Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://shining-melodic-magnesium.glitch.me/rvicendDev.html

Overview

General Information

Sample URL:https://shining-melodic-magnesium.glitch.me/rvicendDev.html
Analysis ID:1431407
Infos:

Detection

Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Phishing site detected (based on favicon image match)
Snort IDS alert for network traffic
Phishing site detected (based on image similarity)
Form action URLs do not match main URL
HTML body contains low number of good links
HTML title does not match URL
Invalid 'forgot password' link found
Stores files to the Windows start menu directory
Suspicious form URL found
Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 6256 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6400 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2060,i,11271670896977708482,13358523711605265383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 5908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://shining-melodic-magnesium.glitch.me/rvicendDev.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

Timestamp:04/25/24-01:58:39.836084
SID:2029493
Source Port:58597
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:04/25/24-01:58:40.785101
SID:2029493
Source Port:58837
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:04/25/24-01:58:40.784854
SID:2029493
Source Port:55404
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:04/25/24-01:58:39.836231
SID:2029493
Source Port:49912
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlAvira URL Cloud: detection malicious, Label: phishing
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlSlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering
Multi AV Scanner detection for submitted file
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlVirustotal: Detection: 5%Perma Link

Phishing

barindex
Phishing site detected (based on favicon image match)
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlMatcher: Template: excel matched with high similarity
Phishing site detected (based on image similarity)
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlMatcher: Found strong image similarity, brand: MICROSOFT
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlHTTP Parser: Form action: https://homegoods.cloud/reboty2783mediloaocptx.php glitch homegoods
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlHTTP Parser: Number of links: 0
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlHTTP Parser: Title: Excel Mobile does not match URL
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlHTTP Parser: Invalid link: Forgot your password?
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlHTTP Parser: Form action: https://homegoods.cloud/reboty2783mediloaocptx.php
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlHTTP Parser: <input type="password" .../> found
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlHTTP Parser: No <meta name="author".. found
Source: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlHTTP Parser: No <meta name="copyright".. found
Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49731 version: TLS 1.0
Source: unknownHTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 1MB later: 35MB

Networking

barindex
Snort IDS alert for network traffic
Source: TrafficSnort IDS: 2029493 ET CURRENT_EVENTS Possible Glitch.me Phishing Domain 192.168.2.5:58597 -> 1.1.1.1:53
Source: TrafficSnort IDS: 2029493 ET CURRENT_EVENTS Possible Glitch.me Phishing Domain 192.168.2.5:49912 -> 1.1.1.1:53
Source: TrafficSnort IDS: 2029493 ET CURRENT_EVENTS Possible Glitch.me Phishing Domain 192.168.2.5:55404 -> 1.1.1.1:53
Source: TrafficSnort IDS: 2029493 ET CURRENT_EVENTS Possible Glitch.me Phishing Domain 192.168.2.5:58837 -> 1.1.1.1:53
Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49731 version: TLS 1.0
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /rvicendDev.html HTTP/1.1Host: shining-melodic-magnesium.glitch.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /rvicendDev.html HTTP/1.1Host: shining-melodic-magnesium.glitch.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "f6edd152435965f96a6ae58c10e618e9"If-Modified-Since: Wed, 24 Apr 2024 06:00:44 GMT
Source: global trafficHTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shining-melodic-magnesium.glitch.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /rvicendDev.html HTTP/1.1Host: shining-melodic-magnesium.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /wikipedia/commons/thumb/3/34/Microsoft_Office_Excel_%282019%E2%80%93present%29.svg/2203px-Microsoft_Office_Excel_%282019%E2%80%93present%29.svg.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shining-melodic-magnesium.glitch.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /wikipedia/commons/thumb/3/34/Microsoft_Office_Excel_%282019%E2%80%93present%29.svg/2203px-Microsoft_Office_Excel_%282019%E2%80%93present%29.svg.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficDNS traffic detected: DNS query: shining-melodic-magnesium.glitch.me
Source: global trafficDNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global trafficDNS traffic detected: DNS query: upload.wikimedia.org
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: unknownHTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714003100925&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
Source: chromecache_59.2.dr, chromecache_63.2.drString found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90b
Source: chromecache_59.2.dr, chromecache_63.2.drString found in binary or memory: https://homegoods.cloud/reboty2783mediloaocptx.php
Source: chromecache_59.2.dr, chromecache_63.2.drString found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/3/34/Microsoft_Office_Excel_%282019%E2%80%93pre
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownHTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: classification engineClassification label: mal76.phis.win@16/17@14/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2060,i,11271670896977708482,13358523711605265383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://shining-melodic-magnesium.glitch.me/rvicendDev.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2060,i,11271670896977708482,13358523711605265383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Google Drive.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder		1
Process Injection		1
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media3
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Extra Window Memory Injection		1
Obfuscated Files or Information		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive4
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Extra Window Memory Injection		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://shining-melodic-magnesium.glitch.me/rvicendDev.html100%Avira URL Cloudphishing
https://shining-melodic-magnesium.glitch.me/rvicendDev.html5%VirustotalBrowse
https://shining-melodic-magnesium.glitch.me/rvicendDev.html100%SlashNextCredential Stealing type: Phishing & Social Engineering

