Edit tour

Windows Analysis Report
http://www.pdfconvertercompare.com

Overview

General Information

Sample URL:	http://www.pdfconvertercompare.com
Analysis ID:	1428647
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pdfconvertercompare.com/ MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1940,i,17557288236442541491,16567634371527361135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: www.pdfconvertercompare.com

Virustotal: Detection: 5%

Perma Link

Multi AV Scanner detection for submitted file

Source: http://www.pdfconvertercompare.com

Virustotal: Detection: 5%

Perma Link

Source: https://www.pdfconvertercompare.com/

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.216.73.151:443 -> 192.168.2.18:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.216.73.151:443 -> 192.168.2.18:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.18:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.13:443 -> 192.168.2.18:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.22.200:443 -> 192.168.2.18:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.18:49711 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.13
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.13
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.13
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.13
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.13

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.pdfconvertercompare.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.pdfconvertercompare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pdfconvertercompare.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XZ+NN9H8GulCbRO&MD=4rFRszaL HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 120X-DeviceID: 01000A410900B03DX-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAbBC88hl7N016cTZsToba47ksqRCNDKipioKRJV54nhw4oagOqHeMtAGcvkGM7OrhQcymLZIXA2E6JIJez/RjaMbOC84IRUjbJxEfxxD/Niqbkt2/GmRiEvzZlhC5yfdJ9eaZi/IRitTbHRm7UPDevQEPxOynfJ4FJY1vjT9oKYTfWu0///Unrl4IdhGZ37AkX71Q%2BbmiWC/HoL63wUrgLBwGAVqC8%2Br5R/hZw04zflPRkEO9ClYroIqW86wX7OxbqU37ZVNr5VFRt7BJRhoqID5KOHr/wzDWXt7/kVoXZlpRIp6VY%2BHGFtTzptxV7USuD%2BTsKiVijDZrxe2dNvLcXkDZgAACImakz1yiOwpqAHOsUsmbDum6xPwIWWGf/j/TtOONcGcwycgqeL6TjpTBMhwFm09PHnm50w4MBFQlojRxnS1atYJCR/gBHIyXkgw33DZW2zZblzeU0Yvyaer/Vb5LrDYyRts3LDrJ%2Bxq3iCtUEX6pmxgJrVLoun82fHPgaELXqg%2B0YG12IzYKWmPt/HszbnFwKLJhBvTbHnZna6kVzvxigQlzavEPLqezuGIJZqPTV9pqw6PnFvfV%2BvrL7AlxPJatSknuZGumSqK33vCbHhCNK%2B4UbzGRr/pRR914dVX675b1Kk4ijw1wz66fo7AzWrsmyuFcRzuCpOAzGIj2bXoeX0dhFiV5RHntW3xCz/WqFV/7SKadjawnG1DburVgeE6sDI5pAh4WCLSiAeys0uU3iHTdY0rc/Gi2%2BKxKQzJcnHZEH%2BX7knDJSVAKhfXtEnMSRgPh2Z2z2ynUOGdVtkJfr%2B%2Bo5dl1L6f5csOr%2BmRYFpyEC5jBDkm//0DL0Ob1hKngBA7g43aEDWq%2BXQ/cczCj0s282H9VGVHIP1VTFdNRe7n8km2c1tE8OrZO97c2m41lrIB2AE%3D%26p%3DX-Agent-DeviceId: 01000A410900B03DX-BM-CBT: 1713517249User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: CEC5DF1EB39B4401BE3005AD697C33F2X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=B4BB39E5F80E411D94C438C0FA7ACF94&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&LUT=1707317051026&IPMH=6b344233&IPMID=1707317270835&HV=1707317277; ANON=A=680C1B1A649CBD64DD40EBFCFFFFFFFF; MUID=BC76BB0020D345C1A049A4820CB4C03C; MUIDB=BC76BB0020D345C1A049A4820CB4C03C
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XZ+NN9H8GulCbRO&MD=4rFRszaL HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: unknown

DNS traffic detected: queries for: www.pdfconvertercompare.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=XRSuzvIXp2ls7Ai%2FlqQApJLjUFT5NpKI9X49gwGzirLl%2FMPvM3YO7YRCvWHYyLQheZTXz6AvDMDkYJ4vRTaIF5gLulr9LqwlwAtMOrPgMdFvv2UNs9HPY82GC8BQqpSZiN21u%2Bhsl0VnGmfkdA%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 397Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 23.216.73.151:443 -> 192.168.2.18:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.216.73.151:443 -> 192.168.2.18:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.18:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.13:443 -> 192.168.2.18:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.22.200:443 -> 192.168.2.18:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.18:49711 version: TLS 1.2

Source: classification engine

Classification label: mal56.win@15/6@8/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pdfconvertercompare.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1940,i,17557288236442541491,16567634371527361135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1940,i,17557288236442541491,16567634371527361135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://www.pdfconvertercompare.com	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
www.pdfconvertercompare.com	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.pdfconvertercompare.com/favicon.ico	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false		high
www.google.com	74.125.136.106	true	false		high
www.pdfconvertercompare.com	104.26.0.18	true	false	5%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.pdfconvertercompare.com/	false		unknown
https://www.pdfconvertercompare.com/favicon.ico	false	3%, Virustotal, Browse	unknown
https://a.nel.cloudflare.com/report/v4?s=RTot2bvyDRaa%2F9KFzMrtkAHoDC%2FpFs1z%2FpOUq2U44F9%2BK%2BSef5wOAxFbE50ucl6NvNXSpgxKmlcfuM7YrgE8BWEtuPRluXK5%2FCc5%2FyAHYQcTAT%2BFHV8SVgvtEagwkSvzhh%2FNI1Ov1I2F758MzQ%3D%3D	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.67.69.183	unknown	United States	13335	CLOUDFLARENETUS	false
74.125.136.106	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.18

