Edit tour

Windows Analysis Report
New Voicemail_Daiichi-Sankyo.html

Overview

General Information

Sample name:	New Voicemail_Daiichi-Sankyo.html
Analysis ID:	1428650
MD5:	fad4e997eaeea62578413ea678476cd9
SHA1:	ad0babd4c6385c478c78100139e329dee20be319
SHA256:	05b643d7aed6dfef151821ec1ac1eef67d7a2cf887633eb98a5639405bde79d1
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

HTML document with suspicious name

HTML document with suspicious title

HTML file submission containing password form

HTML sample is only containing javascript code

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

IP address seen in connection with other malware

Invalid 'forgot password' link found

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\New Voicemail_Daiichi-Sankyo.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2280,i,6943950111535354216,13745419357944458540,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
New Voicemail_Daiichi-Sankyo.html	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site detected (based on favicon image match)

Source: file://	Matcher: Template: microsoft matched with high similarity
Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Source: Yara match	File source: New Voicemail_Daiichi-Sankyo.html, type: SAMPLE
Source: Yara match	File source: 0.0.pages.csv, type: HTML

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html

Tab title: Sign in to your account

HTML sample is only containing javascript code

Source: New Voicemail_Daiichi-Sankyo.html

HTTP Parser: <script>var email = "info@daiichi-sankyo.at";</script><html> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>Sign in to your account</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> ...

Source: New Voicemail_Daiichi-Sankyo.html	HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html	HTTP Parser: Number of links: 0

Source: New Voicemail_Daiichi-Sankyo.html	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: New Voicemail_Daiichi-Sankyo.html	HTTP Parser: Title: Sign in to your account does not match URL
Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html	HTTP Parser: Title: Sign in to your account does not match URL

Source: New Voicemail_Daiichi-Sankyo.html	HTTP Parser: Invalid link: Forgotten my password
Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html	HTTP Parser: Invalid link: Forgotten my password

Source: New Voicemail_Daiichi-Sankyo.html	HTTP Parser: Invalid link: Terms of use
Source: New Voicemail_Daiichi-Sankyo.html	HTTP Parser: Invalid link: Privacy & cookies
Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html	HTTP Parser: Invalid link: Terms of use
Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html	HTTP Parser: Invalid link: Privacy & cookies

Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html

HTTP Parser: Has password / email / username input fields

Source: New Voicemail_Daiichi-Sankyo.html	HTTP Parser: <input type="password" .../> found
Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html	HTTP Parser: <input type="password" .../> found

Source: New Voicemail_Daiichi-Sankyo.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html	HTTP Parser: No <meta name="author".. found

Source: New Voicemail_Daiichi-Sankyo.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49738 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.216.73.151:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.216.73.151:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49741 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 152.199.4.44 152.199.4.44
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49738 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183

Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: nullsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /daiichi-sankyo.at HTTP/1.1Host: logo.clearbit.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /daiichi-sankyo.at HTTP/1.1Host: logo.clearbit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=do3Xfs9PACD7E9V&MD=94olGX7g HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=do3Xfs9PACD7E9V&MD=94olGX7g HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /json/?fields=status,country,regionName,city,query HTTP/1.1Host: ip-api.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Origin: nullAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json/?fields=status,country,regionName,city,query HTTP/1.1Host: ip-api.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: aadcdn.msftauth.net

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713517984939&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: New Voicemail_Daiichi-Sankyo.html	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhle
Source: New Voicemail_Daiichi-Sankyo.html	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d
Source: New Voicemail_Daiichi-Sankyo.html	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: New Voicemail_Daiichi-Sankyo.html	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 23.216.73.151:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.216.73.151:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49741 version: TLS 1.2

System Summary

HTML document with suspicious name

Source: Name includes: New Voicemail_Daiichi-Sankyo.html

Initial sample: voicemail

Source: classification engine

Classification label: mal72.phis.winHTML@26/22@14/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\New Voicemail_Daiichi-Sankyo.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2280,i,6943950111535354216,13745419357944458540,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2280,i,6943950111535354216,13745419357944458540,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html

