497091 CEST	443	49746	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:02.987529993 CEST	49746	443	192.168.2.5	23.201.212.130
Apr 18, 2024 00:23:02.987549067 CEST	443	49746	23.201.212.130	192.168.2.5
Apr 18, 2024 00:23:10.135708094 CEST	443	49717	74.125.138.103	192.168.2.5
Apr 18, 2024 00:23:10.135859966 CEST	443	49717	74.125.138.103	192.168.2.5
Apr 18, 2024 00:23:10.135942936 CEST	49717	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:23:11.555012941 CEST	49717	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:23:11.555075884 CEST	443	49717	74.125.138.103	192.168.2.5
Apr 18, 2024 00:23:12.983983994 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:12.984133959 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:12.985737085 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:12.985816002 CEST	443	49756	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:12.985903978 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:12.986191034 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:12.986227036 CEST	443	49756	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:13.138437986 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:13.138448954 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:13.310467958 CEST	443	49756	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:13.310544968 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:14.136985064 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:14.137007952 CEST	443	49756	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:14.137442112 CEST	443	49756	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:14.137504101 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:14.138312101 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:14.138340950 CEST	443	49756	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:14.138607979 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:14.138616085 CEST	443	49756	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:14.516685009 CEST	443	49756	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:14.516933918 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:14.517601967 CEST	443	49756	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:14.517746925 CEST	443	49756	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:14.517811060 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:14.517811060 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:14.521159887 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:14.521159887 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:14.521222115 CEST	443	49756	23.1.237.91	192.168.2.5
Apr 18, 2024 00:23:14.521286964 CEST	49756	443	192.168.2.5	23.1.237.91
Apr 18, 2024 00:23:59.851488113 CEST	49761	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:23:59.851557970 CEST	443	49761	74.125.138.103	192.168.2.5
Apr 18, 2024 00:23:59.851728916 CEST	49761	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:23:59.853027105 CEST	49761	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:23:59.853060007 CEST	443	49761	74.125.138.103	192.168.2.5
Apr 18, 2024 00:24:00.073178053 CEST	443	49761	74.125.138.103	192.168.2.5
Apr 18, 2024 00:24:00.073801994 CEST	49761	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:24:00.073869944 CEST	443	49761	74.125.138.103	192.168.2.5
Apr 18, 2024 00:24:00.074357033 CEST	443	49761	74.125.138.103	192.168.2.5
Apr 18, 2024 00:24:00.074809074 CEST	49761	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:24:00.074902058 CEST	443	49761	74.125.138.103	192.168.2.5