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428647
Start date and time:	2024-04-19 10:59:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://www.pdfconvertercompare.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@15/6@8/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 64.233.177.94, 74.125.138.100, 74.125.138.102, 74.125.138.113, 74.125.138.139, 74.125.138.138, 74.125.138.101, 172.217.215.84, 34.104.35.123, 142.251.15.94, 142.250.105.138, 142.250.105.100, 142.250.105.113, 142.250.105.102, 142.250.105.101, 142.250.105.139
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, login.live.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:00:20 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9757370546732558
Encrypted:	false
SSDEEP:	48:8E+dFT5/G/H6idAKZdA1rehwiZUklqehNy+3:8EMV/G6uy
MD5:	8FB065FE158A9C50315BC1166EB1C896
SHA1:	5081D51359130980F8923C70C7A68E9927CDD7B3
SHA-256:	536EC8FD004CEA01EDF72D1EBD5C5AE042A1FE25F227FFC6D8DA0F35DBA59CBC
SHA-512:	70EDC6EA883144B6E3B3BEB214836A0653A40DFE1A829D001555EA0883FCADE9A8AE6F3898B8950FEC0AF5FB2C363440039521491B9EEE9A5DF3218497F96C40
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........8.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.X.H....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.H....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.X.H....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.X.H...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.H.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Z.2......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:00:20 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9918173439749305
Encrypted:	false
SSDEEP:	48:8l+dFT5/G/H6idAKZdA1ceh/iZUkAQkqehey+2:8lMV/Ge9Qvy
MD5:	91CD3BE159EBB23BC7047C52B7EFA642
SHA1:	CA038E1B31AA316D59184C49FB798E1BF229D37B
SHA-256:	E32A0C4AD44A7A3D2F66E004343B71F2D9EEC94E833B465B20002E3E0CBF8418
SHA-512:	F7E7AE1E9519D1651A9888C3E8FC300B788764ABFF7E1BB05443E772F77A624DF1723D731EADD324BCB1BAE225BF235C65095AC8A142F3B0430170081C41EE17
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..8.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.X.H....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.H....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.X.H....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.X.H...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.H.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Z.2......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	4.001210686517445
Encrypted:	false
SSDEEP:	48:8XR+dFT5/GSH6idAKZdA14Aeh7sFiZUkmgqeh7sgy+BX:8hMV/GjnCy
MD5:	C23B014A32001E8D5F53DF9B19907BBB
SHA1:	7FC9E2110D147FE87B23F633B4D947F04BA4DBCA
SHA-256:	04875AF60293F872AAB47C09445BA717AC5A04A3B7CEBED83F0B3683629A2F38
SHA-512:	59FFF98832D8C3066D86095BCB265160E21EDC1E0C57CC8AEBE60EE04B91729784D558A7708C92EF046108A132DE2BBAC6463CB133F07ABD7929A1F55C1914F2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....?.4 ?.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.X.H....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.H....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.X.H....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.X.H...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.R.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Z.2......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:00:20 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.990012865671263
Encrypted:	false
SSDEEP:	48:8v+dFT5/G/H6idAKZdA1JehDiZUkwqehKy+R:8vMV/GLoy
MD5:	898F7C24D9C3C33144BE26661D199BEC
SHA1:	C8C8A2F572EE87C3F74C3FAC9A5195C98C7520CE
SHA-256:	FC7E3F19F9BCBE6FB89A1BC3520058D9EF6754729D1753E92AB90D744B4F1D36
SHA-512:	AD337BC11E17BE8D8F0942169D13435128DCB1B1CF5FC17C5AAA85B4C296D4413141D722F30EE774B8E40C82F38F4A0EC7EC1C4CB4F9D45D2035ECCC6E8E3FD8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........8.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.X.H....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.H....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.X.H....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.X.H...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.H.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Z.2......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:00:20 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.976234394598776
Encrypted:	false
SSDEEP:	48:81+dFT5/G/H6idAKZdA1XehBiZUk1W1qehky+C:81MV/Gr9Ey
MD5:	FDF5804C378C4646AFDE4417717FFC71
SHA1:	32DA23D3D24EE2E07F059839B4715BF97365E485
SHA-256:	8C33E311B05BEBE35B9B4262880EE3ECA04B938DD9371C00A8357EBA39F603D7
SHA-512:	58EC193413F864F67531B433A167A8006636C0A03F00FEE3D489BF9D89331EE5FBE80D97C44815E0451639013D535D0278AF34B3B222E716940D5FCACA8B744F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....n7..8.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.X.H....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.H....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.X.H....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.X.H...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.H.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Z.2......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:00:20 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9908826164595093
Encrypted:	false
SSDEEP:	48:8V+dFT5/G/H6idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbCy+yT+:8VMV/GFT/TbxWOvTbCy7T
MD5:	FC414925B52D59C21D6B0DCF75046D53
SHA1:	AFDC4E6AA7998E1F5B48A2F49D2FDEA139B2D099
SHA-256:	3ED46F8079300EBEF73624E47A55503DA239EBA3BF3C52FB7F1204F0521C2699
SHA-512:	48FCCE1B5F63DB32BE2C670581C726E31F6947325A80101372F95C3B0EF6C6D9FD0D6E1AE60B868969C2CA460AFD631CA91954F7628E82472BAD5DDD0260A3E2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......8.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.X.H....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.H....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.X.H....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.X.H...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X.H.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Z.2......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:00:18.973154068 CEST	49697	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:18.973206043 CEST	443	49697	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:18.973278999 CEST	49697	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:18.973511934 CEST	49697	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:18.973530054 CEST	443	49697	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.195729971 CEST	443	49697	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.196008921 CEST	49697	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.196024895 CEST	443	49697	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.197288036 CEST	443	49697	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.197352886 CEST	49697	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.198447943 CEST	49697	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.198524952 CEST	443	49697	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.198636055 CEST	49697	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.198647976 CEST	443	49697	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.239814043 CEST	49697	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.472868919 CEST	443	49697	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.472954035 CEST	443	49697	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.472999096 CEST	49697	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.473602057 CEST	49697	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.473615885 CEST	443	49697	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.561002016 CEST	49698	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.561052084 CEST	443	49698	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.561160088 CEST	49698	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.561391115 CEST	49698	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.561403990 CEST	443	49698	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.578352928 CEST	49700	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:19.578381062 CEST	443	49700	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:19.578450918 CEST	49700	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:19.578649044 CEST	49700	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:19.578664064 CEST	443	49700	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:19.780191898 CEST	443	49698	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.780610085 CEST	49698	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.780637026 CEST	443	49698	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.781035900 CEST	443	49698	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.781371117 CEST	49698	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.781439066 CEST	443	49698	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.781583071 CEST	49698	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:19.795675993 CEST	443	49700	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:19.795955896 CEST	49700	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:19.795984983 CEST	443	49700	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:19.797136068 CEST	443	49700	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:19.797210932 CEST	49700	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:19.798345089 CEST	49700	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:19.798434019 CEST	443	49700	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:19.798536062 CEST	49700	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:19.798552036 CEST	443	49700	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:19.824131966 CEST	443	49698	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:19.840835094 CEST	49700	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.029165030 CEST	443	49700	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.029254913 CEST	443	49700	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.029345989 CEST	49700	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.029603958 CEST	49700	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.029623032 CEST	443	49700	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.030368090 CEST	49701	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.030405045 CEST	443	49701	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.030474901 CEST	49701	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.030760050 CEST	49701	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.030767918 CEST	443	49701	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.059479952 CEST	443	49698	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:20.059556007 CEST	443	49698	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:20.059689045 CEST	49698	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:20.060151100 CEST	49698	443	192.168.2.18	172.67.69.183
Apr 19, 2024 11:00:20.060174942 CEST	443	49698	172.67.69.183	192.168.2.18