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg0%URL Reputationsafe
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg0%URL Reputationsafe
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90b0%URL Reputationsafe
https://homegoods.cloud/reboty2783mediloaocptx.php1%VirustotalBrowse
https://homegoods.cloud/reboty2783mediloaocptx.php0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalse
    		unknown
    cs1100.wpc.omegacdn.net
    		152.199.4.44
    		truefalse
      		unknown
      shining-melodic-magnesium.glitch.me
      		44.214.198.122
      		truefalse
        		high
        www.google.com
        		64.233.176.104
        		truefalse
          		high
          upload.wikimedia.org
          		208.80.154.240
          		truefalse
            		high
            fp2e7a.wpc.phicdn.net
            		192.229.211.108
            		truefalse
              		unknown
              aadcdn.msftauth.net
              		unknown
              		unknownfalse
                		unknown

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                https://shining-melodic-magnesium.glitch.me/rvicendDev.htmlfalse
                  		high
                  https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svgfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  		unknown
                  https://upload.wikimedia.org/wikipedia/commons/thumb/3/34/Microsoft_Office_Excel_%282019%E2%80%93present%29.svg/2203px-Microsoft_Office_Excel_%282019%E2%80%93present%29.svg.pngfalse
                    		high

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    https://upload.wikimedia.org/wikipedia/commons/thumb/3/34/Microsoft_Office_Excel_%282019%E2%80%93prechromecache_59.2.dr, chromecache_63.2.drfalse
                      		high
                      https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bchromecache_59.2.dr, chromecache_63.2.drfalse
                      • URL Reputation: safe
                      		unknown
                      https://homegoods.cloud/reboty2783mediloaocptx.phpchromecache_59.2.dr, chromecache_63.2.drfalse
                      • 1%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      44.214.198.122
                      		shining-melodic-magnesium.glitch.meUnited States
                      		14618AMAZON-AESUSfalse
                      239.255.255.250
                      		unknownReserved
                      		unknownunknownfalse
                      152.199.4.44
                      		cs1100.wpc.omegacdn.netUnited States
                      		15133EDGECASTUSfalse
                      208.80.154.240
                      		upload.wikimedia.orgUnited States
                      		14907WIKIMEDIAUSfalse
                      64.233.176.104
                      		www.google.comUnited States
                      		15169GOOGLEUSfalse

                      Private

                      IP
                      192.168.2.5

                      General Information

                      Joe Sandbox version:40.0.0 Tourmaline
                      Analysis ID:1431407
                      Start date and time:2024-04-25 01:57:48 +02:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 3m 40s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:browseurl.jbs
                      Sample URL:https://shining-melodic-magnesium.glitch.me/rvicendDev.html
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:7
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Detection:MAL
                      Classification:mal76.phis.win@16/17@14/6
                      EGA Information:Failed
                      HCA Information:
                      • Successful, ratio: 100%
                      • Number of executed functions: 0
                      • Number of non-executed functions: 0

                      Warnings

                      • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                      • Excluded IPs from analysis (whitelisted): 172.217.215.94, 142.250.105.113, 142.250.105.138, 142.250.105.101, 142.250.105.102, 142.250.105.139, 142.250.105.100, 172.253.124.84, 34.104.35.123, 64.233.177.95, 173.194.219.95, 172.253.124.95, 172.217.215.95, 64.233.176.95, 74.125.136.95, 108.177.122.95, 142.250.105.95, 74.125.138.95, 64.233.185.95, 142.251.15.95, 142.250.9.95, 40.68.123.157, 199.232.214.172, 23.40.205.26, 23.40.205.34, 23.40.205.18, 192.229.211.108, 20.3.187.198, 20.242.39.171, 173.194.219.94, 199.232.210.172
                      • Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size getting too big, too many NtSetInformationFile calls found.