Apr 18, 2024 00:24:00.129642963 CEST	49761	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:24:10.089937925 CEST	443	49761	74.125.138.103	192.168.2.5
Apr 18, 2024 00:24:10.090025902 CEST	443	49761	74.125.138.103	192.168.2.5
Apr 18, 2024 00:24:10.090267897 CEST	49761	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:24:12.074053049 CEST	49761	443	192.168.2.5	74.125.138.103
Apr 18, 2024 00:24:12.074114084 CEST	443	49761	74.125.138.103	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 00:22:57.208091974 CEST	53	65000	1.1.1.1	192.168.2.5
Apr 18, 2024 00:22:57.393332958 CEST	53	51826	1.1.1.1	192.168.2.5
Apr 18, 2024 00:22:58.006500006 CEST	53	63452	1.1.1.1	192.168.2.5
Apr 18, 2024 00:22:59.356205940 CEST	65439	53	192.168.2.5	1.1.1.1
Apr 18, 2024 00:22:59.356920004 CEST	57698	53	192.168.2.5	1.1.1.1
Apr 18, 2024 00:22:59.461213112 CEST	53	65439	1.1.1.1	192.168.2.5
Apr 18, 2024 00:22:59.461400032 CEST	53	57698	1.1.1.1	192.168.2.5
Apr 18, 2024 00:22:59.798512936 CEST	49918	53	192.168.2.5	1.1.1.1
Apr 18, 2024 00:22:59.799362898 CEST	65289	53	192.168.2.5	1.1.1.1
Apr 18, 2024 00:22:59.903285027 CEST	53	49918	1.1.1.1	192.168.2.5
Apr 18, 2024 00:22:59.903887987 CEST	53	65289	1.1.1.1	192.168.2.5
Apr 18, 2024 00:23:00.389174938 CEST	63102	53	192.168.2.5	1.1.1.1
Apr 18, 2024 00:23:00.389422894 CEST	62394	53	192.168.2.5	1.1.1.1
Apr 18, 2024 00:23:00.514305115 CEST	53	63102	1.1.1.1	192.168.2.5
Apr 18, 2024 00:23:00.515414953 CEST	53	62394	1.1.1.1	192.168.2.5
Apr 18, 2024 00:23:01.246999025 CEST	54966	53	192.168.2.5	1.1.1.1
Apr 18, 2024 00:23:01.247596025 CEST	65281	53	192.168.2.5	1.1.1.1
Apr 18, 2024 00:23:01.353804111 CEST	53	54966	1.1.1.1	192.168.2.5
Apr 18, 2024 00:23:01.371192932 CEST	53	65281	1.1.1.1	192.168.2.5
Apr 18, 2024 00:23:17.157053947 CEST	53	57811	1.1.1.1	192.168.2.5
Apr 18, 2024 00:23:36.606353045 CEST	53	56013	1.1.1.1	192.168.2.5
Apr 18, 2024 00:23:56.858262062 CEST	53	54530	1.1.1.1	192.168.2.5
Apr 18, 2024 00:23:59.917506933 CEST	53	52160	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 00:22:59.356205940 CEST	192.168.2.5	1.1.1.1	0x728b	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:22:59.356920004 CEST	192.168.2.5	1.1.1.1	0xc6de	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Apr 18, 2024 00:22:59.798512936 CEST	192.168.2.5	1.1.1.1	0xc44d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:22:59.799362898 CEST	192.168.2.5	1.1.1.1	0x513a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 18, 2024 00:23:00.389174938 CEST	192.168.2.5	1.1.1.1	0xd489	Standard query (0)	ipwho.is	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:23:00.389422894 CEST	192.168.2.5	1.1.1.1	0x7a5a	Standard query (0)	ipwho.is	65	IN (0x0001)	false
Apr 18, 2024 00:23:01.246999025 CEST	192.168.2.5	1.1.1.1	0xf42a	Standard query (0)	ipwho.is	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:23:01.247596025 CEST	192.168.2.5	1.1.1.1	0xad8	Standard query (0)	ipwho.is	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 00:22:59.461213112 CEST	1.1.1.1	192.168.2.5	0x728b	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:22:59.461213112 CEST	1.1.1.1	192.168.2.5	0x728b	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:22:59.461213112 CEST	1.1.1.1	192.168.2.5	0x728b	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:22:59.461213112 CEST	1.1.1.1	192.168.2.5	0x728b	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:22:59.903285027 CEST	1.1.1.1	192.168.2.5	0xc44d	No error (0)	www.google.com		74.125.138.103	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:22:59.903285027 CEST	1.1.1.1	192.168.2.5	