Apr 19, 2024 11:00:20.211812019 CEST	49702	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.211862087 CEST	443	49702	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.211929083 CEST	49702	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.212858915 CEST	49702	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.212872982 CEST	443	49702	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.241466045 CEST	443	49701	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.241782904 CEST	49701	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.241800070 CEST	443	49701	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.242147923 CEST	443	49701	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.242532969 CEST	49701	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.242592096 CEST	443	49701	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.242685080 CEST	49701	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.284117937 CEST	443	49701	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.426719904 CEST	443	49702	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.426795006 CEST	49702	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.429449081 CEST	49702	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.429460049 CEST	443	49702	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.429805994 CEST	443	49702	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.454673052 CEST	49702	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.474436045 CEST	443	49701	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.474515915 CEST	443	49701	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.474565029 CEST	49701	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.474698067 CEST	49701	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.474713087 CEST	443	49701	35.190.80.1	192.168.2.18
Apr 19, 2024 11:00:20.474723101 CEST	49701	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.474769115 CEST	49701	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:00:20.500117064 CEST	443	49702	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.625257015 CEST	443	49702	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.625344992 CEST	443	49702	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.625441074 CEST	49702	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.625521898 CEST	49702	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.625545025 CEST	443	49702	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.625555038 CEST	49702	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.625560999 CEST	443	49702	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.657073975 CEST	49703	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.657134056 CEST	443	49703	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.657244921 CEST	49703	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.657541990 CEST	49703	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.657553911 CEST	443	49703	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.867564917 CEST	443	49703	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.867705107 CEST	49703	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.869287968 CEST	49703	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.869298935 CEST	443	49703	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.869605064 CEST	443	49703	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:20.870630026 CEST	49703	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:20.916117907 CEST	443	49703	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:21.072781086 CEST	443	49703	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:21.072882891 CEST	443	49703	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:21.072937012 CEST	49703	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:21.073328972 CEST	49703	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:21.073348045 CEST	443	49703	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:21.073354959 CEST	49703	443	192.168.2.18	23.216.73.151
Apr 19, 2024 11:00:21.073369026 CEST	443	49703	23.216.73.151	192.168.2.18
Apr 19, 2024 11:00:23.673463106 CEST	49704	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:00:23.673497915 CEST	443	49704	74.125.136.106	192.168.2.18
Apr 19, 2024 11:00:23.673588991 CEST	49704	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:00:23.673816919 CEST	49704	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:00:23.673829079 CEST	443	49704	74.125.136.106	192.168.2.18
Apr 19, 2024 11:00:23.887878895 CEST	443	49704	74.125.136.106	192.168.2.18
Apr 19, 2024 11:00:23.888205051 CEST	49704	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:00:23.888226032 CEST	443	49704	74.125.136.106	192.168.2.18
Apr 19, 2024 11:00:23.889254093 CEST	443	49704	74.125.136.106	192.168.2.18
Apr 19, 2024 11:00:23.889331102 CEST	49704	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:00:23.895340919 CEST	49704	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:00:23.895411968 CEST	443	49704	74.125.136.106	192.168.2.18
Apr 19, 2024 11:00:23.937247038 CEST	49704	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:00:23.937268972 CEST	443	49704	74.125.136.106	192.168.2.18
Apr 19, 2024 11:00:23.982947111 CEST	49704	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:00:27.734158993 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 19, 2024 11:00:28.036823034 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 19, 2024 11:00:28.641818047 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 19, 2024 11:00:29.851809025 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 19, 2024 11:00:32.263819933 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 19, 2024 11:00:32.931412935 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:32.931462049 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:32.931567907 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:32.933244944 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:32.933264017 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:33.568806887 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:33.569061995 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:33.571578026 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:33.571594954 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:33.571918011 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:33.622895002 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:33.631386042 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:33.676115990 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:33.893385887 CEST	443	49704	74.125.136.106	192.168.2.18
Apr 19, 2024 11:00:33.893472910 CEST	443	49704	74.125.136.106	192.168.2.18
Apr 19, 2024 11:00:33.893559933 CEST	49704	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:00:34.181981087 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:34.182005882 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:34.182013988 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:34.182024002 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:34.182048082 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:34.182075977 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:34.182096004 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:34.182116032 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:34.182117939 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:34.182153940 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:34.182162046 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:34.182207108 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:34.182260036 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:34.182293892 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:34.194124937 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:34.194149017 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:34.194168091 CEST	49705	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:00:34.194175005 CEST	443	49705	40.68.123.157	192.168.2.18
Apr 19, 2024 11:00:34.855195045 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 19, 2024 11:00:34.968385935 CEST	49704	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:00:34.968422890 CEST	443	49704	74.125.136.106	192.168.2.18
Apr 19, 2024 11:00:35.159533024 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 19, 2024 11:00:35.764811993 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 19, 2024 11:00:36.979777098 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 19, 2024 11:00:37.075773001 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 19, 2024 11:00:39.390810966 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 19, 2024 11:00:44.193857908 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 19, 2024 11:00:46.679792881 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 19, 2024 11:00:50.728212118 CEST	49706	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:50.728250027 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:50.728359938 CEST	49706	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:50.729392052 CEST	49706	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:50.729408979 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.099354029 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.099493980 CEST	49706	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.144615889 CEST	49706	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.144639015 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.145023108 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.146246910 CEST	49706	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.146296978 CEST	49706	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.146336079 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.540072918 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.540095091 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.540132999 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.540174007 CEST	49706	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.540198088 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.540215969 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.540230036 CEST	49706	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.540262938 CEST	49706	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.540836096 CEST	49706	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.540854931 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.540879011 CEST	49706	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.540885925 CEST	443	49706	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.618849993 CEST	49707	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.618896961 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.618983984 CEST	49707	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.619167089 CEST	49707	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.619178057 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.985838890 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.986485958 CEST	49707	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.986512899 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.987226963 CEST	49707	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.987231970 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:51.987261057 CEST	49707	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:51.987267017 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.299031019 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.299076080 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.299119949 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.299160957 CEST	49707	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:52.299185038 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.299200058 CEST	49707	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:52.299201012 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.299248934 CEST	49707	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:52.299612045 CEST	49707	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:52.299631119 