                      Simulations

                      Behavior and APIs

                      ⊘No simulations

                      Joe Sandbox View / Context

                      IPs

                      ⊘No context

                      Domains

                      ⊘No context

                      ASNs

                      ⊘No context

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 22:58:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2677
                      Entropy (8bit):3.9789886738247926
                      Encrypted:false
                      SSDEEP:48:8ndsTQUuHNcidAKZdA19ehwiZUklqehoxy+3:8Kf0qzy
                      MD5:8080A3BE34F6BCC78821920B36389F7F
                      SHA1:8F33445D3037B395BE1ECC4762EEA7572E0084CD
                      SHA-256:CFE44F2059ED1AC0D3825F33C37857315E9AA43B531590B7710C5F2966C78621
                      SHA-512:734231843B1ACCE9E80226A58E27A0A52570069D0FB3131F1F4805017ADFBCDED0E234449C86A916494DAFE052EB6D18140B8AC207E70578029B8814D944A9B8
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,.....+.S....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XP.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XP.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XP.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XP............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XT............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 22:58:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2679
                      Entropy (8bit):3.99574980373461
                      Encrypted:false
                      SSDEEP:48:8qdsTQUuHNcidAKZdA1weh/iZUkAQkqehZxy+2:8df0g9QCy
                      MD5:32E8E745F9448874F8F805AE2A86F598
                      SHA1:FF46B8CE0BA4B50438490B7B8B3CE26577F905E3
                      SHA-256:4830E9B133F5F45E18E901B7989C5720AC9A7E46AC3337148CD4884D1092127D
                      SHA-512:4F9F56D0F9AC51667BAFE3154A81FD3EA0209DFF2C376E97FEE65E064669CE5A455560578C2BA93CB691A742D14CAD8CAEBFD60EDF49C2AA53E8A18B008A4C4E
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,.....7.S....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XP.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XP.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XP.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XP............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XT............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2693
                      Entropy (8bit):4.0043914951365585
                      Encrypted:false
                      SSDEEP:48:8xldsTQUsHNcidAKZdA14tseh7sFiZUkmgqeh7sXxy+BX:8xEfW4n3y
                      MD5:2972CA097948B919323F3CB7CA376E18
                      SHA1:84D82B0540381916EEA23944B20BA466E5D3DE3D
                      SHA-256:5D7CACD2039FB8C4EA375C23347191B0EC94A5D075838345BD229BC5D6A5BC0D
                      SHA-512:0D26D9D3F7C3DC7764AC75248745966196DE1668AF5F3D442C7D0168F0E977401C2A540A3D2779CD2BCD1807D0C8293B8F55DDA3254FF0A6AE0E2B747B0EC324
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XP.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XP.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XP.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XP............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 22:58:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2681
                      Entropy (8bit):3.9925622223300095
                      Encrypted:false
                      SSDEEP:48:8XdsTQUuHNcidAKZdA1vehDiZUkwqehdxy+R:86f0rpy
                      MD5:6F8A9B96B2AABC87A3A95036CC2BD6A6
                      SHA1:5D51DF1DF32A0E2B87BA243CA56BA898286302F1
                      SHA-256:3B48FA92FA38AEF2574E41EE024AEBF1722B261E536DD3EB128B475C5D2B1736
                      SHA-512:23B99A4A58F26F2F11279A5E9A9EE76E6D28CB2BD63CF036FBD8AACD36F046298B0E8EF9E203F6B3DB13340B19E4A800C72F53E5CDFE91C1FF78C823DC577B81
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,..... .S....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XP.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XP.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XP.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XP............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XT............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 22:58:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2681
                      Entropy (8bit):3.980640800931808
                      Encrypted:false
                      SSDEEP:48:8PidsTQUuHNcidAKZdA1hehBiZUk1W1qehTxy+C:8tf0r9ly
                      MD5:D4517D242A1383121B8786C79242FBCF
                      SHA1:12693622F2573DE4E70A4E8F67A7C734EBC702D2
                      SHA-256:500AE71F5986311E48B511BF6C11B6DD18A066BC7B8D896B7AF18D9247AF710E
                      SHA-512:41E1A9814102B387FF0C92452A1E502933EF6A9E3B58D674558ACF62363E4B96407E8E83141A9372A6125A4F2E06AF6C801995AEE4F8D0C2BCCAD6DD18FEA4B1
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,.....n.S....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XP.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XP.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XP.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XP............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XT............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 22:58:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2683
                      Entropy (8bit):3.9938484399502543
                      Encrypted:false
                      SSDEEP:48:8HcdsTQUuHNcidAKZdA1duT+ehOuTbbiZUk5OjqehOuTblxy+yT+:8H7f0LT/TbxWOvTb3y7T
                      MD5:EBFD661B7A91E57375D14F2687CDA353
                      SHA1:DC44199A02FB42CE0416DBEAE0D9F5C769C11A80
                      SHA-256:4870A3AB9EC15F776BAA74C76046FD108790D903F62861175963DED46CCC1D5F
                      SHA-512:ED726A5F59D1EEBD47161E00A21F32518AB2E258863940A8A5306EA3221FD47A208A1788FDC06007556B0B60E621EA27B832F6CF6C944157BB60A701778C603B
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,.....ZnS....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XP.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XP.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XP.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XP............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XT............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      Chrome Cache Entry: 59