HTTP Parser: file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cs1100.wpc.omegacdn.net	0%	Virustotal		Browse
aadcdn.msftauth.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhle	0%	Virustotal		Browse
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
d26p066pn2w0s0.cloudfront.net	3.161.136.96	true	false		high
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	0%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	false		high
www.google.com	64.233.176.103	true	false		high
aadcdn.msftauth.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
logo.clearbit.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://logo.clearbit.com/daiichi-sankyo.at	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	URL Reputation: safe	unknown
http://ip-api.com/json/?fields=status,country,regionName,city,query	false		high
file:///C:/Users/user/Desktop/New%20Voicemail_Daiichi-Sankyo.html	true		low
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css	false	0%, Virustotal, Browse	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhle	New Voicemail_Daiichi-Sankyo.html	false	0%, Virustotal, Browse	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d	New Voicemail_Daiichi-Sankyo.html	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.161.136.96	d26p066pn2w0s0.cloudfront.net	United States	16509	AMAZON-02US	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
64.233.176.103	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428650
Start date and time:	2024-04-19 11:12:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New Voicemail_Daiichi-Sankyo.html
Detection:	MAL
Classification:	mal72.phis.winHTML@26/22@14/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 74.125.138.94, 172.253.124.139, 172.253.124.101, 172.253.124.113, 172.253.124.102, 172.253.124.138, 172.253.124.100, 108.177.122.84, 142.250.9.95, 34.104.35.123, 108.177.122.95, 173.194.219.95, 64.233.185.95, 172.217.215.95, 64.233.176.95, 142.251.15.95, 142.250.105.95, 172.253.124.95, 64.233.177.95, 74.125.138.95, 74.125.136.95, 199.232.210.172, 192.229.211.108, 142.250.9.94, 199.232.214.172, 172.217.215.113, 172.217.215.101, 172.217.215.138, 172.217.215.100, 172.217.215.139, 172.217.215.102
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ajax.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	DHL.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	ip-api.com/line/?fields=hosting
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Win64.Evo-gen.10533.31255.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json
	13w4NM6mPa.exe	Get hash	malicious	LummaC	Browse	ip-api.com/json
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	ip-api.com/line/?fields=hosting
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	ip-api.com/line/?fields=hosting
	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Shipping Dcuments_CI PKL_HL_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	transferencia_BBVA_97866456345354678976543425678.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
239.255.255.250	http://www.pdfconvertercompare.com	Get hash	malicious	Unknown	Browse
	Play_NewMessage_17April2024_Audio.htm	Get hash	malicious	Unknown	Browse
	https://jll2.sharepoint.com/:f:/t/WorkplaceStrategy274/EqyxzpLxD8lEhSn1hXMNtKMBbmoik8-xeuIbHrYk7cgngA?e=5%3a2wyFQq&at=9&xsdata=MDV8MDJ8cGF0cmljaWEucmliZWlyb0Bub3ZvYmFuY28ucHR8NjlmMTdkMWU5YzBjNDFkN2UwZmIwOGRjNTNjN2YwZTV8MTAzMzgwNDgxOTNhNDI5OGFiZWEzNTk2YWU4OGIwNWV8MHwwfDYzODQ3NzM2NTQwMjI0OTQwNXxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=T2RkZHdHdHpwUXkxSG5Kd2Noc1RHVUc3YVNLVE1sOWZUTXdVZitYYXh6Yz0%3d	Get hash	malicious	HTMLPhisher	Browse
	http://tracking.elastic.iscarcup.com/tracking/click?d=XVOGkKKIFI1BUi5gqgZHAdRPhk99njZvP0qXh2IpArKp9RzCSjeoWkfJDrjbcvw75j380eQ4qSrYjhK4RegFgVWSX5L2beQO2AeFGF72kzLV5bUDHAc9_x1G5mw8AznhlHtuepCFbAQZbboWjeiG8YOae_yZBP5-luynay2YDr9Jmf0rVcJIVEgp8xRayU7B_A2	Get hash	malicious	Unknown	Browse
	http://monacolife.net	Get hash	malicious	Unknown	Browse
	http://www.sushi-idea.com	Get hash	malicious	Unknown	Browse
	https://support-for-business-marketing.vercel.app/appeal_case_id#132654589681	Get hash	malicious	Unknown	Browse
	VnSRmWE631.html	Get hash	malicious	Unknown	Browse
	nBBR7c5gR5.html	Get hash	malicious	Unknown	Browse
	https://www.joesandbox.com/login	Get hash	malicious	Unknown	Browse
152.199.4.44	https://cvn7.sa.com/invoice.html?app=	Get hash	malicious	HTMLPhisher	Browse
	Payment Receipt .html	Get hash	malicious	HTMLPhisher	Browse
	https://www.canva.com/design/DAGCxF7mFTo/x_4mk65cpl5G5aJF2UYVbw/view?utm_content=DAGCxF7mFTo&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse
	http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=esi-doc.one/YWGTytNgAkCXj6A/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/bXNvbG9yemFub0Bsc2ZjdS5vcmc=&d=DwMGaQ	Get hash	malicious	HTMLPhisher	Browse
	https://assets-gbr.mkt.dynamics.com/63445ada-d6fc-ee11-9046-002248c656ac/digitalassets/standaloneforms/4f16ddf0-7afd-ee11-a1fe-000d3ad499fa	Get hash	malicious	HTMLPhisher	Browse
	https://csactivation.carestreamdental.com/ViewSwitcher/SwitchView?mobile=True&returnUrl=https://bpy.us/moTxvQ3E4RAm3ToTxn2APa4RAchQ3E4RAD5QyD5Qm3TQ3EmD5Qz01coTxm&mc=101631	Get hash	malicious	Unknown	Browse
	http://t.co/IcNMLUH6OE	Get hash	malicious	HTMLPhisher	Browse
	http://t.cm.morganstanley.com/r/?id=h1b92d14%2C134cc33c%2C1356be32&p1=www.saiengroup.com%2Fteaz%2F648c482b60b3906833c9304bab170add%2FJBVNhz%2FYW15LmNoZW5AZG91YmxlbGluZS5jb20=	Get hash	malicious	HTMLPhisher	Browse
	https://17apmic5.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse
	https://tukix.net/qp9sKz1A43Pt/news/d1022596bf248601809305df44e8f1f4////dGNvb3BlckBod25lbmVyZ3kuY29t	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
d26p066pn2w0s0.cloudfront.net	Voicemail Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	108.138.106.26
	https://cloudflare-ipfs.com/ipfs/bafybeihqnui3i43lph6svx56opzeyj3gyyzxjf3s5i5l3mdj2klv5eneem/?openboxmailer/auto/eMail.web/987FTmail.authenticate/checking_auth0/authenticate-userid/84778949884903948993839/#Claudia.Giarratana.ext@daiichi-sankyo.it	Get hash	malicious	HTMLPhisher	Browse	108.138.106.32
	https://atsginc.com@google.co.uk/%61%6D%70/%73/%F0%9F%84%B8%F0%9F%85%82.%E2%93%96%E2%93%93/zAtZ30%23anastassiya.gainey@atsginc.com	Get hash	malicious	HTMLPhisher	Browse	52.85.151.18
	https://dish.com@google.co.uk/%61%6D%70/%73/%F0%9F%84%B8%F0%9F%85%82.%E2%93%96%E2%93%93/zAtZ30%23audra.ritter@dish.com	Get hash	malicious	HTMLPhisher	Browse	52.85.151.31
	http://https:lcatterton.com@google.co.uk/%61%6D%70/%73/%F0%9F%84%B8%F0%9F%85%82.%E2%93%96%E2%93%93/zAtZ30%23amanda.materasso@lcatterton.com	Get hash	malicious	HTMLPhisher	Browse	52.85.151.31
	message (1).eml	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse	18.173.166.66
	https://cf-ipfs.com/ipfs/QmfHaQHtJgXPdht1BAJyLikoDjhp3gXvGRo72QgUS3ibYe#msp.handgunpermits@maryland.gov	Get hash	malicious	HTMLPhisher	Browse	52.85.151.109
	https://topteamoscarlubricants.online/nba#ZGluYUBqdmRtLmNvLnph	Get hash	malicious	HTMLPhisher	Browse	52.85.151.31
	https://cloudflare-ipfs.com/ipfs/bafybeific5oh7p6dvnpe2yvzaxfuvvaf5c6xpacgz774hqgtk4xznu2v5m/#r.cortes@system-asefin.com	Get hash	malicious	HTMLPhisher	Browse	52.85.151.98
	I_ REF _ Due Debt 25_03_2024.msg	Get hash	malicious	HTMLPhisher	Browse	52.85.151.109
cs1100.wpc.omegacdn.net	https://cvn7.sa.com/invoice.html?app=	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://18apmic18.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	152.199.4.44
	Payment Receipt .html	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://www.canva.com/design/DAGCxF7mFTo/x_4mk65cpl5G5aJF2UYVbw/view?utm_content=DAGCxF7mFTo&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=esi-doc.one/YWGTytNgAkCXj6A/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/bXNvbG9yemFub0Bsc2ZjdS5vcmc=&d=DwMGaQ	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://assets-gbr.mkt.dynamics.com/63445ada-d6fc-ee11-9046-002248c656ac/digitalassets/standaloneforms/4f16ddf0-7afd-ee11-a1fe-000d3ad499fa	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	rapport.docx_POH.docx	Get hash	malicious	Unknown	Browse	152.199.4.44
	https://csactivation.carestreamdental.com/ViewSwitcher/SwitchView?mobile=True&returnUrl=https://bpy.us/moTxvQ3E4RAm3ToTxn2APa4RAchQ3E4RAD5QyD5Qm3TQ3EmD5Qz01coTxm&mc=101631	Get hash	malicious	Unknown	Browse	152.199.4.44
	http://t.co/IcNMLUH6OE	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	http://t.cm.morganstanley.com/r/?id=h1b92d14%2C134cc33c%2C1356be32&p1=www.saiengroup.com%2Fteaz%2F648c482b60b3906833c9304bab170add%2FJBVNhz%2FYW15LmNoZW5AZG91YmxlbGluZS5jb20=	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
ip-api.com	DHL.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	208.95.112.1
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win64.Evo-gen.10533.31255.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	13w4NM6mPa.exe	Get hash	malicious	LummaC	Browse	208.95.112.1
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Shipping Dcuments_CI PKL_HL_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	transferencia_BBVA_97866456345354678976543425678.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	XioVUcbE3G.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	s02RKS8Moh.elf	Get hash	malicious	Unknown	Browse	54.247.62.1
	igIKGnfg87.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	Play_NewMessage_17April2024_Audio.htm	Get hash	malicious	Unknown	Browse	108.156.152.88
	$RWRW8GN.exe	Get hash	malicious	Unknown	Browse	13.33.19.164
	https://support-for-business-marketing.vercel.app/appeal_case_id#132654589681	Get hash	malicious	Unknown	Browse	76.76.21.123
	https://www.joesandbox.com/login	Get hash	malicious	Unknown	Browse	54.230.31.76
	https://www.we-conect.io/	Get hash	malicious	Unknown	Browse	3.77.226.233
	SecuriteInfo.com.Win64.Evo-gen.10533.31255.exe	Get hash	malicious	Unknown	Browse	45.112.123.227
	https://jobrad.us1.list-manage.com/track/click?u=9c40c69097d5cc62620fab666&id=4174455835&e=1c8272e83c	Get hash	malicious	Unknown	Browse	54.73.64.222
TUT-ASUS	DHL.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	208.95.112.1
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win64.Evo-gen.10533.31255.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	13w4NM6mPa.exe	Get hash	malicious	LummaC	Browse	208.95.112.1
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Shipping Dcuments_CI PKL_HL_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	transferencia_BBVA_97866456345354678976543425678.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
EDGECASTUS	http://monacolife.net	Get hash	malicious	Unknown	Browse	152.199.5.152
	https://www.joesandbox.com/login	Get hash	malicious	Unknown	Browse	152.199.5.152
	https://cvn7.sa.com/invoice.html?app=	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	Payment Receipt .html	Get hash	malicious	HTMLPhisher	Browse	72.21.91.237
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FBigge/aDRmd79087aDRmd79087aDRmd/ZHN3ZWF6YUBiaWdnZS5jb20=	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97
	https://www.canva.com/design/DAGCxF7mFTo/x_4mk65cpl5G5aJF2UYVbw/view?utm_content=DAGCxF7mFTo&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=esi-doc.one/YWGTytNgAkCXj6A/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/bXNvbG9yemFub0Bsc2ZjdS5vcmc=&d=DwMGaQ	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://recouvrement-assurance.fr/LKeZL	Get hash	malicious	Unknown	Browse	152.199.24.185
	https://assets-gbr.mkt.dynamics.com/63445ada-d6fc-ee11-9046-002248c656ac/digitalassets/standaloneforms/4f16ddf0-7afd-ee11-a1fe-000d3ad499fa	Get hash	malicious	HTMLPhisher	Browse	192.229.173.207
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FC2educate/aEFQv26188aEFQv26188aEFQv/anVsaWUubG9uZ2lub0BjMmVkdWNhdGUuY29t	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	VnSRmWE631.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	xYUpeXwPkWEHXm4.exe	Get hash	malicious	AgentTesla	Browse	23.1.237.91
	nBBR7c5gR5.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	dwutTyDPzl2TBZV.exe	Get hash	malicious	AgentTesla	Browse	23.1.237.91
	https://ilo.slepptek.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	23.1.237.91
	https://sdcoes.net/LandingPage/Index/122/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://huiyuan-sh.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://netflixfreeprimeofficle.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	http://www.pdfconvertercompare.com	Get hash	malicious	Unknown	Browse	23.216.73.151 20.114.59.183
	https://jll2.sharepoint.com/:f:/t/WorkplaceStrategy274/EqyxzpLxD8lEhSn1hXMNtKMBbmoik8-xeuIbHrYk7cgngA?e=5%3a2wyFQq&at=9&xsdata=MDV8MDJ8cGF0cmljaWEucmliZWlyb0Bub3ZvYmFuY28ucHR8NjlmMTdkMWU5YzBjNDFkN2UwZmIwOGRjNTNjN2YwZTV8MTAzMzgwNDgxOTNhNDI5OGFiZWEzNTk2YWU4OGIwNWV8MHwwfDYzODQ3NzM2NTQwMjI0OTQwNXxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=T2RkZHdHdHpwUXkxSG5Kd2Noc1RHVUc3YVNLVE1sOWZUTXdVZitYYXh6Yz0%3d	Get hash	malicious	HTMLPhisher	Browse	23.216.73.151 20.114.59.183
	http://tracking.elastic.iscarcup.com/tracking/click?d=XVOGkKKIFI1BUi5gqgZHAdRPhk99njZvP0qXh2IpArKp9RzCSjeoWkfJDrjbcvw75j380eQ4qSrYjhK4RegFgVWSX5L2beQO2AeFGF72kzLV5bUDHAc9_x1G5mw8AznhlHtuepCFbAQZbboWjeiG8YOae_yZBP5-luynay2YDr9Jmf0rVcJIVEgp8xRayU7B_A2	Get hash	malicious	Unknown	Browse	23.216.73.151 20.114.59.183
	http://monacolife.net	Get hash	malicious	Unknown	Browse	23.216.73.151 20.114.59.183
	http://www.sushi-idea.com	Get hash	malicious	Unknown	Browse	23.216.73.151 20.114.59.183
	ServerInfo.exe	Get hash	malicious	Unknown	Browse	23.216.73.151 20.114.59.183
	https://support-for-business-marketing.vercel.app/appeal_case_id#132654589681	Get hash	malicious	Unknown	Browse	23.216.73.151 20.114.59.183
	VnSRmWE631.html	Get hash	malicious	Unknown	Browse	23.216.73.151 20.114.59.183
	nBBR7c5gR5.html	Get hash	malicious	Unknown	Browse	23.216.73.151 20.114.59.183
	eInvoicing_pdf.vbs	Get hash	malicious	FormBook	Browse	23.216.73.151 20.114.59.183