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.299639940 CEST	49707	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:52.299644947 CEST	443	49707	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.337558031 CEST	49708	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:52.337603092 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.337677002 CEST	49708	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:52.337932110 CEST	49708	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:52.337954998 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.712960005 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.713742018 CEST	49708	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:52.713768005 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.714462042 CEST	49708	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:52.714488029 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:52.714514017 CEST	49708	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:52.714523077 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.007962942 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.007983923 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.008023977 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.008111954 CEST	49708	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.008126974 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.008136988 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.008171082 CEST	49708	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.008191109 CEST	49708	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.008650064 CEST	49708	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.008672953 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.008683920 CEST	49708	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.008690119 CEST	443	49708	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.080584049 CEST	49709	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.080622911 CEST	443	49709	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.080733061 CEST	49709	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.080965042 CEST	49709	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.080976963 CEST	443	49709	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.447920084 CEST	443	49709	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.448642969 CEST	49709	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.448673010 CEST	443	49709	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.449388027 CEST	49709	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.449393034 CEST	443	49709	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.449436903 CEST	49709	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.449445009 CEST	443	49709	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.743676901 CEST	443	49709	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.743690968 CEST	443	49709	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.743724108 CEST	443	49709	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.743782043 CEST	443	49709	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.743869066 CEST	49709	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.743906021 CEST	49709	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.744422913 CEST	49709	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.744438887 CEST	443	49709	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.744451046 CEST	49709	443	192.168.2.18	40.126.28.13
Apr 19, 2024 11:00:53.744456053 CEST	443	49709	40.126.28.13	192.168.2.18
Apr 19, 2024 11:00:53.798228025 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 19, 2024 11:00:53.927192926 CEST	49710	443	192.168.2.18	13.107.22.200
Apr 19, 2024 11:00:53.927232981 CEST	443	49710	13.107.22.200	192.168.2.18
Apr 19, 2024 11:00:53.927321911 CEST	49710	443	192.168.2.18	13.107.22.200
Apr 19, 2024 11:00:53.929361105 CEST	49710	443	192.168.2.18	13.107.22.200
Apr 19, 2024 11:00:53.929374933 CEST	443	49710	13.107.22.200	192.168.2.18
Apr 19, 2024 11:00:54.297311068 CEST	443	49710	13.107.22.200	192.168.2.18
Apr 19, 2024 11:00:54.297935963 CEST	49710	443	192.168.2.18	13.107.22.200
Apr 19, 2024 11:00:54.298136950 CEST	443	49710	13.107.22.200	192.168.2.18
Apr 19, 2024 11:00:54.299933910 CEST	49710	443	192.168.2.18	13.107.22.200
Apr 19, 2024 11:00:54.343848944 CEST	49710	443	192.168.2.18	13.107.22.200
Apr 19, 2024 11:00:54.343861103 CEST	443	49710	13.107.22.200	192.168.2.18
Apr 19, 2024 11:00:54.344428062 CEST	443	49710	13.107.22.200	192.168.2.18
Apr 19, 2024 11:00:54.344491005 CEST	49710	443	192.168.2.18	13.107.22.200
Apr 19, 2024 11:00:54.345913887 CEST	49710	443	192.168.2.18	13.107.22.200
Apr 19, 2024 11:00:54.345964909 CEST	443	49710	13.107.22.200	192.168.2.18
Apr 19, 2024 11:00:54.602519035 CEST	443	49710	13.107.22.200	192.168.2.18
Apr 19, 2024 11:00:54.602531910 CEST	443	49710	13.107.22.200	192.168.2.18
Apr 19, 2024 11:00:54.602606058 CEST	443	49710	13.107.22.200	192.168.2.18
Apr 19, 2024 11:00:54.602626085 CEST	49710	443	192.168.2.18	13.107.22.200
Apr 19, 2024 11:00:54.602736950 CEST	49710	443	192.168.2.18	13.107.22.200
Apr 19, 2024 11:00:54.605720043 CEST	49710	443	192.168.2.18	13.107.22.200
Apr 19, 2024 11:00:54.605737925 CEST	443	49710	13.107.22.200	192.168.2.18
Apr 19, 2024 11:01:08.471299887 CEST	49689	80	192.168.2.18	72.21.81.240
Apr 19, 2024 11:01:08.573344946 CEST	80	49689	72.21.81.240	192.168.2.18
Apr 19, 2024 11:01:08.573411942 CEST	49689	80	192.168.2.18	72.21.81.240
Apr 19, 2024 11:01:10.562474966 CEST	49711	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:01:10.562536955 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:10.562644958 CEST	49711	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:01:10.563247919 CEST	49711	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:01:10.563282967 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:11.185970068 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:11.186187029 CEST	49711	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:01:11.188114882 CEST	49711	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:01:11.188133001 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:11.188380957 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:11.190210104 CEST	49711	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:01:11.236118078 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:11.799463034 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:11.799489975 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:11.799505949 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:11.799854994 CEST	49711	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:01:11.799854994 CEST	49711	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:01:11.799876928 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:11.799890995 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:11.800081968 CEST	49711	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:01:11.803566933 CEST	49711	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:01:11.803594112 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:11.803661108 CEST	49711	443	192.168.2.18	40.68.123.157
Apr 19, 2024 11:01:11.803668022 CEST	443	49711	40.68.123.157	192.168.2.18
Apr 19, 2024 11:01:19.483881950 CEST	49713	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:19.483921051 CEST	443	49713	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:19.484041929 CEST	49713	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:19.484272003 CEST	49713	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:19.484283924 CEST	443	49713	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:19.698626995 CEST	443	49713	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:19.698990107 CEST	49713	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:19.699008942 CEST	443	49713	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:19.700165033 CEST	443	49713	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:19.700479031 CEST	49713	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:19.700603008 CEST	49713	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:19.700650930 CEST	443	49713	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:19.753741980 CEST	49713	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:19.930927992 CEST	443	49713	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:19.931019068 CEST	443	49713	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:19.931073904 CEST	49713	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:19.931282043 CEST	49713	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:19.931301117 CEST	443	49713	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:19.931777954 CEST	49714	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:19.931807995 CEST	443	49714	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:19.931906939 CEST	49714	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:19.932152987 CEST	49714	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:19.932168007 CEST	443	49714	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:20.144198895 CEST	443	49714	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:20.144510984 CEST	49714	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:20.144531012 CEST	443	49714	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:20.144889116 CEST	443	49714	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:20.145201921 CEST	49714	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:20.145267963 CEST	443	49714	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:20.145343065 CEST	49714	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:20.188117981 CEST	443	49714	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:20.384316921 CEST	443	49714	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:20.384524107 CEST	443	49714	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:20.384586096 CEST	49714	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:20.384646893 CEST	49714	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:20.384666920 CEST	443	49714	35.190.80.1	192.168.2.18
Apr 19, 2024 11:01:20.384675980 CEST	49714	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:20.384737968 CEST	49714	443	192.168.2.18	35.190.80.1
Apr 19, 2024 11:01:23.623064995 CEST	49715	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:01:23.623116016 CEST	443	49715	74.125.136.106	192.168.2.18
Apr 19, 2024 11:01:23.623234034 CEST	49715	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:01:23.623472929 CEST	49715	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:01:23.623486996 CEST	443	49715	74.125.136.106	192.168.2.18
Apr 19, 2024 11:01:23.832808018 CEST	443	49715	74.125.136.106	192.168.2.18
Apr 19, 2024 11:01:23.833147049 CEST	49715	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:01:23.833168030 CEST	443	49715	74.125.136.106	192.168.2.18
Apr 19, 2024 11:01:23.833503008 CEST	443	49715	74.125.136.106	192.168.2.18
Apr 19, 2024 11:01:23.833798885 CEST	49715	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:01:23.833863020 CEST	443	49715	74.125.136.106	192.168.2.18
Apr 19, 2024 11:01:23.877794027 CEST	49715	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:01:33.866755009 CEST	443	49715	74.125.136.106	192.168.2.18
Apr 19, 2024 11:01:33.866805077 CEST	443	49715	74.125.136.106	192.168.2.18
Apr 19, 2024 11:01:33.866878986 CEST	49715	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:01:34.977478027 CEST	49715	443	192.168.2.18	74.125.136.106
Apr 19, 2024 11:01:34.977519989 CEST	443	49715	74.125.136.106	192.168.2.18