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:HTML document, ASCII text
                      Category:downloaded
                      Size (bytes):4274
                      Entropy (8bit):5.275670925084233
                      Encrypted:false
                      SSDEEP:96:HoE24Qee5KSlvgOa9jk4L06gBSGLhoOl85TtuCtV+/C/w9L8gttXQvViEsuU:nHSlvBa55jEdoO0Ttvt4/C/w9L8gttXd
                      MD5:F6EDD152435965F96A6AE58C10E618E9
                      SHA1:F50C2CE7E6C66389A7EFD6CC5C7982558EFF4944
                      SHA-256:66458E66ED6D9481CCC6B87556F5E1DB3830ADDE85B741C431AAC8807196B509
                      SHA-512:EB67C288F81603424E22CD431BB33AF8E90D574C35E77F2DC9906E18FA1CF58CB48312BF0F949212179BD307B6F4E71C4CD1D4E2D93C4E3432C7449BC3B9514C
                      Malicious:false
                      Reputation:low
                      URL:https://shining-melodic-magnesium.glitch.me/rvicendDev.html
                      Preview:<html>.<head>..<meta name="viewport" content="width=device-width, initial-scale=1">..<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />..<title>Excel Mobile</title>. <link rel="icon" href="https://upload.wikimedia.org/wikipedia/commons/thumb/3/34/Microsoft_Office_Excel_%282019%E2%80%93present%29.svg/2203px-Microsoft_Office_Excel_%282019%E2%80%93present%29.svg.png" type="image/gif" sizes="16x16">..<style> .body, html { height: 100%;margin: 0; font-family: Arial, Helvetica, sans-serif;.}.* {. box-sizing: border-box;.}..bg-image {. /* The image used */. background-image: url("");. /* Add the blur effect */ filter: blur(4px); -webkit-filter: blur(5px);. /* Full height */ height: 100%; /* Center and scale the image nicely */. background-position: cover; background-repeat: no-repeat; background-size: cover;.}../* Position text in the middle of the page/image */..bg-text {. background: #FFF;. width:340px; height:300px; -webkit-box-shadow: 1px 1px 15px 1px #000000; .

                      Chrome Cache Entry: 60

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with no line terminators
                      Category:downloaded
                      Size (bytes):28
                      Entropy (8bit):4.208966082694623
                      Encrypted:false
                      SSDEEP:3:G4iCw:ziCw
                      MD5:FE567926364F1F70610B746A64DE9165
                      SHA1:A11A5E6E799B094612BBBEB4ABF31707F5080C33
                      SHA-256:07DCC4C01BD13CC989FEC4730DCB6DEEE43A9C7895DFCCFD5113EAD8B1BFB1F7
                      SHA-512:94A588BC0A2500D2B7A53671C00A383A7A2030F593E910E7B96FB4768C28F649CEE4E9263D5EF388706D82F9EF344B337D416A4CBEAC78217A5EC86E21AB2D7E
                      Malicious:false
                      Reputation:low
                      URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwlA2ZezmGQrdBIFDVNVgbUSBQ3OQUx6?alt=proto
                      Preview:ChIKBw1TVYG1GgAKBw3OQUx6GgA=

                      Chrome Cache Entry: 61

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:SVG Scalable Vector Graphics image
                      Category:dropped
                      Size (bytes):3651
                      Entropy (8bit):4.094801914706141
                      Encrypted:false
                      SSDEEP:96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
                      MD5:EE5C8D9FB6248C938FD0DC19370E90BD
                      SHA1:D01A22720918B781338B5BBF9202B241A5F99EE4
                      SHA-256:04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
                      SHA-512:C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
                      Malicious:false
                      Reputation:low
                      Preview:<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