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:13:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9812925396174075
Encrypted:	false
SSDEEP:	48:8FdETogEH5idAKZdA19ehwiZUklqehLy+3:8c3m0y
MD5:	57ABAABEC0F678450168A53D8788A177
SHA1:	94CF3E34743CC4594F750015B597D274AE210611
SHA-256:	4F750AFBF9B7CFE34EAD396FF7804BA933924FF4BCDB25388C3E361F033C0D75
SHA-512:	BA23FE48686E8F33E35817907CC9BF712A849AD938D8A9E8E2A732595EE6FB039D15193B169823FCAEFC3DAD66250479BCE0EDD4CB22788A0BBCC9E90857BF4E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......n.9...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............q.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:13:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9955051013213088
Encrypted:	false
SSDEEP:	48:8pdETogEH5idAKZdA1weh/iZUkAQkqehky+2:8A3k9QVy
MD5:	CC8157A5EE59CF92CC107DB0C7F0C7AA
SHA1:	58DD11A23CA057B793C9A0AA1805E6920E00C6DB
SHA-256:	45C14C254727DFC7E87DE938550772DE1BF7326C15BDD7F041689FFAE4A12381
SHA-512:	030208583DAE23C3454436445D420A8B2BA8CF89DB783DD114C1210870A632A2A56C9D8D1576AE9AD2AD532000FA746A3EE040402A221E840A7C0F3BC543A024
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....-q`.9...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............q.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.007922903495509
Encrypted:	false
SSDEEP:	48:8x5dETogsH5idAKZdA14tseh7sFiZUkmgqeh7s+y+BX:8xQ3Enoy
MD5:	C3048F0F3BE7F1239F02150E45ED38E0
SHA1:	6526ECF936B7B3575050C8CC7B305C5270BC313B
SHA-256:	7EAD3C98FA8A94CD3D6931DABFBC60B9721EAC4FED46EEDB90B4EA564880C75B
SHA-512:	84BAE565B8BC4A7AD59BDE6DAA888B920E61BF9E930928F61F36975E4DAB80603E8951E44763510BBF7A865793CE0540890977AC5589794FA44F98E83BA4F94F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............q.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:13:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9958050819196393
Encrypted:	false
SSDEEP:	48:8NdETogEH5idAKZdA1vehDiZUkwqehAy+R:8E3v2y
MD5:	8DF36450779CB5B9CB116B07B2EFF532
SHA1:	DA49A46D4FF7B350975A72BCE2203EDB52EEF990
SHA-256:	C8C726413BB06A871509BD59E5BD245A391482485E2058F96D617E3F9484F7AA
SHA-512:	EF003F8F17A2646F4E29F7124CB9100E964C72CEDD913C2797679073D1BD765F823E61ADA6F7B673E65342A7A2E9D29CAC4EB2B326B0BA1A30665F68B9A05D60
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....XZ.9...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............q.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:13:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9829317034251837
Encrypted:	false
SSDEEP:	48:8MqdETogEH5idAKZdA1hehBiZUk1W1qehyy+C:8U3P9Sy
MD5:	EF5FA322EF105EA4F96EFC130A44CBB8
SHA1:	3D32E7B356C82FADF1DFA4901C32BFCC6FCEBC2E
SHA-256:	2F47DA716656BA0EC577274C98F524D7E2E8E65ACA10BB7C908F54810B2634F5
SHA-512:	B5F9D0005E4E9DCB8F6F40D1C27A94629FB3BFBCC2D8568035023552259A5FC51433AD9155B5C5D885CB6FDBA5907C8E497236C15857676A5B5203764B90047D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....84j.9...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............q.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 08:13:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9947964091986665
Encrypted:	false
SSDEEP:	48:8fdETogEH5idAKZdA1duT+ehOuTbbiZUk5OjqehOuTboy+yT+:8i3HT/TbxWOvTboy7T
MD5:	ABF20D633643B0562DC27F893BF2E84B
SHA1:	AA08B0A67264454F94E9C900296C72A43A5A18B9
SHA-256:	54DC46044F5D86CA6EDCEF3F7E1D9441AE0FA29EFE0A656C8E7CBB9D837A9E88
SHA-512:	58618E1864251AB3E350FDD4085EF3295011911637B45BA1C894D2E32BF0115D2693B354F609ADA577EA652D96A720CA1481EEC7570FBC235E6784A6D41BAFB2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....w6E.9...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............q.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	10674
Entropy (8bit):	7.965280609095081
Encrypted:	false
SSDEEP:	192:qdF1gV1Hn/z1sUvLWSiYQsl4SvJB/KZ6kgg8NsorTlHbOmcSud:a1gbBDD+4FbkggxqTYZSO
MD5:	3F3EDB226B846AAC1DF8F6A25E6BDD96
SHA1:	7B753F82782402750A88047A9225C9662F0A9775
SHA-256:	1BA36DCC366A027145E713377EBFD43CA47D9C9284D24113CAB786CE4F69D4C0
SHA-512:	B8BBAE997375A0E75D44CC4008516BFB3516195F0A832ACFAC7F5F6E36748F5AEF3DF3CE433439C4CA457E2FC4DF3ACD016DE14C62074A1DB6107E4375AACFEE
Malicious:	false
Reputation:	low
URL:	https://logo.clearbit.com/daiichi-sankyo.at
Preview:	.PNG........IHDR.............L\....)yIDATx....dU.'\|..-...Y..RP.R,..%hK....-...8.=......q.m......e....P..sA..KPP....j...X.{..s.....U...9t...IFe.[.......<...\_..u..`.i..9.y.....c..`.i..9.y.....c..`.i..9.y.....c..`.i..9.y.....c..`.i..9&=.'...@.;..F@.:.#......kq.............$....38U.F.aDj..s`~..?..-.k.\.AH.D@.P...3kt..".....l.sC.l$c1.&IbS.N...F..a...U .Y.......&....\.....@;....vE.@.......T..M2.......CO.....A;..G.U....G...b.U.....wt....<..x..=G.(w.\0......{..`J...P.4.&.%..o.....+.+I.c6..?.....m.\|_.{...R..2.]R.,.t....\=.......4fF;..w.......3..o\.....$.....6.TS#...\..@0."0..4.^...B0,.RC3.......;v......i.b..a..,....D.u..3v._...;...e.p.c./..W..]p.i.[{rO. .-@.`..Ff...Q.f..dAj.c.....\}.7=v.V.M#.Q...c..%..6..!.dDR$*H.v..2Rf8..R.ZWsA...!.M&.. ..U..Wo.w./^]\...j..'..5,.........X.B.......7..(.N.nU.()..=..j..E2...jq.D..U$..P.@.`..h.`"..).;5.q.`..PFY.:..8...7....N .8.AL....@....p.f....g-jb..d.....-7.lmiOGO..P...CU..,....c.:..@P...."....L..)@e.k...SU.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	10674
Entropy (8bit):	7.965280609095081
Encrypted:	false
SSDEEP:	192:qdF1gV1Hn/z1sUvLWSiYQsl4SvJB/KZ6kgg8NsorTlHbOmcSud:a1gbBDD+4FbkggxqTYZSO
MD5:	3F3EDB226B846AAC1DF8F6A25E6BDD96
SHA1:	7B753F82782402750A88047A9225C9662F0A9775
SHA-256:	1BA36DCC366A027145E713377EBFD43CA47D9C9284D24113CAB786CE4F69D4C0
SHA-512:	B8BBAE997375A0E75D44CC4008516BFB3516195F0A832ACFAC7F5F6E36748F5AEF3DF3CE433439C4CA457E2FC4DF3ACD016DE14C62074A1DB6107E4375AACFEE
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............L\....)yIDATx....dU.'\|..-...Y..RP.R,..%hK....-...8.=......q.m......e....P..sA..KPP....j...X.{..s.....U...9t...IFe.[.......<...\_..u..`.i..9.y.....c..`.i..9.y.....c..`.i..9.y.....c..`.i..9.y.....c..`.i..9&=.'...@.;..F@.:.#......kq.............$....38U.F.aDj..s`~..?..-.k.\.AH.D@.P...3kt..".....l.sC.l$c1.&IbS.N...F..a...U .Y.......&....\.....@;....vE.@.......T..M2.......CO.....A;..G.U....G...b.U.....wt....<..x..=G.(w.\0......{..`J...P.4.&.%..o.....+.+I.c6..?.....m.\|_.{...R..2.]R.,.t....\=.......4fF;..w.......3..o\.....$.....6.TS#...\..@0."0..4.^...B0,.RC3.......;v......i.b..a..,....D.u..3v._...;...e.p.c./..W..]p.i.[{rO. .-@.`..Ff...Q.f..dAj.c.....\}.7=v.V.M#.Q...c..%..6..!.dDR$*H.v..2Rf8..R.ZWsA...!.M&.. ..U..Wo.w./^]\...j..'..5,.........X.B.......7..(.N.nU.()..=..j..E2...jq.D..U$..P.@.`..h.`"..).;5.q.`..PFY.:..8...7....N .8.AL....@....p.f....g-jb..d.....-7.lmiOGO..P...CU..,....c.:..@P...."....L..)@e.k...SU.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	109
Entropy (8bit):	4.47214660131935
Encrypted:	false
SSDEEP:	3:YWR4buWsyLMfQxaNmX/QIiEEpGQ48HJHJA6kLrCHY:YWybucxaNmX4Iu34WJHJ0LrEY
MD5:	1AC6C77BB7DC8E064C78ED493EF59DEE
SHA1:	8631706EC97390E9F5BC41081E0ACD3D8B4EFCDA
SHA-256:	AC5A15B790FCF58655780CC21293B8706AADD6AA74B089E71AD325FBB7E92F8A
SHA-512:	CFD268C359E437BC9921230A8E3938BFF91CF134791074E1C46F2EDA6AEB2C0EA11DC2BC51DA9E426CE72AD3BFBAD5489403DE867640DD51F18EF52134DA59BE
Malicious:	false
Reputation:	low
URL:	"http://ip-api.com/json/?fields=status,country,regionName,city,query"
Preview:	{"status":"success","country":"United States","regionName":"Georgia","city":"Atlanta","query":"81.181.57.52"}