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:00:18.728760958 CEST	60424	53	192.168.2.18	1.1.1.1
Apr 19, 2024 11:00:18.728930950 CEST	54242	53	192.168.2.18	1.1.1.1
Apr 19, 2024 11:00:18.830954075 CEST	53	57329	1.1.1.1	192.168.2.18
Apr 19, 2024 11:00:18.832066059 CEST	53	60424	1.1.1.1	192.168.2.18
Apr 19, 2024 11:00:18.846291065 CEST	53	52876	1.1.1.1	192.168.2.18
Apr 19, 2024 11:00:18.848856926 CEST	53	54242	1.1.1.1	192.168.2.18
Apr 19, 2024 11:00:18.852809906 CEST	53721	53	192.168.2.18	1.1.1.1
Apr 19, 2024 11:00:18.853128910 CEST	60462	53	192.168.2.18	1.1.1.1
Apr 19, 2024 11:00:18.956759930 CEST	53	60462	1.1.1.1	192.168.2.18
Apr 19, 2024 11:00:18.972554922 CEST	53	53721	1.1.1.1	192.168.2.18
Apr 19, 2024 11:00:19.429480076 CEST	53	59890	1.1.1.1	192.168.2.18
Apr 19, 2024 11:00:19.474898100 CEST	59400	53	192.168.2.18	1.1.1.1
Apr 19, 2024 11:00:19.475140095 CEST	62792	53	192.168.2.18	1.1.1.1
Apr 19, 2024 11:00:19.577292919 CEST	53	59400	1.1.1.1	192.168.2.18
Apr 19, 2024 11:00:19.577971935 CEST	53	62792	1.1.1.1	192.168.2.18
Apr 19, 2024 11:00:23.569091082 CEST	56614	53	192.168.2.18	1.1.1.1
Apr 19, 2024 11:00:23.569305897 CEST	64870	53	192.168.2.18	1.1.1.1
Apr 19, 2024 11:00:23.671808958 CEST	53	56614	1.1.1.1	192.168.2.18
Apr 19, 2024 11:00:23.672559977 CEST	53	64870	1.1.1.1	192.168.2.18
Apr 19, 2024 11:00:36.461308956 CEST	53	58696	1.1.1.1	192.168.2.18
Apr 19, 2024 11:00:55.485838890 CEST	53	51334	1.1.1.1	192.168.2.18
Apr 19, 2024 11:01:18.212722063 CEST	53	53239	1.1.1.1	192.168.2.18
Apr 19, 2024 11:01:18.804938078 CEST	53	62715	1.1.1.1	192.168.2.18
Apr 19, 2024 11:01:35.068584919 CEST	138	138	192.168.2.18	192.168.2.255
Apr 19, 2024 11:01:46.767807007 CEST	53	57905	1.1.1.1	192.168.2.18