                      Chrome Cache Entry: 62

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:PNG image data, 2203 x 2049, 8-bit/color RGBA, non-interlaced
                      Category:dropped
                      Size (bytes):100727
                      Entropy (8bit):7.576212282061622
                      Encrypted:false
                      SSDEEP:3072:oqZjsdMCBhLZXM8rueU6o8Amk93VdDaly:bjsdMCBI8rueXMtDaE
                      MD5:39F9670257CF2C47B21177E26205540A
                      SHA1:3F961150D0BC99CC951F50509AE53C282EFE28B1
                      SHA-256:0CC3FED62E8B1F2D7C8F2A6937957914C8E8ABFA355F57906053E3D274D238B7
                      SHA-512:A35CE2F31E2A21790F0EA8090DF784310FD7A5666C3D91AD767223E208F7C3AAEBFE6C3041F2E95A8885613E66A956F83262DCDDAC361F50EB1D61FCFB4D8B6F
                      Malicious:false
                      Reputation:low
                      Preview:.PNG........IHDR.............@.s.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............IDATx...{.eg]'...>..%...' I*.(.....M@tD;.h........-:.b.`....tO...>.h.......FQG..:*.6:N.h..(..T..\.z..!!..:g..Z...<..U.u~...>+.Z+....s.......#....#...,.H9].#..".H.G.9.qVD.ED..........^p.bc..N..@c."b;"rD|*".......*....>W..N../.;........W}...]........s.r....9.U)..s.c"b]w...&.]rA....... G.#..F....................sf.&.....G....G.\.xFJ...9.:...tA....V.]..w"......e..?}..c..`.&.@...._XEum....q}x......a...Xy.....mU._..3_..H)k....P.+..O...|aD|mD\.#.....M..`t>.#.....?pM..HG.R.!l....~.eQ.1"^..&.....6...Q.H.......G....M......#'.?+..M...Xh....*.M..`"r.YD.\..7....~....M...../.8.w.i.....XG...U$l....s""n...?..5G.h......q./{l...F..F.~....V.....L..r.[>..W.-R.S+N.....+....V...H..}.....B.........k......S....1..h=.g_...".P..G>....c#l...E....?x..q....R....#....*..H_..3.....H........"....g.}...6..F..7.t`.@.g)..F.Y:..........,...w.w.....(.|......m7}C.xC.x.n...

                      Chrome Cache Entry: 63

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:HTML document, ASCII text
                      Category:dropped
                      Size (bytes):4274
                      Entropy (8bit):5.275670925084233
                      Encrypted:false
                      SSDEEP:96:HoE24Qee5KSlvgOa9jk4L06gBSGLhoOl85TtuCtV+/C/w9L8gttXQvViEsuU:nHSlvBa55jEdoO0Ttvt4/C/w9L8gttXd
                      MD5:F6EDD152435965F96A6AE58C10E618E9
                      SHA1:F50C2CE7E6C66389A7EFD6CC5C7982558EFF4944
                      SHA-256:66458E66ED6D9481CCC6B87556F5E1DB3830ADDE85B741C431AAC8807196B509
                      SHA-512:EB67C288F81603424E22CD431BB33AF8E90D574C35E77F2DC9906E18FA1CF58CB48312BF0F949212179BD307B6F4E71C4CD1D4E2D93C4E3432C7449BC3B9514C
                      Malicious:false
                      Reputation:low
                      Preview:<html>.<head>..<meta name="viewport" content="width=device-width, initial-scale=1">..<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />..<title>Excel Mobile</title>. <link rel="icon" href="https://upload.wikimedia.org/wikipedia/commons/thumb/3/34/Microsoft_Office_Excel_%282019%E2%80%93present%29.svg/2203px-Microsoft_Office_Excel_%282019%E2%80%93present%29.svg.png" type="image/gif" sizes="16x16">..<style> .body, html { height: 100%;margin: 0; font-family: Arial, Helvetica, sans-serif;.}.* {. box-sizing: border-box;.}..bg-image {. /* The image used */. background-image: url("");. /* Add the blur effect */ filter: blur(4px); -webkit-filter: blur(5px);. /* Full height */ height: 100%; /* Center and scale the image nicely */. background-position: cover; background-repeat: no-repeat; background-size: cover;.}../* Position text in the middle of the page/image */..bg-text {. background: #FFF;. width:340px; height:300px; -webkit-box-shadow: 1px 1px 15px 1px #000000; .