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	109
Entropy (8bit):	4.47214660131935
Encrypted:	false
SSDEEP:	3:YWR4buWsyLMfQxaNmX/QIiEEpGQ48HJHJA6kLrCHY:YWybucxaNmX4Iu34WJHJ0LrEY
MD5:	1AC6C77BB7DC8E064C78ED493EF59DEE
SHA1:	8631706EC97390E9F5BC41081E0ACD3D8B4EFCDA
SHA-256:	AC5A15B790FCF58655780CC21293B8706AADD6AA74B089E71AD325FBB7E92F8A
SHA-512:	CFD268C359E437BC9921230A8E3938BFF91CF134791074E1C46F2EDA6AEB2C0EA11DC2BC51DA9E426CE72AD3BFBAD5489403DE867640DD51F18EF52134DA59BE
Malicious:	false
Reputation:	low
Preview:	{"status":"success","country":"United States","regionName":"Georgia","city":"Atlanta","query":"81.181.57.52"}

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61177)
Category:	downloaded
Size (bytes):	110554
Entropy (8bit):	5.287120567085247
Encrypted:	false
SSDEEP:	1536:QpHDgBvguhw+EViazA/PWrF7qvEAFiQcpmU4eCgzc6VUgs:xktA6VUf
MD5:	CE26137FC0D9B7D7A0D52EBE3A186512
SHA1:	B9D7FB3FE7D08F46C2D1153BB47B13809375C663
SHA-256:	1304C5090F063C677A5B3720FE7B97EF4D9EA102E2BDD837CE399DF6057FE385
SHA-512:	6A189C0858A150E6388648895B1950EF31284EA90795E4D45FD7E53F35AA364E49473367FD2142552A145CFC48CA89D8CB13B4F1B9039E050CF4E70026393E0A
Malicious:	false
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	88145
Entropy (8bit):	5.291106244832159
Encrypted:	false
SSDEEP:	1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe
MD5:	220AFD743D9E9643852E31A135A9F3AE
SHA1:	88523924351BAC0B5D560FE0C5781E2556E7693D
SHA-256:	0925E8AD7BD971391A8B1E98BE8E87A6971919EB5B60C196485941C3C1DF089A
SHA-512:	6E722FCE1E8553BE592B1A741972C7F5B7B0CDAFCE230E9D2D587D20283482881C96660682E4095A5F14DF45A96EC193A9B222030C53B1B7BBE8312B2EAE440D
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
Preview:	/! jQuery v3.4.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],E=C.document,r=Object.getPrototypeOf,s=t.slice,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (42404), with CRLF line terminators
Entropy (8bit):	5.426233377388408
TrID:	HyperText Markup Language (13008/1) 61.90% HTML Application (8008/1) 38.10%
File name:	New Voicemail_Daiichi-Sankyo.html
File size:	46'797 bytes
MD5:	fad4e997eaeea62578413ea678476cd9
SHA1:	ad0babd4c6385c478c78100139e329dee20be319
SHA256:	05b643d7aed6dfef151821ec1ac1eef67d7a2cf887633eb98a5639405bde79d1
SHA512:	ba89538ad6faf974db3b4d49f47430d7f7de1bc05841f7b3ef29a134cd46c89a5788ce04f25fa9ea07018c06b9c8635136f0837d39ce6917f2d6d69a72cfacb0
SSDEEP:	768:/lhXxq+2Qak+KRhz18M7l/lxqahkkRLfPLG:/lxAkJdP6
TLSH:	072394F193938CD58DAAF82FF15D5B53CA20A757DD8B40E030E6E249A7E4F618D622C4
File Content Preview:	<script>....var email = "info@daiichi-sankyo.at";....</script>..<html>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Sign in to your account</title>.. <meta http-equiv="X-UA-Compatible" content="IE=edge">.. <me