0xc44d	No error (0)	www.google.com		74.125.138.104	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:22:59.903285027 CEST	1.1.1.1	192.168.2.5	0xc44d	No error (0)	www.google.com		74.125.138.147	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:22:59.903285027 CEST	1.1.1.1	192.168.2.5	0xc44d	No error (0)	www.google.com		74.125.138.99	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:22:59.903285027 CEST	1.1.1.1	192.168.2.5	0xc44d	No error (0)	www.google.com		74.125.138.105	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:22:59.903285027 CEST	1.1.1.1	192.168.2.5	0xc44d	No error (0)	www.google.com		74.125.138.106	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:22:59.903887987 CEST	1.1.1.1	192.168.2.5	0x513a	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 18, 2024 00:23:00.514305115 CEST	1.1.1.1	192.168.2.5	0xd489	No error (0)	ipwho.is		15.204.213.5	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:23:01.353804111 CEST	1.1.1.1	192.168.2.5	0xf42a	No error (0)	ipwho.is		15.204.213.5	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:23:12.600589991 CEST	1.1.1.1	192.168.2.5	0x11b9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:23:12.600589991 CEST	1.1.1.1	192.168.2.5	0x11b9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:23:12.738262892 CEST	1.1.1.1	192.168.2.5	0x5c4a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 00:23:12.738262892 CEST	1.1.1.1	192.168.2.5	0x5c4a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:23:26.474340916 CEST	1.1.1.1	192.168.2.5	0x186e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 00:23:26.474340916 CEST	1.1.1.1	192.168.2.5	0x186e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:23:52.222049952 CEST	1.1.1.1	192.168.2.5	0x1976	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 00:23:52.222049952 CEST	1.1.1.1	192.168.2.5	0x1976	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:24:09.870126009 CEST	1.1.1.1	192.168.2.5	0xe1e1	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 00:24:09.870126009 CEST	1.1.1.1	192.168.2.5	0xe1e1	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:24:13.342103958 CEST	1.1.1.1	192.168.2.5	0xc7d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.48.36	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:24:13.342103958 CEST	1.1.1.1	192.168.2.5	0xc7d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.50.25	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:24:13.342103958 CEST	1.1.1.1	192.168.2.5	0xc7d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.53.36	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:24:13.342103958 CEST	1.1.1.1	192.168.2.5	0xc7d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.63.34	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:24:13.342103958 CEST	1.1.1.1	192.168.2.5	0xc7d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.50.19	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:24:13.342103958 CEST	1.1.1.1	192.168.2.5	0xc7d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.53.35	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:24:13.342103958 CEST	1.1.1.1	192.168.2.5	0xc7d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.50.34	A (IP address)	IN (0x0001)	false
Apr 18, 2024 00:24:13.342103958 CEST	1.1.1.1	192.168.2.5	0xc7d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.51.41	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

code.jquery.com

ipwho.is