                      Chrome Cache Entry: 64

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:PNG image data, 2203 x 2049, 8-bit/color RGBA, non-interlaced
                      Category:downloaded
                      Size (bytes):100727
                      Entropy (8bit):7.576212282061622
                      Encrypted:false
                      SSDEEP:3072:oqZjsdMCBhLZXM8rueU6o8Amk93VdDaly:bjsdMCBI8rueXMtDaE
                      MD5:39F9670257CF2C47B21177E26205540A
                      SHA1:3F961150D0BC99CC951F50509AE53C282EFE28B1
                      SHA-256:0CC3FED62E8B1F2D7C8F2A6937957914C8E8ABFA355F57906053E3D274D238B7
                      SHA-512:A35CE2F31E2A21790F0EA8090DF784310FD7A5666C3D91AD767223E208F7C3AAEBFE6C3041F2E95A8885613E66A956F83262DCDDAC361F50EB1D61FCFB4D8B6F
                      Malicious:false
                      Reputation:low
                      URL:https://upload.wikimedia.org/wikipedia/commons/thumb/3/34/Microsoft_Office_Excel_%282019%E2%80%93present%29.svg/2203px-Microsoft_Office_Excel_%282019%E2%80%93present%29.svg.png
                      Preview:.PNG........IHDR.............@.s.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............IDATx...{.eg]'...>..%...' I*.(.....M@tD;.h........-:.b.`....tO...>.h.......FQG..:*.6:N.h..(..T..\.z..!!..:g..Z...<..U.u~...>+.Z+....s.......#....#...,.H9].#..".H.G.9.qVD.ED..........^p.bc..N..@c."b;"rD|*".......*....>W..N../.;........W}...]........s.r....9.U)..s.c"b]w...&.]rA....... G.#..F....................sf.&.....G....G.\.xFJ...9.:...tA....V.]..w"......e..?}..c..`.&.@...._XEum....q}x......a...Xy.....mU._..3_..H)k....P.+..O...|aD|mD\.#.....M..`t>.#.....?pM..HG.R.!l....~.eQ.1"^..&.....6...Q.H.......G....M......#'.?+..M...Xh....*.M..`"r.YD.\..7....~....M...../.8.w.i.....XG...U$l....s""n...?..5G.h......q./{l...F..F.~....V.....L..r.[>..W.-R.S+N.....+....V...H..}.....B.........k......S....1..h=.g_...".P..G>....c#l...E....?x..q....R....#....*..H_..3.....H........"....g.}...6..F..7.t`.@.g)..F.Y:..........,...w.w.....(.|......m7}C.xC.x.n...

                      Chrome Cache Entry: 65

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:SVG Scalable Vector Graphics image
                      Category:downloaded
                      Size (bytes):3651
                      Entropy (8bit):4.094801914706141
                      Encrypted:false
                      SSDEEP:96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
                      MD5:EE5C8D9FB6248C938FD0DC19370E90BD
                      SHA1:D01A22720918B781338B5BBF9202B241A5F99EE4
                      SHA-256:04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
                      SHA-512:C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
                      Malicious:false
                      Reputation:low
                      URL:https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
                      Preview:<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

                      Static File Info

                      ⊘No static file info

                      Network Behavior

                      Snort IDS Alerts

                      TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                      04/25/24-01:58:39.836084UDP2029493ET CURRENT_EVENTS Possible Glitch.me Phishing Domain5859753192.168.2.51.1.1.1
                      04/25/24-01:58:40.785101UDP2029493ET CURRENT_EVENTS Possible Glitch.me Phishing Domain5883753192.168.2.51.1.1.1
                      04/25/24-01:58:40.784854UDP2029493ET CURRENT_EVENTS Possible Glitch.me Phishing Domain5540453192.168.2.51.1.1.1
                      04/25/24-01:58:39.836231UDP2029493ET CURRENT_EVENTS Possible Glitch.me Phishing Domain4991253192.168.2.51.1.1.1