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:13:15.450151920 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:15.450186968 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:15.590888023 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:20.956366062 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:20.956446886 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:20.956528902 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:20.956780910 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:20.956805944 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.287507057 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.288770914 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.288830042 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.290508986 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.290646076 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.294210911 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.294361115 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.294388056 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.294533014 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.337955952 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.338012934 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.387254000 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.488612890 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.488806963 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.488826036 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.488846064 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.488888025 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.488909960 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.488990068 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.488990068 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.488990068 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.488990068 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.489063025 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.489105940 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.489134073 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.489140987 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.489154100 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.489198923 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.489211082 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.489217043 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.489239931 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.489257097 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.489497900 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.489497900 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.592782021 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.592844963 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.592891932 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.592957973 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.592994928 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.592997074 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.593053102 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.593250990 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.593250990 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.593312979 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.593575001 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.632399082 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.632461071 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.632621050 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.632621050 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.632683992 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.632838011 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.684552908 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.684622049 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.684678078 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.684743881 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.684809923 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.684809923 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.697323084 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.697391987 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.697423935 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.697489977 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.697542906 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.697571039 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.697663069 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.698179007 CEST	49709	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.698239088 CEST	443	49709	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.773855925 CEST	49712	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.773936033 CEST	443	49712	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.774053097 CEST	49712	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.774425983 CEST	49712	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:21.774493933 CEST	443	49712	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:21.899337053 CEST	49713	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:21.899406910 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:21.899471998 CEST	49713	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:21.899698019 CEST	49713	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:21.899725914 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:21.951886892 CEST	49714	80	192.168.2.5	208.95.112.1
Apr 19, 2024 11:13:22.069502115 CEST	80	49714	208.95.112.1	192.168.2.5
Apr 19, 2024 11:13:22.069688082 CEST	49714	80	192.168.2.5	208.95.112.1
Apr 19, 2024 11:13:22.069886923 CEST	49714	80	192.168.2.5	208.95.112.1
Apr 19, 2024 11:13:22.093564987 CEST	443	49712	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.094048023 CEST	49712	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.094105959 CEST	443	49712	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.095819950 CEST	443	49712	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.096014023 CEST	49712	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.096321106 CEST	49712	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.096399069 CEST	49712	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.096424103 CEST	443	49712	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.096453905 CEST	443	49712	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.124209881 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.124444962 CEST	49713	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.124464989 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.126158953 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.126219988 CEST	49713	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.127331972 CEST	49713	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.127427101 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.127494097 CEST	49713	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.127500057 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.154722929 CEST	49712	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.154779911 CEST	443	49712	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.243300915 CEST	80	49714	208.95.112.1	192.168.2.5
Apr 19, 2024 11:13:22.260688066 CEST	49713	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.260808945 CEST	49712	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.310955048 CEST	443	49712	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.311044931 CEST	443	49712	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.311197996 CEST	443	49712	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.311405897 CEST	49712	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.311949968 CEST	49712	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.311989069 CEST	443	49712	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.318846941 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.318912983 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.319973946 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.320312977 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.320337057 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.377161980 CEST	49717	80	192.168.2.5	208.95.112.1
Apr 19, 2024 11:13:22.426307917 CEST	49718	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.426347017 CEST	443	49718	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.426434994 CEST	49718	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.426640034 CEST	49718	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.426651955 CEST	443	49718	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.453943014 CEST	49714	80	192.168.2.5	208.95.112.1
Apr 19, 2024 11:13:22.475383997 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.475430012 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.475439072 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.475467920 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.475480080 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.475554943 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.475563049 CEST	49713	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.475637913 CEST	49713	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.485646009 CEST	49713	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.485677004 CEST	443	49713	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.497176886 CEST	80	49717	208.95.112.1	192.168.2.5
Apr 19, 2024 11:13:22.497462034 CEST	49717	80	192.168.2.5	208.95.112.1
Apr 19, 2024 11:13:22.531807899 CEST	49717	80	192.168.2.5	208.95.112.1
Apr 19, 2024 11:13:22.645009995 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.645320892 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.645355940 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.645436049 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.645577908 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.645636082 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.645664930 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.645680904 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.646449089 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.646872997 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.646872997 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.646961927 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.647043943 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.689073086 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.711986065 CEST	80	49717	208.95.112.1	192.168.2.5
Apr 19, 2024 11:13:22.746978045 CEST	443	49718	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.750729084 CEST	49718	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.750768900 CEST	443	49718	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.751827002 CEST	443	49718	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.751912117 CEST	49718	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.752655983 CEST	49718	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.752720118 CEST	443	49718	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.752965927 CEST	49718	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.752974033 CEST	443	49718	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.767471075 CEST	49717	80	192.168.2.5	208.95.112.1
Apr 19, 2024 11:13:22.807718039 CEST	49718	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.853179932 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.853486061 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.853517056 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.853575945 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.853626013 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.853651047 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.853738070 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.853790045 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.853790998 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.853853941 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.853868008 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.853945971 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.853946924 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.854017973 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.867470980 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.920341969 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.934353113 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.934369087 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.938062906 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.938095093 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.938158989 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.939104080 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.939308882 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.939560890 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:22.939578056 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:22.940231085 CEST	49715	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.940298080 CEST	443	49715	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.959897041 CEST	443	49718	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.959940910 CEST	443	49718	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.960002899 CEST	443	49718	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.960028887 CEST	49718	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.960095882 CEST	49718	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.963965893 CEST	49718	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.963988066 CEST	443	49718	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.984543085 CEST	49720	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.984639883 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.984746933 CEST	49720	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.985068083 CEST	49720	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:22.985102892 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:22.993730068 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:23.133268118 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:23.133295059 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:23.133305073 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:23.133327961 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:23.133339882 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:23.133383989 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:23.133399963 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:23.133429050 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:23.133431911 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:23.133486032 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:23.277600050 CEST	49719	443	192.168.2.5	3.161.136.96
Apr 19, 2024 11:13:23.277628899 CEST	443	49719	3.161.136.96	192.168.2.5
Apr 19, 2024 11:13:23.312985897 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:23.314266920 CEST	49720	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:23.314323902 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:23.314982891 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:23.316243887 CEST	49720	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:23.316339016 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:23.316561937 CEST	49720	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:23.364145994 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:23.523694038 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:23.523858070 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:23.523902893 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:23.523963928 CEST	49720	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:23.524029970 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:23.524070978 CEST	49720	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:23.524147987 CEST	49720	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:23.524162054 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:23.524204969 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:23.524219036 CEST	49720	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:23.524265051 CEST	49720	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:23.564997911 CEST	49720	443	192.168.2.5	152.199.4.44
Apr 19, 2024 11:13:23.565057993 CEST	443	49720	152.199.4.44	192.168.2.5
Apr 19, 2024 11:13:25.057769060 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:25.057883024 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:25.198415995 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:25.378505945 CEST	49724	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:13:25.378551960 CEST	443	49724	64.233.176.103	192.168.2.5
Apr 19, 2024 11:13:25.378650904 CEST	49724	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:13:25.391072035 CEST	49724	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:13:25.391097069 CEST	443	49724	64.233.176.103	192.168.2.5
Apr 19, 2024 11:13:25.619415998 CEST	443	49724	64.233.176.103	192.168.2.5
Apr 19, 2024 11:13:25.622941017 CEST	49724	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:13:25.622963905 CEST	443	49724	64.233.176.103	192.168.2.5
Apr 19, 2024 11:13:25.624510050 CEST	443	49724	64.233.176.103	192.168.2.5
Apr 19, 2024 11:13:25.624593019 CEST	49724	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:13:25.644753933 CEST	49724	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:13:25.645206928 CEST	443	49724	64.233.176.103	192.168.2.5
Apr 19, 2024 11:13:25.697407961 CEST	49724	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:13:25.697423935 CEST	443	49724	64.233.176.103	192.168.2.5