www.bing.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	151.101.66.137	443	7120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 22:22:59 UTC	562	OUT	GET /jquery-1.4.4.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-17 22:22:59 UTC	567	IN	HTTP/1.1 200 OK Connection: close Content-Length: 78601 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-13309" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 1030157 Date: Wed, 17 Apr 2024 22:22:59 GMT X-Served-By: cache-lga21980-LGA, cache-pdk-kpdk1780097-PDK X-Cache: HIT, HIT X-Cache-Hits: 29, 0 X-Timer: S1713392580.828510,VS0,VE1 Vary: Accept-Encoding
2024-04-17 22:22:59 UTC	1378	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 31 2e 34 2e 34 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 30 2c 20 4a 6f 68 6e 20 52 65 73 69 67 0a 20 2a 20 44 75 61 6c 20 6c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6f 72 20 47 50 4c 20 56 65 72 73 69 6f 6e 20 32 20 6c 69 63 65 6e 73 65 73 2e 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 49 6e 63 6c 75 64 65 73 20 53 69 7a 7a 6c 65 2e 6a 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 30 2c 20 54 68 65 20 44 Data Ascii: /! jQuery JavaScript Library v1.4.4 * http://jquery.com/ * * Copyright 2010, John Resig * Dual licensed under the MIT or GPL Version 2 licenses. * http://jquery.org/license * * Includes Sizzle.js * http://sizzlejs.com/ * Copyright 2010, The D
2024-04-17 22:22:59 UTC	1378	IN	Data Raw: 75 73 65 65 6e 74 65 72 22 7c 7c 0a 68 2e 70 72 65 54 79 70 65 3d 3d 3d 22 6d 6f 75 73 65 6c 65 61 76 65 22 29 7b 61 2e 74 79 70 65 3d 68 2e 70 72 65 54 79 70 65 3b 65 3d 63 28 61 2e 72 65 6c 61 74 65 64 54 61 72 67 65 74 29 2e 63 6c 6f 73 65 73 74 28 68 2e 73 65 6c 65 63 74 6f 72 29 5b 30 5d 7d 69 66 28 21 65 7c 7c 65 21 3d 3d 6c 29 43 2e 70 75 73 68 28 7b 65 6c 65 6d 3a 6c 2c 68 61 6e 64 6c 65 4f 62 6a 3a 68 2c 6c 65 76 65 6c 3a 72 2e 6c 65 76 65 6c 7d 29 7d 7d 7d 6f 3d 30 3b 66 6f 72 28 78 3d 43 2e 6c 65 6e 67 74 68 3b 6f 3c 78 3b 6f 2b 2b 29 7b 66 3d 43 5b 6f 5d 3b 69 66 28 64 26 26 66 2e 6c 65 76 65 6c 3e 64 29 62 72 65 61 6b 3b 61 2e 63 75 72 72 65 6e 74 54 61 72 67 65 74 3d 66 2e 65 6c 65 6d 3b 61 2e 64 61 74 61 3d 66 2e 68 61 6e 64 6c 65 4f 62 6a Data Ascii: useenter"\|\|h.preType==="mouseleave"){a.type=h.preType;e=c(a.relatedTarget).closest(h.selector)[0]}if(!e\|\|e!==l)C.push({elem:l,handleObj:h,level:r.level})}}}o=0;for(x=C.length;o<x;o++){f=C[o];if(d&&f.level>d)break;a.currentTarget=f.elem;a.data=f.handleObj
2024-04-17 22:22:59 UTC	1378	IN	Data Raw: 68 74 3b 69 66 28 64 3d 3d 3d 22 62 6f 72 64 65 72 22 29 72 65 74 75 72 6e 20 65 3b 63 2e 65 61 63 68 28 62 3d 3d 3d 22 77 69 64 74 68 22 3f 50 61 3a 51 61 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 64 7c 7c 28 65 2d 3d 70 61 72 73 65 46 6c 6f 61 74 28 63 2e 63 73 73 28 61 2c 22 70 61 64 64 69 6e 67 22 2b 74 68 69 73 29 29 7c 7c 30 29 3b 69 66 28 64 3d 3d 3d 22 6d 61 72 67 69 6e 22 29 65 2b 3d 70 61 72 73 65 46 6c 6f 61 74 28 63 2e 63 73 73 28 61 2c 0a 22 6d 61 72 67 69 6e 22 2b 74 68 69 73 29 29 7c 7c 30 3b 65 6c 73 65 20 65 2d 3d 70 61 72 73 65 46 6c 6f 61 74 28 63 2e 63 73 73 28 61 2c 22 62 6f 72 64 65 72 22 2b 74 68 69 73 2b 22 57 69 64 74 68 22 29 29 7c 7c 30 7d 29 3b 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 64 61 28 61 2c 62 2c 64 2c 65 29 7b Data Ascii: ht;if(d==="border")return e;c.each(b==="width"?Pa:Qa,function(){d\|\|(e-=parseFloat(c.css(a,"padding"+this))\|\|0);if(d==="margin")e+=parseFloat(c.css(a,"margin"+this))\|\|0;else e-=parseFloat(c.css(a,"border"+this+"Width"))\|\|0});return e}function da(a,b,d,e){