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Apr 25, 2024 01:58:31.599306107 CEST49674443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:31.602655888 CEST49675443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:31.739914894 CEST49673443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:39.961030960 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:39.961110115 CEST4434971244.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:39.961241961 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:39.961477041 CEST49713443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:39.961525917 CEST4434971344.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:39.961575985 CEST49713443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:39.961903095 CEST49713443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:39.961924076 CEST4434971344.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:39.962160110 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:39.962198019 CEST4434971244.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.342988014 CEST4434971344.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.343306065 CEST49713443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.343344927 CEST4434971344.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.344269037 CEST4434971344.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.344327927 CEST49713443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.344800949 CEST4434971244.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.345360041 CEST49713443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.345422983 CEST4434971344.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.345554113 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.345618010 CEST4434971244.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.345752954 CEST49713443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.345762968 CEST4434971344.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.349193096 CEST4434971244.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.349320889 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.349741936 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.349919081 CEST4434971244.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.398336887 CEST49713443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.398459911 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.398508072 CEST4434971244.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.447973967 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.576649904 CEST4434971344.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.576672077 CEST4434971344.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.576710939 CEST4434971344.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.576759100 CEST49713443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.576829910 CEST49713443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.577857971 CEST49713443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.577899933 CEST4434971344.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.597871065 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.640153885 CEST4434971244.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.709100008 CEST49716443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:40.709137917 CEST44349716152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:40.709198952 CEST49716443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:40.709709883 CEST49716443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:40.709726095 CEST44349716152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:40.770910025 CEST4434971244.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.771049976 CEST4434971244.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.771111012 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.772150040 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.772164106 CEST4434971244.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.772186995 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.772209883 CEST49712443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.898997068 CEST49718443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.899020910 CEST4434971844.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:40.899075985 CEST49718443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.899410963 CEST49718443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:40.899420977 CEST4434971844.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:41.044882059 CEST44349716152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.054346085 CEST49716443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.054363966 CEST44349716152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.055227041 CEST44349716152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.055301905 CEST49716443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.057153940 CEST49716443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.057209015 CEST44349716152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.057538033 CEST49716443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.057548046 CEST44349716152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.102416992 CEST49716443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.150978088 CEST4434971844.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:41.151391983 CEST49718443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:41.151407003 CEST4434971844.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:41.154968023 CEST4434971844.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:41.155105114 CEST49718443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:41.155982971 CEST49718443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:41.156033993 CEST4434971844.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:41.156256914 CEST49718443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:41.156264067 CEST4434971844.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:41.195831060 CEST49718443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:41.211266041 CEST49674443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:41.211277962 CEST49675443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:41.261147976 CEST44349716152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.261373043 CEST44349716152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.261415958 CEST44349716152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.261425972 CEST49716443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.261466980 CEST49716443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.262275934 CEST49716443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.262295008 CEST44349716152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.351572037 CEST49673443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:41.393009901 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:41.393079996 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.393157959 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:41.393383980 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:41.393416882 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.394979000 CEST49720443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.395045996 CEST44349720152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.395137072 CEST49720443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.395349026 CEST49720443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.395385027 CEST44349720152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.426043034 CEST49721443192.168.2.564.233.176.104
                      Apr 25, 2024 01:58:41.426065922 CEST4434972164.233.176.104192.168.2.5
                      Apr 25, 2024 01:58:41.426131010 CEST49721443192.168.2.564.233.176.104
                      Apr 25, 2024 01:58:41.426552057 CEST49721443192.168.2.564.233.176.104
                      Apr 25, 2024 01:58:41.426577091 CEST4434972164.233.176.104192.168.2.5
                      Apr 25, 2024 01:58:41.453213930 CEST4434971844.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:41.453269958 CEST4434971844.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:41.453332901 CEST49718443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:41.453347921 CEST4434971844.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:41.453387976 CEST49718443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:41.453423977 CEST4434971844.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:41.453469038 CEST49718443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:41.455590010 CEST49718443192.168.2.544.214.198.122
                      Apr 25, 2024 01:58:41.455600023 CEST4434971844.214.198.122192.168.2.5
                      Apr 25, 2024 01:58:41.652228117 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.652513981 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:41.652580976 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.653454065 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.653517962 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:41.653541088 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.653594017 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:41.654232979 CEST4434972164.233.176.104192.168.2.5
                      Apr 25, 2024 01:58:41.655468941 CEST49721443192.168.2.564.233.176.104
                      Apr 25, 2024 01:58:41.655505896 CEST4434972164.233.176.104192.168.2.5
                      Apr 25, 2024 01:58:41.655936003 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:41.656001091 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.656403065 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:41.656418085 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.656436920 CEST4434972164.233.176.104192.168.2.5
                      Apr 25, 2024 01:58:41.656497002 CEST49721443192.168.2.564.233.176.104
                      Apr 25, 2024 01:58:41.658509970 CEST49721443192.168.2.564.233.176.104
                      Apr 25, 2024 01:58:41.658570051 CEST4434972164.233.176.104192.168.2.5
                      Apr 25, 2024 01:58:41.700850010 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:41.700851917 CEST49721443192.168.2.564.233.176.104
                      Apr 25, 2024 01:58:41.700872898 CEST4434972164.233.176.104192.168.2.5
                      Apr 25, 2024 01:58:41.734632969 CEST44349720152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.735017061 CEST49720443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.735034943 CEST44349720152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.738549948 CEST44349720152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.738630056 CEST49720443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.739804029 CEST49720443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.739974022 CEST44349720152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.740180969 CEST49720443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.740195990 CEST44349720152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.753328085 CEST49721443192.168.2.564.233.176.104