Apr 19, 2024 11:13:25.744271040 CEST	49724	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:13:25.943613052 CEST	49725	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:25.943695068 CEST	443	49725	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:25.943991899 CEST	49725	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:25.947237015 CEST	49725	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:25.947314024 CEST	443	49725	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.177346945 CEST	443	49725	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.177448034 CEST	49725	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.180803061 CEST	49725	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.180854082 CEST	443	49725	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.181284904 CEST	443	49725	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.228857994 CEST	49725	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.314085960 CEST	49725	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.356148958 CEST	443	49725	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.422360897 CEST	443	49725	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.422684908 CEST	49725	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.422749996 CEST	443	49725	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.422791004 CEST	443	49725	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.422791958 CEST	49725	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.422821999 CEST	443	49725	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.452172041 CEST	49726	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.452250004 CEST	443	49726	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.452354908 CEST	49726	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.452873945 CEST	49726	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.452951908 CEST	443	49726	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.577272892 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:26.577398062 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:26.673044920 CEST	443	49726	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.673157930 CEST	49726	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.674880981 CEST	49726	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.674891949 CEST	443	49726	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.675220966 CEST	443	49726	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.676409960 CEST	49726	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.724113941 CEST	443	49726	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.879725933 CEST	443	49726	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.879919052 CEST	443	49726	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.880498886 CEST	49726	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.931354046 CEST	49726	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.931354046 CEST	49726	443	192.168.2.5	23.216.73.151
Apr 19, 2024 11:13:26.931416988 CEST	443	49726	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:26.931459904 CEST	443	49726	23.216.73.151	192.168.2.5
Apr 19, 2024 11:13:35.625842094 CEST	443	49724	64.233.176.103	192.168.2.5
Apr 19, 2024 11:13:35.626015902 CEST	443	49724	64.233.176.103	192.168.2.5
Apr 19, 2024 11:13:35.626087904 CEST	49724	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:13:35.927213907 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:35.927253008 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:35.927311897 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:35.928636074 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:35.928656101 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:36.452152967 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:36.452222109 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:36.488135099 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:36.488159895 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:36.489173889 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:36.542133093 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:36.693497896 CEST	49724	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:13:36.693572044 CEST	443	49724	64.233.176.103	192.168.2.5
Apr 19, 2024 11:13:37.275974989 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:37.320116997 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:37.330343008 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:37.330501080 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:37.331857920 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:37.331959963 CEST	443	49738	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:37.332154989 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:37.332662106 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:37.332686901 CEST	443	49738	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:37.482570887 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:37.482599974 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:37.606345892 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:37.606406927 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:37.606429100 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:37.606472969 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:37.606478930 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:37.606499910 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:37.606511116 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:37.606519938 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:37.606549025 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:37.606554985 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:37.606568098 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:37.606604099 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:37.606735945 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:37.606797934 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:37.606806993 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:37.606925964 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:37.607127905 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:37.658158064 CEST	443	49738	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:37.658245087 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:37.851428986 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:37.851512909 CEST	443	49738	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:37.851979971 CEST	443	49738	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:37.852057934 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:37.852650881 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:37.852695942 CEST	443	49738	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:37.852864981 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:37.852879047 CEST	443	49738	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:38.168582916 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:38.168611050 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:38.168621063 CEST	49733	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:13:38.168626070 CEST	443	49733	20.114.59.183	192.168.2.5
Apr 19, 2024 11:13:38.231466055 CEST	443	49738	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:38.231583118 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:38.231940985 CEST	443	49738	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:38.232012033 CEST	443	49738	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:38.232023001 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:38.232049942 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:38.354024887 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:38.354053020 CEST	443	49738	23.1.237.91	192.168.2.5
Apr 19, 2024 11:13:38.354063988 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:38.354105949 CEST	49738	443	192.168.2.5	23.1.237.91
Apr 19, 2024 11:13:53.349965096 CEST	80	49717	208.95.112.1	192.168.2.5
Apr 19, 2024 11:13:53.350050926 CEST	49717	80	192.168.2.5	208.95.112.1
Apr 19, 2024 11:13:55.073421001 CEST	49717	80	192.168.2.5	208.95.112.1
Apr 19, 2024 11:13:55.191606045 CEST	80	49717	208.95.112.1	192.168.2.5
Apr 19, 2024 11:13:56.720273972 CEST	80	49714	208.95.112.1	192.168.2.5
Apr 19, 2024 11:13:56.720393896 CEST	49714	80	192.168.2.5	208.95.112.1
Apr 19, 2024 11:13:57.072988033 CEST	49714	80	192.168.2.5	208.95.112.1
Apr 19, 2024 11:13:57.191066027 CEST	80	49714	208.95.112.1	192.168.2.5
Apr 19, 2024 11:14:14.650465012 CEST	49741	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:14:14.650512934 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:14.650609970 CEST	49741	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:14:14.651233912 CEST	49741	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:14:14.651247978 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:15.176287889 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:15.176372051 CEST	49741	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:14:15.180919886 CEST	49741	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:14:15.180928946 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:15.181272030 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:15.193206072 CEST	49741	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:14:15.240134954 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:15.685887098 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:15.685920000 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:15.685939074 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:15.686042070 CEST	49741	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:14:15.686057091 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:15.686093092 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:15.686151028 CEST	49741	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:14:15.686167002 CEST	49741	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:14:15.697585106 CEST	49741	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:14:15.697603941 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:15.697720051 CEST	49741	443	192.168.2.5	20.114.59.183
Apr 19, 2024 11:14:15.697726965 CEST	443	49741	20.114.59.183	192.168.2.5
Apr 19, 2024 11:14:25.501027107 CEST	49743	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:14:25.501055956 CEST	443	49743	64.233.176.103	192.168.2.5
Apr 19, 2024 11:14:25.501178026 CEST	49743	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:14:25.501498938 CEST	49743	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:14:25.501518011 CEST	443	49743	64.233.176.103	192.168.2.5
Apr 19, 2024 11:14:25.720942020 CEST	443	49743	64.233.176.103	192.168.2.5
Apr 19, 2024 11:14:25.721443892 CEST	49743	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:14:25.721465111 CEST	443	49743	64.233.176.103	192.168.2.5
Apr 19, 2024 11:14:25.722554922 CEST	443	49743	64.233.176.103	192.168.2.5
Apr 19, 2024 11:14:25.723469973 CEST	49743	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:14:25.723550081 CEST	443	49743	64.233.176.103	192.168.2.5
Apr 19, 2024 11:14:25.775116920 CEST	49743	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:14:35.727801085 CEST	443	49743	64.233.176.103	192.168.2.5
Apr 19, 2024 11:14:35.727986097 CEST	443	49743	64.233.176.103	192.168.2.5
Apr 19, 2024 11:14:35.728121996 CEST	49743	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:14:37.081480980 CEST	49743	443	192.168.2.5	64.233.176.103
Apr 19, 2024 11:14:37.081506014 CEST	443	49743	64.233.176.103	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:13:20.850462914 CEST	56086	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:20.850609064 CEST	60607	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:20.861771107 CEST	53	63659	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:20.863090038 CEST	53	49317	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:20.954025984 CEST	53	58516	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:20.955070019 CEST	53	56086	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:20.955868006 CEST	53	60607	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:21.464934111 CEST	53	57256	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:21.772094965 CEST	58348	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:21.772248030 CEST	56393	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:21.826343060 CEST	57746	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:21.826585054 CEST	50955	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:21.877121925 CEST	53	58348	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:21.898695946 CEST	53	56393	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:21.931967974 CEST	53	57746	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:21.950980902 CEST	53	50955	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:22.249293089 CEST	54723	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:22.249439001 CEST	56131	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:22.315985918 CEST	64187	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:22.316418886 CEST	57297	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:22.355999947 CEST	53	54723	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:22.376616001 CEST	53	56131	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:22.423719883 CEST	53	64187	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:22.424701929 CEST	53	57297	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:22.536375999 CEST	50442	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:22.536516905 CEST	65174	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:22.641633987 CEST	53	65174	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:22.644817114 CEST	53	50442	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:25.266690969 CEST	59470	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:25.266901016 CEST	50469	53	192.168.2.5	1.1.1.1
Apr 19, 2024 11:13:25.371376038 CEST	53	50469	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:25.371438026 CEST	53	59470	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:26.859637976 CEST	53	64348	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:39.070983887 CEST	53	61525	1.1.1.1	192.168.2.5
Apr 19, 2024 11:13:58.115334034 CEST	53	56116	1.1.1.1	192.168.2.5
Apr 19, 2024 11:14:20.488068104 CEST	53	56028	1.1.1.1	192.168.2.5
Apr 19, 2024 11:14:21.097372055 CEST	53	54428	1.1.1.1	192.168.2.5
Apr 19, 2024 11:14:48.743449926 CEST	53	51048	1.1.1.1	192.168.2.5
Apr 19, 2024 11:15:33.384880066 CEST	53	51874	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 11:13:20.850462914 CEST	192.168.2.5	1.1.1.1	0x34ef	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:20.850609064 CEST	192.168.2.5	1.1.1.1	0xcba6	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Apr 19, 2024 11:13:21.772094965 CEST	192.168.2.5	1.1.1.1	0x543	Standard query (0)	logo.clearbit.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:21.772248030 CEST	192.168.2.5	1.1.1.1	0x3d56	Standard query (0)	logo.clearbit.com	65	IN (0x0001)	false
Apr 19, 2024 11:13:21.826343060 CEST	192.168.2.5	1.1.1.1	0x21e6	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:21.826585054 CEST	192.168.2.5	1.1.1.1	0xd093	Standard query (0)	ip-api.com	65	IN (0x0001)	false
Apr 19, 2024 11:13:22.249293089 CEST	192.168.2.5	1.1.1.1	0x2ca7	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:22.249439001 CEST	192.168.2.5	1.1.1.1	0x2f24	Standard query (0)	ip-api.com	65	IN (0x0001)	false
Apr 19, 2024 11:13:22.315985918 CEST	192.168.2.5	1.1.1.1	0xda22	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:22.316418886 CEST	192.168.2.5	1.1.1.1	0x78c7	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Apr 19, 2024 11:13:22.536375999 CEST	192.168.2.5	1.1.1.1	0xe4d1	Standard query (0)	logo.clearbit.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:22.536516905 CEST	192.168.2.5	1.1.1.1	0x9312	Standard query (0)	logo.clearbit.com	65	IN (0x0001)	false
Apr 19, 2024 11:13:25.266690969 CEST	192.168.2.5	1.1.1.1	0x4527	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:25.266901016 CEST	192.168.2.5	1.1.1.1	0xaee6	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 11:13:20.955070019 CEST	1.1.1.1	192.168.2.5	0x34ef	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 11:13:20.955070019 CEST	1.1.1.1	192.168.2.5	0x34ef	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:20.955868006 CEST	1.1.1.1	192.168.2.5	0xcba6	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 11:13:21.877121925 CEST	1.1.1.1	192.168.2.5	0x543	No error (0)	logo.clearbit.com	d26p066pn2w0s0.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 11:13:21.877121925 CEST	1.1.1.1	192.168.2.5	0x543	No error (0)	d26p066pn2w0s0.cloudfront.net		3.161.136.96	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:21.877121925 CEST	1.1.1.1	192.168.2.5	0x543	No error (0)	d26p066pn2w0s0.cloudfront.net		3.161.136.8	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:21.877121925 CEST	1.1.1.1	192.168.2.5	0x543	No error (0)	d26p066pn2w0s0.cloudfront.net		3.161.136.24	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:21.877121925 CEST	1.1.1.1	192.168.2.5	0x543	No error (0)	d26p066pn2w0s0.cloudfront.net		3.161.136.44	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:21.898695946 CEST	1.1.1.1	192.168.2.5	0x3d56	No error (0)	logo.clearbit.com	d26p066pn2w0s0.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 11:13:21.931967974 CEST	1.1.1.1	192.168.2.5	0x21e6	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:22.355999947 CEST	1.1.1.1	192.168.2.5	0x2ca7	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:22.423719883 CEST	1.1.1.1	192.168.2.5	0xda22	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 11:13:22.423719883 CEST	1.1.1.1	192.168.2.5	0xda22	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:22.424701929 CEST	1.1.1.1	192.168.2.5	0x78c7	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 11:13:22.641633987 CEST	1.1.1.1	192.168.2.5	0x9312	No error (0)	logo.clearbit.com	d26p066pn2w0s0.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 11:13:22.644817114 CEST	1.1.1.1	192.168.2.5	0xe4d1	No error (0)	logo.clearbit.com	d26p066pn2w0s0.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 11:13:22.644817114 CEST	1.1.1.1	192.168.2.5	0xe4d1	No error (0)	d26p066pn2w0s0.cloudfront.net		3.161.136.96	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:22.644817114 CEST	1.1.1.1	192.168.2.5	0xe4d1	No error (0)	d26p066pn2w0s0.cloudfront.net		3.161.136.44	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:22.644817114 CEST	1.1.1.1	192.168.2.5	0xe4d1	No error (0)	d26p066pn2w0s0.cloudfront.net		3.161.136.24	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:22.644817114 CEST	1.1.1.1	192.168.2.5	0xe4d1	No error (0)	d26p066pn2w0s0.cloudfront.net		3.161.136.8	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:25.371376038 CEST	1.1.1.1	192.168.2.5	0xaee6	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 11:13:25.371438026 CEST	1.1.1.1	192.168.2.5	0x4527	No error (0)	www.google.com		64.233.176.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:25.371438026 CEST	1.1.1.1	192.168.2.5	0x4527	No error (0)	www.google.com		64.233.176.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:25.371438026 CEST	1.1.1.1	192.168.2.5	0x4527	No error (0)	www.google.com		64.233.176.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:25.371438026 CEST	1.1.1.1	192.168.2.5	0x4527	No error (0)	www.google.com		64.233.176.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:25.371438026 CEST	1.1.1.1	192.168.2.5	0x4527	No error (0)	www.google.com		64.233.176.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 11:13:25.371438026 CEST	1.1.1.1	192.168.2.5	0x4527	No error (0)	www.google.com		64.233.176.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