2024-04-17 22:22:59 UTC	1378	IN	Data Raw: 5c 77 2e 5d 2b 29 2f 2c 69 3d 2f 28 6d 73 69 65 29 20 28 5b 5c 77 2e 5d 2b 29 2f 2c 6e 3d 2f 28 6d 6f 7a 69 6c 6c 61 29 28 3f 3a 2e 2a 3f 20 72 76 3a 28 5b 5c 77 2e 5d 2b 29 29 3f 2f 2c 6d 3d 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2c 70 3d 66 61 6c 73 65 2c 71 3d 5b 5d 2c 75 2c 79 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2c 46 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 4d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 70 75 73 68 2c 4e 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2c 4f 3d 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 74 72 69 6d 2c 44 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 64 65 78 Data Ascii: \w.]+)/,i=/(msie) ([\w.]+)/,n=/(mozilla)(?:.*? rv:([\w.]+))?/,m=navigator.userAgent,p=false,q=[],u,y=Object.prototype.toString,F=Object.prototype.hasOwnProperty,M=Array.prototype.push,N=Array.prototype.slice,O=String.prototype.trim,D=Array.prototype.index
2024-04-17 22:22:59 UTC	1378	IN	Data Raw: 68 69 73 2c 30 29 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 6a 29 7b 72 65 74 75 72 6e 20 6a 3d 3d 6e 75 6c 6c 3f 74 68 69 73 2e 74 6f 41 72 72 61 79 28 29 3a 6a 3c 30 3f 74 68 69 73 2e 73 6c 69 63 65 28 6a 29 5b 30 5d 3a 74 68 69 73 5b 6a 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 6a 2c 73 2c 76 29 7b 76 61 72 20 7a 3d 62 28 29 3b 62 2e 69 73 41 72 72 61 79 28 6a 29 3f 4d 2e 61 70 70 6c 79 28 7a 2c 6a 29 3a 62 2e 6d 65 72 67 65 28 7a 2c 6a 29 3b 7a 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 3b 7a 2e 63 6f 6e 74 65 78 74 3d 74 68 69 73 2e 63 6f 6e 74 65 78 74 3b 69 66 28 73 3d 3d 3d 22 66 69 6e 64 22 29 7a 2e 73 65 6c 65 63 74 6f 72 3d 74 68 69 73 2e 73 65 6c 65 63 74 6f 72 2b 28 74 68 69 73 2e 73 65 6c 65 63 74 6f 72 3f 22 Data Ascii: his,0)},get:function(j){return j==null?this.toArray():j<0?this.slice(j)[0]:this[j]},pushStack:function(j,s,v){var z=b();b.isArray(j)?M.apply(z,j):b.merge(z,j);z.prevObject=this;z.context=this.context;if(s==="find")z.selector=this.selector+(this.selector?"
2024-04-17 22:22:59 UTC	1378	IN	Data Raw: 74 3a 66 75 6e 63 74 69 6f 6e 28 6a 29 7b 45 2e 24 3d 65 3b 69 66 28 6a 29 45 2e 6a 51 75 65 72 79 3d 64 3b 72 65 74 75 72 6e 20 62 7d 2c 69 73 52 65 61 64 79 3a 66 61 6c 73 65 2c 72 65 61 64 79 57 61 69 74 3a 31 2c 72 65 61 64 79 3a 66 75 6e 63 74 69 6f 6e 28 6a 29 7b 6a 3d 3d 3d 74 72 75 65 26 26 62 2e 72 65 61 64 79 57 61 69 74 2d 2d 3b 0a 69 66 28 21 62 2e 72 65 61 64 79 57 61 69 74 7c 7c 6a 21 3d 3d 74 72 75 65 26 26 21 62 2e 69 73 52 65 61 64 79 29 7b 69 66 28 21 74 2e 62 6f 64 79 29 72 65 74 75 72 6e 20 73 65 74 54 69 6d 65 6f 75 74 28 62 2e 72 65 61 64 79 2c 31 29 3b 62 2e 69 73 52 65 61 64 79 3d 74 72 75 65 3b 69 66 28 21 28 6a 21 3d 3d 74 72 75 65 26 26 2d 2d 62 2e 72 65 61 64 79 57 61 69 74 3e 30 29 29 69 66 28 71 29 7b 76 61 72 20 73 3d 30 2c Data Ascii: t:function(j){E.$=e;if(j)E.jQuery=d;return b},isReady:false,readyWait:1,ready:function(j){j===true&&b.readyWait--;if(!b.readyWait\|\|j!==true&&!b.isReady){if(!t.body)return setTimeout(b.ready,1);b.isReady=true;if(!(j!==true&&--b.readyWait>0))if(q){var s=0,