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 11:00:18.728760958 CEST	192.168.2.18	1.1.1.1	0xcf43	Standard query (0)	www.pdfconvertercompare.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:18.728930950 CEST	192.168.2.18	1.1.1.1	0x4323	Standard query (0)	www.pdfconvertercompare.com	65	IN (0x0001)	false
Apr 19, 2024 11:00:18.852809906 CEST	192.168.2.18	1.1.1.1	0x69a7	Standard query (0)	www.pdfconvertercompare.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:18.853128910 CEST	192.168.2.18	1.1.1.1	0xf743	Standard query (0)	www.pdfconvertercompare.com	65	IN (0x0001)	false
Apr 19, 2024 11:00:19.474898100 CEST	192.168.2.18	1.1.1.1	0x3653	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:19.475140095 CEST	192.168.2.18	1.1.1.1	0x22a0	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Apr 19, 2024 11:00:23.569091082 CEST	192.168.2.18	1.1.1.1	0x6176	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:23.569305897 CEST	192.168.2.18	1.1.1.1	0x568d	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 11:00:18.832066059 CEST	1.1.1.1	192.168.2.18	0xcf43	No error (0)	www.pdfconvertercompare.com	104.26.0.18	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:18.832066059 CEST	1.1.1.1	192.168.2.18	0xcf43	No error (0)	www.pdfconvertercompare.com	172.67.69.183	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:18.832066059 CEST	1.1.1.1	192.168.2.18	0xcf43	No error (0)	www.pdfconvertercompare.com	104.26.1.18	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:18.848856926 CEST	1.1.1.1	192.168.2.18	0x4323	No error (0)	www.pdfconvertercompare.com		65	IN (0x0001)	false
Apr 19, 2024 11:00:18.956759930 CEST	1.1.1.1	192.168.2.18	0xf743	No error (0)	www.pdfconvertercompare.com		65	IN (0x0001)	false
Apr 19, 2024 11:00:18.972554922 CEST	1.1.1.1	192.168.2.18	0x69a7	No error (0)	www.pdfconvertercompare.com	172.67.69.183	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:18.972554922 CEST	1.1.1.1	192.168.2.18	0x69a7	No error (0)	www.pdfconvertercompare.com	104.26.0.18	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:18.972554922 CEST	1.1.1.1	192.168.2.18	0x69a7	No error (0)	www.pdfconvertercompare.com	104.26.1.18	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:19.577292919 CEST	1.1.1.1	192.168.2.18	0x3653	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:23.671808958 CEST	1.1.1.1	192.168.2.18	0x6176	No error (0)	www.google.com	74.125.136.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:23.671808958 CEST	1.1.1.1	192.168.2.18	0x6176	No error (0)	www.google.com	74.125.136.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:23.671808958 CEST	1.1.1.1	192.168.2.18	0x6176	No error (0)	www.google.com	74.125.136.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:23.671808958 CEST	1.1.1.1	192.168.2.18	0x6176	No error (0)	www.google.com	74.125.136.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:23.671808958 CEST	1.1.1.1	192.168.2.18	0x6176	No error (0)	www.google.com	74.125.136.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:23.671808958 CEST	1.1.1.1	192.168.2.18	0x6176	No error (0)	www.google.com	74.125.136.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:00:23.672559977 CEST	1.1.1.1	192.168.2.18	0x568d	No error (0)	www.google.com		65	IN (0x0001)	false