aadcdn.msftauth.net

logo.clearbit.com

fs.microsoft.com

slscr.update.microsoft.com

https:

www.bing.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	208.95.112.1	80	6660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 11:13:22.069886923 CEST	326	OUT	GET /json/?fields=status,country,regionName,city,query HTTP/1.1 Host: ip-api.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Origin: null Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 11:13:22.243300915 CEST	286	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 09:13:22 GMT Content-Type: application/json; charset=utf-8 Content-Length: 109 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 69 74 79 22 3a 22 41 74 6c 61 6e 74 61 22 2c 22 71 75 65 72 79 22 3a 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"Georgia","city":"Atlanta","query":"81.181.57.52"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49717	208.95.112.1	80	6660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 11:13:22.531807899 CEST	312	OUT	GET /json/?fields=status,country,regionName,city,query HTTP/1.1 Host: ip-api.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 11:13:22.711986065 CEST	286	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 09:13:22 GMT Content-Type: application/json; charset=utf-8 Content-Length: 109 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 69 74 79 22 3a 22 41 74 6c 61 6e 74 61 22 2c 22 71 75 65 72 79 22 3a 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"Georgia","city":"Atlanta","query":"81.181.57.52"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	152.199.4.44	443	6660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:13:21 UTC	586	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: null sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:13:21 UTC	734	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4479041 Cache-Control: public, max-age=31536000 Content-MD5: xg2DER+s52egaL6bUXi4hw== Content-Type: text/css Date: Fri, 19 Apr 2024 09:13:21 GMT Etag: 0x8DA2180E9C582E0 Last-Modified: Mon, 18 Apr 2022 21:17:58 GMT Server: ECAcc (agc/7F81) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 28ecf56e-d01e-005e-5b7d-699b08000000 x-ms-version: 2009-09-19 Content-Length: 110554 Connection: close
2024-04-19 09:13:21 UTC	16383	IN	Data Raw: 2f 2a 21 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 2f 2f 2a 21 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 0a 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 Data Ascii: /! Copyright (C) Microsoft Corporation. All rights reserved. //*!------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------This file is based on or incorporates material from the projects listed
2024-04-19 09:13:21 UTC	1	IN	Data Raw: 73 Data Ascii: s
2024-04-19 09:13:21 UTC	16383	IN	Data Raw: 2d 31 2c 2e 63 6f 6c 2d 78 73 2d 32 2c 2e 63 6f 6c 2d 78 73 2d 33 2c 2e 63 6f 6c 2d 78 73 2d 34 2c 2e 63 6f 6c 2d 78 73 2d 35 2c 2e 63 6f 6c 2d 78 73 2d 36 2c 2e 63 6f 6c 2d 78 73 2d 37 2c 2e 63 6f 6c 2d 78 73 2d 38 2c 2e 63 6f 6c 2d 78 73 2d 39 2c 2e 63 6f 6c 2d 78 73 2d 31 30 2c 2e 63 6f 6c 2d 78 73 2d 31 31 2c 2e 63 6f 6c 2d 78 73 2d 31 32 2c 2e 63 6f 6c 2d 78 73 2d 31 33 2c 2e 63 6f 6c 2d 78 73 2d 31 34 2c 2e 63 6f 6c 2d 78 73 2d 31 35 2c 2e 63 6f 6c 2d 78 73 2d 31 36 2c 2e 63 6f 6c 2d 78 73 2d 31 37 2c 2e 63 6f 6c 2d 78 73 2d 31 38 2c 2e 63 6f 6c 2d 78 73 2d 31 39 2c 2e 63 6f 6c 2d 78 73 2d 32 30 2c 2e 63 6f 6c 2d 78 73 2d 32 31 2c 2e 63 6f 6c 2d 78 73 2d 32 32 2c 2e 63 6f 6c 2d 78 73 2d 32 33 2c 2e 63 6f 6c 2d 78 73 2d 32 34 7b 66 6c 6f 61 74 3a 6c Data Ascii: -1,.col-xs-2,.col-xs-3,.col-xs-4,.col-xs-5,.col-xs-6,.col-xs-7,.col-xs-8,.col-xs-9,.col-xs-10,.col-xs-11,.col-xs-12,.col-xs-13,.col-xs-14,.col-xs-15,.col-xs-16,.col-xs-17,.col-xs-18,.col-xs-19,.col-xs-20,.col-xs-21,.col-xs-22,.col-xs-23,.col-xs-24{float:l
2024-04-19 09:13:21 UTC	16383	IN	Data Raw: 67 69 6e 2d 6c 65 66 74 3a 39 35 2e 38 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 32 34 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 30 25 7d 7d 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 7d 6c 65 67 65 6e 64 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 7d 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f Data Ascii: gin-left:95.83333%}.col-xl-offset-24{margin-left:100%}}fieldset{padding:0;margin:0;border:0;min-width:0}legend{display:block;width:100%;padding:0;border:0}label{display:inline-block;max-width:100%}input[type="search"]{-webkit-box-sizing:border-box;-moz-bo
2024-04-19 09:13:21 UTC	16383	IN	Data Raw: 6c 6f 77 2d 78 3a 61 75 74 6f 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2e 30 31 25 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 35 33 39 70 78 29 7b 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 35 70 78 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 68 69 64 64 65 6e 3b 2d 6d 73 2d 6f 76 65 72 66 6c 6f 77 2d 73 74 79 6c 65 3a 2d 6d 73 2d 61 75 74 6f 68 69 64 69 6e 67 2d 73 63 72 6f 6c 6c 62 61 72 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 2c 2e 74 61 62 Data Ascii: low-x:auto;min-height:.01%}@media screen and (max-width:539px){.table-responsive{width:100%;margin-bottom:15px;overflow-y:hidden;-ms-overflow-style:-ms-autohiding-scrollbar}.table-responsive>.table{margin-bottom:0}.table-responsive>.table>thead>tr>th,.tab
2024-04-19 09:13:21 UTC	16383	IN	Data Raw: 49 22 2c 22 54 75 6e 67 61 22 2c 22 4c 61 6f 20 55 49 22 2c 22 52 61 61 76 69 22 2c 22 49 73 6b 6f 6f 6c 61 20 50 6f 74 61 22 2c 22 4c 61 74 68 61 22 2c 22 4c 65 65 6c 61 77 61 64 65 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 20 55 49 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4a 68 65 6e 67 48 65 69 20 55 49 22 2c 22 4d 61 6c 67 75 6e 20 47 6f 74 68 69 63 22 2c 22 45 73 74 72 61 6e 67 65 6c 6f 20 45 64 65 73 73 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 48 69 6d 61 6c 61 79 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4e 65 77 20 54 61 69 20 4c 75 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 50 68 61 67 73 50 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 54 61 69 20 4c 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 69 20 42 61 69 74 69 22 2c 22 4d 6f 6e 67 Data Ascii: I","Tunga","Lao UI","Raavi","Iskoola Pota","Latha","Leelawadee","Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Estrangelo Edessa","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mong
2024-04-19 09:13:21 UTC	4	IN	Data Raw: 63 74 69 76 Data Ascii: ctiv
2024-04-19 09:13:21 UTC	16383	IN	Data Raw: 65 2c 2e 62 74 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2d 61 63 74 69 76 65 2c 2e 62 74 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 61 63 74 69 76 65 2c 62 75 74 74 6f 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 61 63 74 69 76 65 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 61 63 74 69 76 65 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 61 63 74 69 76 65 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 65 73 65 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 61 63 74 69 76 65 7b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 39 38 29 3b 2d Data Ascii: e,.btn.btn-primary-active,.btn.btn-primary:active,button.btn-primary:active,input[type="button"].btn-primary:active,input[type="submit"].btn-primary:active,input[type="reset"].btn-primary:active{outline:none;text-decoration:none;-ms-transform:scale(.98);-
2024-04-19 09:13:21 UTC	12251	IN	Data Raw: 69 6e 65 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 36 36 36 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 2e 6d 65 6d 62 65 72 6e 61 6d 65 50 72 65 66 69 6c 6c 53 65 6c 65 63 74 3a 61 63 74 69 76 65 7b 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 30 30 37 38 64 37 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 77 69 64 74 68 3a 30 3b 62 6f 72 64 65 72 2d 6c 65 66 74 2d 77 69 64 74 68 3a 30 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 2d 77 69 64 74 68 3a 30 7d Data Ascii: ine:none;border-left:none;border-right:none;border-top:none;border-color:#666;background-color:transparent}.dropdown-toggle.membernamePrefillSelect:active{transform:none;border:1px solid #0078d7;border-top-width:0;border-left-width:0;border-right-width:0}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	152.199.4.44	443	6660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:13:22 UTC	619	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:13:22 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4563488 Cache-Control: public, max-age=31536000 Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Content-Type: image/svg+xml Date: Fri, 19 Apr 2024 09:13:22 GMT Etag: 0x8D7B007297AE131 Last-Modified: Wed, 12 Feb 2020 22:01:50 GMT Server: ECAcc (agc/7F47) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: dd20a117-001e-0067-2cb8-68c90a000000 x-ms-version: 2009-09-19 Content-Length: 1864 Connection: close