2024-04-17 22:22:59 UTC	1378	IN	Data Raw: 3b 7d 2c 70 61 72 73 65 4a 53 4f 4e 3a 66 75 6e 63 74 69 6f 6e 28 6a 29 7b 69 66 28 74 79 70 65 6f 66 20 6a 21 3d 3d 22 73 74 72 69 6e 67 22 7c 7c 21 6a 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 6a 3d 62 2e 74 72 69 6d 28 6a 29 3b 69 66 28 43 2e 74 65 73 74 28 6a 2e 72 65 70 6c 61 63 65 28 4a 2c 22 40 22 29 2e 72 65 70 6c 61 63 65 28 77 2c 22 5d 22 29 2e 72 65 70 6c 61 63 65 28 49 2c 22 22 29 29 29 72 65 74 75 72 6e 20 45 2e 4a 53 4f 4e 26 26 45 2e 4a 53 4f 4e 2e 70 61 72 73 65 3f 45 2e 4a 53 4f 4e 2e 70 61 72 73 65 28 6a 29 3a 28 6e 65 77 20 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 22 2b 6a 29 29 28 29 3b 65 6c 73 65 20 62 2e 65 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 4a 53 4f 4e 3a 20 22 2b 6a 29 7d 2c 6e 6f 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 Data Ascii: ;},parseJSON:function(j){if(typeof j!=="string"\|\|!j)return null;j=b.trim(j);if(C.test(j.replace(J,"@").replace(w,"]").replace(I,"")))return E.JSON&&E.JSON.parse?E.JSON.parse(j):(new Function("return "+j))();else b.error("Invalid JSON: "+j)},noop:function(
2024-04-17 22:22:59 UTC	1378	IN	Data Raw: 2e 6c 65 6e 67 74 68 3d 3d 3d 22 6e 75 6d 62 65 72 22 29 66 6f 72 28 76 61 72 20 48 3d 73 2e 6c 65 6e 67 74 68 3b 7a 3c 48 3b 7a 2b 2b 29 6a 5b 76 2b 2b 5d 3d 73 5b 7a 5d 3b 65 6c 73 65 20 66 6f 72 28 3b 73 5b 7a 5d 21 3d 3d 42 3b 29 6a 5b 76 2b 2b 5d 3d 73 5b 7a 2b 2b 5d 3b 6a 2e 6c 65 6e 67 74 68 3d 76 3b 72 65 74 75 72 6e 20 6a 7d 2c 67 72 65 70 3a 66 75 6e 63 74 69 6f 6e 28 6a 2c 73 2c 76 29 7b 76 61 72 20 7a 3d 5b 5d 2c 48 3b 76 3d 21 21 76 3b 66 6f 72 28 76 61 72 20 47 3d 30 2c 4b 3d 6a 2e 6c 65 6e 67 74 68 3b 47 3c 4b 3b 47 2b 2b 29 7b 48 3d 21 21 73 28 6a 5b 47 5d 2c 47 29 3b 76 21 3d 3d 48 26 26 7a 2e 70 75 73 68 28 6a 5b 47 5d 29 7d 72 65 74 75 72 6e 20 7a 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6a 2c 73 2c 76 29 7b 66 6f 72 28 76 61 72 20 Data Ascii: .length==="number")for(var H=s.length;z<H;z++)j[v++]=s[z];else for(;s[z]!==B;)j[v++]=s[z++];j.length=v;return j},grep:function(j,s,v){var z=[],H;v=!!v;for(var G=0,K=j.length;G<K;G++){H=!!s(j[G],G);v!==H&&z.push(j[G])}return z},map:function(j,s,v){for(var
2024-04-17 22:22:59 UTC	1378	IN	Data Raw: 3d 2f 5e 5b 5c 73 5c 78 41 30 5d 2b 2f 3b 6f 3d 2f 5b 5c 73 5c 78 41 30 5d 2b 24 2f 7d 66 3d 62 28 74 29 3b 69 66 28 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 29 75 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 75 2c 0a 66 61 6c 73 65 29 3b 62 2e 72 65 61 64 79 28 29 7d 3b 65 6c 73 65 20 69 66 28 74 2e 61 74 74 61 63 68 45 76 65 6e 74 29 75 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 2e 72 65 61 64 79 53 74 61 74 65 3d 3d 3d 22 63 6f 6d 70 6c 65 74 65 22 29 7b 74 2e 64 65 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 75 29 3b 62 2e 72 65 61 64 79 28 29 7d 7d 3b 72 65 74 75 72 6e 20 Data Ascii: =/^[\s\xA0]+/;o=/[\s\xA0]+$/}f=b(t);if(t.addEventListener)u=function(){t.removeEventListener("DOMContentLoaded",u,false);b.ready()};else if(t.attachEvent)u=function(){if(t.readyState==="complete"){t.detachEvent("onreadystatechange",u);b.ready()}};return
2024-04-17 22:22:59 UTC	1378	IN	Data Raw: 54 65 78 74 4e 6f 64 65 28 22 77 69 6e 64 6f 77 2e 22 2b 65 2b 22 3d 31 3b 22 29 29 7d 63 61 74 63 68 28 6f 29 7b 7d 61 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 62 2c 61 2e 66 69 72 73 74 43 68 69 6c 64 29 3b 69 66 28 45 5b 65 5d 29 7b 63 2e 73 75 70 70 6f 72 74 2e 73 63 72 69 70 74 45 76 61 6c 3d 74 72 75 65 3b 64 65 6c 65 74 65 20 45 5b 65 5d 7d 74 72 79 7b 64 65 6c 65 74 65 20 62 2e 74 65 73 74 7d 63 61 74 63 68 28 78 29 7b 63 2e 73 75 70 70 6f 72 74 2e 64 65 6c 65 74 65 45 78 70 61 6e 64 6f 3d 66 61 6c 73 65 7d 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 3b 69 66 28 64 2e 61 74 74 61 63 68 45 76 65 6e 74 26 26 64 2e 66 69 72 65 45 76 65 6e 74 29 7b 64 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 20 Data Ascii: TextNode("window."