HTTP Request Dependency Graph

www.pdfconvertercompare.com

https:

a.nel.cloudflare.com

fs.microsoft.com

slscr.update.microsoft.com

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.18	49697	172.67.69.183	443	6364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:00:19 UTC	670	OUT	GET / HTTP/1.1 Host: www.pdfconvertercompare.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:00:19 UTC	736	IN	HTTP/1.1 502 Bad Gateway Date: Fri, 19 Apr 2024 09:00:19 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XRSuzvIXp2ls7Ai%2FlqQApJLjUFT5NpKI9X49gwGzirLl%2FMPvM3YO7YRCvWHYyLQheZTXz6AvDMDkYJ4vRTaIF5gLulr9LqwlwAtMOrPgMdFvv2UNs9HPY82GC8BQqpSZiN21u%2Bhsl0VnGmfkdA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 876bb41d29ff6771-ATL
2024-04-19 09:00:19 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 30 32 Data Ascii: error code: 502

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.18	49698	172.67.69.183	443	6364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:00:19 UTC	610	OUT	GET /favicon.ico HTTP/1.1 Host: www.pdfconvertercompare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.pdfconvertercompare.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:00:20 UTC	748	IN	HTTP/1.1 502 Bad Gateway Date: Fri, 19 Apr 2024 09:00:20 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RTot2bvyDRaa%2F9KFzMrtkAHoDC%2FpFs1z%2FpOUq2U44F9%2BK%2BSef5wOAxFbE50ucl6NvNXSpgxKmlcfuM7YrgE8BWEtuPRluXK5%2FCc5%2FyAHYQcTAT%2BFHV8SVgvtEagwkSvzhh%2FNI1Ov1I2F758MzQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 876bb420dd92181b-ATL
2024-04-19 09:00:20 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 30 32 Data Ascii: error code: 502