2024-04-19 09:13:22 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49713	3.161.136.96	443	6660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:13:22 UTC	508	OUT	GET /daiichi-sankyo.at HTTP/1.1 Host: logo.clearbit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:13:22 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/png Transfer-Encoding: chunked Connection: close access-control-allow-origin: * Cache-Control: public, max-age=2592000 Date: Fri, 19 Apr 2024 09:13:22 GMT x-envoy-response-flags: - Server: Clearbit strict-transport-security: max-age=63072000; includeSubDomains; preload x-content-type-options: nosniff X-Cache: Miss from cloudfront Via: 1.1 266ac52f1cf22bd836a3ed8dfdd6f30c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P4 X-Amz-Cf-Id: hpvKT2KPL1Cou2kQED5uKVtJCQPNIv9mpzsWlK6H_fTwDl1mU3GUdw==
2024-04-19 09:13:22 UTC	10682	IN	Data Raw: 32 39 62 32 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 02 00 00 00 4c 5c f6 9c 00 00 29 79 49 44 41 54 78 9c ec bd 09 9c 64 55 95 27 7c ce b9 f7 2d 11 91 19 59 b9 d5 be 52 50 05 52 2c ca be 88 25 68 4b ab 88 a2 d2 88 2d da 8a ad f6 38 d3 3d dd fa e9 f8 d3 d1 71 1c 6d a7 c7 cf fe a4 db 65 a6 15 04 17 50 11 e6 73 41 84 0f 4b 50 50 f6 ad a0 d8 6a af ca aa dc 97 58 de 7b f7 de 73 be df bb 11 99 95 55 2a 08 95 91 39 74 e7 f9 05 49 46 65 c4 5b ce ff 9e fd dc f3 b4 88 c0 3c cd 1d d1 5c 5f c0 bf 75 9a 07 60 8e 69 1e 80 39 a6 79 00 e6 98 e6 01 98 63 9a 07 60 8e 69 1e 80 39 a6 79 00 e6 98 e6 01 98 63 9a 07 60 8e 69 1e 80 39 a6 79 00 e6 98 e6 01 98 63 9a 07 60 8e 69 1e 80 39 a6 79 00 e6 98 e6 01 98 63 9a 07 60 8e 69 1e 80 39 26 Data Ascii: 29b2PNGIHDRL\)yIDATxdU'\|-YRPR,%hK-8=qmePsAKPPjX{sU*9tIFe[<\_u`i9yc`i9yc`i9yc`i9yc`i9&
2024-04-19 09:13:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	152.199.4.44	443	6660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:13:22 UTC	606	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:13:22 UTC	719	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2252332 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Fri, 19 Apr 2024 09:13:22 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (agc/7F29) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 12fef581-701e-0054-4ebd-7d951d000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-04-19 09:13:22 UTC	16383	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-19 09:13:22 UTC	791	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	152.199.4.44	443	6660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:13:22 UTC	419	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:13:22 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4563488 Cache-Control: public, max-age=31536000 Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Content-Type: image/svg+xml Date: Fri, 19 Apr 2024 09:13:22 GMT Etag: 0x8D7B007297AE131 Last-Modified: Wed, 12 Feb 2020 22:01:50 GMT Server: ECAcc (agc/7F47) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: dd20a117-001e-0067-2cb8-68c90a000000 x-ms-version: 2009-09-19 Content-Length: 1864 Connection: close
2024-04-19 09:13:22 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49719	3.161.136.96	443	6660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:13:22 UTC	358	OUT	GET /daiichi-sankyo.at HTTP/1.1 Host: logo.clearbit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:13:23 UTC	555	IN	HTTP/1.1 200 OK Content-Type: image/png Transfer-Encoding: chunked Connection: close access-control-allow-origin: * Cache-Control: public, max-age=2592000 Date: Fri, 19 Apr 2024 09:13:22 GMT x-envoy-response-flags: - Server: Clearbit strict-transport-security: max-age=63072000; includeSubDomains; preload x-content-type-options: nosniff X-Cache: Hit from cloudfront Via: 1.1 186d5799ef5fc5abb6dd0617436e9ef8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P4 X-Amz-Cf-Id: givIeZNtoKwlrU9qcY5wDPdymNw4pM8ezRJ3NrDMacbAyS5B_UqgIQ== Age: 1
2024-04-19 09:13:23 UTC	10682	IN	Data Raw: 32 39 62 32 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 02 00 00 00 4c 5c f6 9c 00 00 29 79 49 44 41 54 78 9c ec bd 09 9c 64 55 95 27 7c ce b9 f7 2d 11 91 19 59 b9 d5 be 52 50 05 52 2c ca be 88 25 68 4b ab 88 a2 d2 88 2d da 8a ad f6 38 d3 3d dd fa e9 f8 d3 d1 71 1c 6d a7 c7 cf fe a4 db 65 a6 15 04 17 50 11 e6 73 41 84 0f 4b 50 50 f6 ad a0 d8 6a af ca aa dc 97 58 de 7b f7 de 73 be df bb 11 99 95 55 2a 08 95 91 39 74 e7 f9 05 49 46 65 c4 5b ce ff 9e fd dc f3 b4 88 c0 3c cd 1d d1 5c 5f c0 bf 75 9a 07 60 8e 69 1e 80 39 a6 79 00 e6 98 e6 01 98 63 9a 07 60 8e 69 1e 80 39 a6 79 00 e6 98 e6 01 98 63 9a 07 60 8e 69 1e 80 39 a6 79 00 e6 98 e6 01 98 63 9a 07 60 8e 69 1e 80 39 a6 79 00 e6 98 e6 01 98 63 9a 07 60 8e 69 1e 80 39 26 Data Ascii: 29b2PNGIHDRL\)yIDATxdU'\|-YRPR,%hK-8=qmePsAKPPjX{sU*9tIFe[<\_u`i9yc`i9yc`i9yc`i9yc`i9&
2024-04-19 09:13:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49720	152.199.4.44	443	6660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:13:23 UTC	406	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 09:13:23 UTC	719	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2252333 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Fri, 19 Apr 2024 09:13:23 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (agc/7F29) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 12fef581-701e-0054-4ebd-7d951d000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-04-19 09:13:23 UTC	16383	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-19 09:13:23 UTC	791	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49725	23.216.73.151	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:13:26 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 09:13:26 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=165003 Date: Fri, 19 Apr 2024 09:13:26 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49726	23.216.73.151	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:13:26 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 09:13:26 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=164965 Date: Fri, 19 Apr 2024 09:13:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-19 09:13:26 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49733	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:13:37 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=do3Xfs9PACD7E9V&MD=94olGX7g HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-19 09:13:37 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 16982de8-793d-473a-bc78-13ffef6adc99 MS-RequestId: a8430c5a-95a8-49a2-a3e8-01ae5b340cd6 MS-CV: uuyg1MloJ0euuhsl.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 19 Apr 2024 09:13:37 GMT Connection: close Content-Length: 24490
2024-04-19 09:13:37 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-19 09:13:37 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49738	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:13:37 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713517984939&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-19 09:13:37 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-19 09:13:37 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-19 09:13:38 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 5B8E92A636214352BC36246A7971EF91 Ref B: LAX311000114023 Ref C: 2024-04-19T09:13:38Z Date: Fri, 19 Apr 2024 09:13:38 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1713518017.10f771e1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49741	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 09:14:15 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=do3Xfs9PACD7E9V&MD=94olGX7g HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-19 09:14:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 01d33dfd-6b6c-4558-aee8-d7cba6630835 MS-RequestId: 48553c25-84c5-4e13-a2c5-007eaefdbd71 MS-CV: RnF09LApsk2ln+dJ.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 19 Apr 2024 09:14:15 GMT Connection: close Content-Length: 25457
2024-04-19 09:14:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-19 09:14:15 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	11:13:16
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\New Voicemail_Daiichi-Sankyo.html"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	11:13:18
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2280,i,6943950111535354216,13745419357944458540,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report New Voicemail_Daiichi-Sankyo.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
New Voicemail_Daiichi-Sankyo.html