+e+"=1;"))}catch(o){}a.insertBefore(b,a.firstChild);if(E[e]){c.support.scriptEval=true;delete E[e]}try{delete b.test}catch(x){c.support.deleteExpando=false}a.removeChild(b);if(d.attachEvent&&d.fireEvent){d.attachEvent("onclick",function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49726	15.204.213.5	443	7120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 22:23:00 UTC	602	OUT	GET /?lang=en HTTP/1.1 Host: ipwho.is Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://i18usgwgwrtjcshghwg.z13.web.core.windows.net Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-17 22:23:01 UTC	255	IN	HTTP/1.1 200 OK Date: Wed, 17 Apr 2024 22:23:00 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2024-04-17 22:23:01 UTC	69	IN	Data Raw: 33 61 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 66 61 6c 73 65 2c 22 6d 65 73 73 61 67 65 22 3a 22 59 6f 75 27 76 65 20 68 69 74 20 74 68 65 20 6d 6f 6e 74 68 6c 79 20 6c 69 6d 69 74 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a{"success":false,"message":"You've hit the monthly limit"}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49737	15.204.213.5	443	7120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 22:23:01 UTC	340	OUT	GET /?lang=en HTTP/1.1 Host: ipwho.is Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-17 22:23:01 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 17 Apr 2024 22:23:01 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2024-04-17 22:23:01 UTC	1038	IN	Data Raw: 34 30 32 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 Data Ascii: 402{ "About Us": "https:\/\/ipwhois.io", "ip": "81.181.57.52", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "Georgi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49739	23.201.212.130	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 22:23:02 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-17 22:23:02 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=31187 Date: Wed, 17 Apr 2024 22:23:02 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49746	23.201.212.130	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 22:23:02 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-17 22:23:02 UTC	530	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Content-Type: application/octet-stream ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=31230 Date: Wed, 17 Apr 2024 22:23:02 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-17 22:23:02 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49756	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 22:23:14 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713392560879&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-17 22:23:14 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-17 22:23:14 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-17 22:23:14 UTC	479	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B107FFB1A836443EBC159813801476C4 Ref B: LAX311000111007 Ref C: 2024-04-17T22:23:14Z Date: Wed, 17 Apr 2024 22:23:14 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1713392594.7b802c3

Target ID:	0
Start time:	00:22:50
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	00:22:53
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2176,i,5963614580776725438,16288755853899356505,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	00:22:57
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/index.html?phone=%201-844-324-0016"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/index.html?phone=%201-844-324-0016

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Windows Analysis Report
https://i18usgwgwrtjcshghwg.z13.web.core.windows.net/Win08ShDMeEr0887/index.html?phone=%201-844-324-0016