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.18	49700	35.190.80.1	443	6364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:00:19 UTC	566	OUT	OPTIONS /report/v4?s=XRSuzvIXp2ls7Ai%2FlqQApJLjUFT5NpKI9X49gwGzirLl%2FMPvM3YO7YRCvWHYyLQheZTXz6AvDMDkYJ4vRTaIF5gLulr9LqwlwAtMOrPgMdFvv2UNs9HPY82GC8BQqpSZiN21u%2Bhsl0VnGmfkdA%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://www.pdfconvertercompare.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:00:20 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Fri, 19 Apr 2024 09:00:19 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.18	49701	35.190.80.1	443	6364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:00:20 UTC	496	OUT	POST /report/v4?s=XRSuzvIXp2ls7Ai%2FlqQApJLjUFT5NpKI9X49gwGzirLl%2FMPvM3YO7YRCvWHYyLQheZTXz6AvDMDkYJ4vRTaIF5gLulr9LqwlwAtMOrPgMdFvv2UNs9HPY82GC8BQqpSZiN21u%2Bhsl0VnGmfkdA%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 397 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:00:20 UTC	397	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 32 30 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 36 39 2e 31 38 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 35 30 32 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 64 66 63 6f 6e 76 65 72 74 65 72 Data Ascii: [{"age":0,"body":{"elapsed_time":620,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"172.67.69.183","status_code":502,"type":"http.error"},"type":"network-error","url":"https://www.pdfconverter
2024-04-19 09:00:20 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Fri, 19 Apr 2024 09:00:20 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.18	49702	23.216.73.151	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:00:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 09:00:20 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=165789 Date: Fri, 19 Apr 2024 09:00:20 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.18	49703	23.216.73.151	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:00:20 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 09:00:21 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=165750 Date: Fri, 19 Apr 2024 09:00:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-19 09:00:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.18	49705	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:00:33 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XZ+NN9H8GulCbRO&MD=4rFRszaL HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-19 09:00:34 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 190dd2ac-bf5e-4704-9b03-610e409350f3 MS-RequestId: 86c675dd-86db-454b-99f6-f6aa4ea1ef15 MS-CV: skwkM/9vk0m78ohv.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 19 Apr 2024 09:00:33 GMT Connection: close Content-Length: 24490
2024-04-19 09:00:34 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-19 09:00:34 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.18	49706	40.126.28.13	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:00:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-19 09:00:51 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 09:00:51 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 08:59:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C539_SN1 x-ms-request-id: ebbdbc99-94db-45f5-abba-c14357224657 PPServer: PPV: 30 H: SN1PEPF0002F96C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 09:00:50 GMT Connection: close Content-Length: 11390
2024-04-19 09:00:51 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.18	49707	40.126.28.13	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:00:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-19 09:00:51 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 09:00:52 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 08:59:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C539_SN1 x-ms-request-id: 39d3cea5-9156-4b64-b1e4-03b944ccb7cb PPServer: PPV: 30 H: SN1PEPF0002F16F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 09:00:51 GMT Connection: close Content-Length: 11370
2024-04-19 09:00:52 UTC	11370	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.18	49708	40.126.28.13	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:00:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-19 09:00:52 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 09:00:53 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 08:59:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C539_SN1 x-ms-request-id: 0700f0c0-59ca-4ebb-84d6-614b87427716 PPServer: PPV: 30 H: SN1PEPF0002F03D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 09:00:51 GMT Connection: close Content-Length: 11370
2024-04-19 09:00:53 UTC	11370	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.18	49709	40.126.28.13	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:00:53 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4788 Host: login.live.com
2024-04-19 09:00:53 UTC	4788	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 09:00:53 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 08:59:53 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C539_SN1 x-ms-request-id: a5178260-91e1-44f3-8a97-73a896e9c810 PPServer: PPV: 30 H: SN1PEPF0002F963 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 09:00:53 GMT Connection: close Content-Length: 11153
2024-04-19 09:00:53 UTC	11153	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.18	49710	13.107.22.200	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:00:54 UTC	2735	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: 120 X-DeviceID: 01000A410900B03D X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75 X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAbBC88hl7N016cTZsToba47ksqRCNDKipioKRJV54nhw4oagOqHeMtAGcvkGM7OrhQcymLZIXA2E6JIJez/RjaMbOC84IRUjbJxEfxxD/Niqbkt2/GmRiEvzZlhC5yfdJ9eaZi/IRitTbHRm7UPDevQEPxOynfJ4FJY1vjT9oKYTfWu0///Unrl4IdhGZ37AkX71Q%2BbmiWC/HoL63wUrgLBwGAVqC8%2Br5R/hZw04zflPRkEO9ClYroIqW86wX7OxbqU37ZVNr5VFRt7BJRhoqID5KOHr/wzDWXt7/kVoXZlpRIp6VY%2BHGFtTzptxV7USuD%2BTsKiVijDZrxe2dNvLcXkDZgAACImakz1yiOwpqAHOsUsmbDum6xPwIWWGf/j/TtOONcGcwycgqeL6TjpTBMhwFm09PHnm50w4MBFQlojRxnS1atYJCR/gBHIyXkgw33DZW2zZblzeU0Yvyaer/Vb5LrDYyRts3LDrJ%2Bxq3iCtUEX6pmxgJrVLoun82fHPgaELXqg%2B0YG12IzYKWmPt/HszbnFwKLJhBvTbHnZna6kVzvxigQlzavEPLqezuGIJZqPTV9pqw6PnFvfV%2BvrL7AlxPJatSknuZGumSqK33vCbHhCNK%2B4UbzGRr/pRR914dVX675b1Kk4ijw1wz66fo7AzWrsmyuFcRzuCpOAzGIj2bXoeX0dhFiV5RHntW3xCz/WqFV/7SKadjawnG1DburVgeE6sDI5pAh4WCLSiAeys0uU3iHTdY0rc/Gi2%2BKxKQzJcnHZEH%2BX7knDJSVAKhfXtEnMSRgPh2Z2z2ynUOGdVtkJfr%2B%2Bo5dl1L6f5csOr%2BmRYFpyEC5jBDkm//0DL0Ob1hKngBA7g43aEDWq%2BXQ/cczCj0s282H9VGVHIP1VTFdNRe7n8km2c1tE8OrZO97c2m41lrIB2AE%3D%26p%3D X-Agent-DeviceId: 01000A410900B03D X-BM-CBT: 1713517249 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: CEC5DF1EB39B4401BE3005AD697C33F2 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=B4BB39E5F80E411D94C438C0FA7ACF94&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&LUT=1707317051026&IPMH=6b344233&IPMID=1707317270835&HV=1707317277; ANON=A=680C1B1A649CBD64DD40EBFCFFFFFFFF; MUID=BC76BB0020D345C1A049A4820CB4C03C; MUIDB=BC76BB0020D345C1A049A4820CB4C03C
2024-04-19 09:00:54 UTC	1512	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2215 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: _EDGE_S=SID=3FBA46DCEE9C67612DF452BAEF1066B4&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: MUIDB=BC76BB0020D345C1A049A4820CB4C03C; expires=Wed, 14-May-2025 09:00:54 GMT; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=en&LUT=1707317051026&IPMH=6b344233&IPMID=1707317270835&HV=1707317277; domain=.bing.com; expires=Wed, 14-May-2025 09:00:54 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=3FBA46DCEE9C67612DF452BAEF1066B4; domain=.bing.com; path=/; secure; SameSite=None X-EventID: 662232c69fe445cfbd135945c9c881ec UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 247FF5B8E9F74DA0B9FB7CB6E6EE1425 Ref B: BL2AA2010202021 Ref C: 2024-04-19T09:00:54Z Date: Fri, 19 Apr 2024 09:00:54 GMT Connection: close
2024-04-19 09:00:54 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.18	49711	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:01:11 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XZ+NN9H8GulCbRO&MD=4rFRszaL HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-19 09:01:11 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: bdbcab5a-8eeb-461a-8698-1ee346999be4 MS-RequestId: 23bfb740-5cb1-437d-b70e-058724360b58 MS-CV: PzZC8IMtJkuHqS28.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 19 Apr 2024 09:01:10 GMT Connection: close Content-Length: 25457
2024-04-19 09:01:11 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-19 09:01:11 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.18	49713	35.190.80.1	443	6364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:01:19 UTC	578	OUT	OPTIONS /report/v4?s=RTot2bvyDRaa%2F9KFzMrtkAHoDC%2FpFs1z%2FpOUq2U44F9%2BK%2BSef5wOAxFbE50ucl6NvNXSpgxKmlcfuM7YrgE8BWEtuPRluXK5%2FCc5%2FyAHYQcTAT%2BFHV8SVgvtEagwkSvzhh%2FNI1Ov1I2F758MzQ%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://www.pdfconvertercompare.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:01:19 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Fri, 19 Apr 2024 09:01:19 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.18	49714	35.190.80.1	443	6364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:01:20 UTC	508	OUT	POST /report/v4?s=RTot2bvyDRaa%2F9KFzMrtkAHoDC%2FpFs1z%2FpOUq2U44F9%2BK%2BSef5wOAxFbE50ucl6NvNXSpgxKmlcfuM7YrgE8BWEtuPRluXK5%2FCc5%2FyAHYQcTAT%2BFHV8SVgvtEagwkSvzhh%2FNI1Ov1I2F758MzQ%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 448 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:01:20 UTC	448	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 39 34 32 33 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 34 39 39 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 64 66 63 6f 6e 76 65 72 74 65 72 63 6f 6d 70 61 72 65 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 36 39 2e 31 38 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 35 30 32 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 Data Ascii: [{"age":59423,"body":{"elapsed_time":499,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://www.pdfconvertercompare.com/","sampling_fraction":1.0,"server_ip":"172.67.69.183","status_code":502,"type":"http.error"},"type":"networ
2024-04-19 09:01:20 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Fri, 19 Apr 2024 09:01:20 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	11:00:17
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pdfconvertercompare.com/
Imagebase:	0x7ff728d30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:00:17
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1940,i,17557288236442541491,16567634371527361135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff728d30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.pdfconvertercompare.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5232, Parent PID: 5368

General

Chronological Activities

Analysis Process: chrome.exePID: 6364, Parent PID: 5232

General

Chronological Activities

Disassembly

Windows Analysis Report
http://www.pdfconvertercompare.com