                      Apr 25, 2024 01:58:41.788639069 CEST49720443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.927011967 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.927031994 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.927093029 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.927113056 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:41.927144051 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.927201033 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.927248001 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:41.927249908 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:41.927249908 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:41.956243038 CEST44349720152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.956401110 CEST44349720152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.956533909 CEST49720443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.956562996 CEST44349720152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.956614971 CEST49720443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.956619978 CEST44349720152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.956682920 CEST49720443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.959698915 CEST49720443192.168.2.5152.199.4.44
                      Apr 25, 2024 01:58:41.959726095 CEST44349720152.199.4.44192.168.2.5
                      Apr 25, 2024 01:58:41.976962090 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.058726072 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.058736086 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.058789968 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.058809996 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.058818102 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.058849096 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.058877945 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.058900118 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.117726088 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.117739916 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.117794991 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.117825031 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.117852926 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.117870092 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.162584066 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.162599087 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.162703037 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.162724018 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.162765980 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.197797060 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.197810888 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.197904110 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.197921991 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.198616982 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.230408907 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.230422974 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.230511904 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.230530024 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.230608940 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.241225958 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.241295099 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.241424084 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.241424084 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.268018007 CEST49719443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:42.268085003 CEST44349719208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:42.687166929 CEST49724443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:42.687202930 CEST4434972423.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:42.687464952 CEST49724443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:42.689879894 CEST49724443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:42.689897060 CEST4434972423.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:42.733105898 CEST4434970323.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:42.734711885 CEST49703443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:42.927006960 CEST4434972423.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:42.927112103 CEST49724443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:43.003576994 CEST49724443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:43.003633022 CEST4434972423.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:43.003952980 CEST4434972423.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:43.055116892 CEST49724443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.204699993 CEST49724443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.248163939 CEST4434972423.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.315665960 CEST4434972423.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.315789938 CEST4434972423.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.315853119 CEST49724443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.315922976 CEST4434972423.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.315967083 CEST49724443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.315967083 CEST49724443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.315987110 CEST4434972423.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.316042900 CEST4434972423.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.356290102 CEST49725443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.356337070 CEST4434972523.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.356533051 CEST49725443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.356779099 CEST49725443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.356795073 CEST4434972523.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.359482050 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:44.359563112 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.359637022 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:44.359889030 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:44.359925985 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.587534904 CEST4434972523.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.587618113 CEST49725443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.589013100 CEST49725443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.589027882 CEST4434972523.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.589792967 CEST4434972523.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.590909958 CEST49725443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.617109060 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.617391109 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:44.617432117 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.618490934 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.618561983 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:44.618593931 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.618722916 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:44.619072914 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:44.619143963 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.619304895 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:44.619318008 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.636111975 CEST4434972523.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.672969103 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:44.805705070 CEST4434972523.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.805872917 CEST4434972523.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.806196928 CEST49725443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.828712940 CEST49725443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.828763008 CEST4434972523.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.828793049 CEST49725443192.168.2.523.63.206.91
                      Apr 25, 2024 01:58:44.828809023 CEST4434972523.63.206.91192.168.2.5
                      Apr 25, 2024 01:58:44.896295071 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.896315098 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.896322012 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.896393061 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.896425009 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.896452904 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:44.896452904 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:44.896477938 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.896495104 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:44.896521091 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:44.896543026 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.029627085 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.029643059 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.029709101 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.029731989 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.029860973 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.085771084 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.085788012 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.085850954 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.085871935 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.085967064 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.131355047 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.131370068 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.131438017 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.131458998 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.131627083 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.166235924 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.166250944 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.166316986 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.166333914 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.166383028 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.198623896 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.198637962 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.198676109 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.198692083 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.198739052 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.198740005 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.209315062 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.209372997 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:45.209393024 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.209428072 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.209731102 CEST49726443192.168.2.5208.80.154.240
                      Apr 25, 2024 01:58:45.209762096 CEST44349726208.80.154.240192.168.2.5
                      Apr 25, 2024 01:58:51.658638000 CEST4434972164.233.176.104192.168.2.5
                      Apr 25, 2024 01:58:51.658704996 CEST4434972164.233.176.104192.168.2.5
                      Apr 25, 2024 01:58:51.658777952 CEST49721443192.168.2.564.233.176.104
                      Apr 25, 2024 01:58:51.993761063 CEST49721443192.168.2.564.233.176.104
                      Apr 25, 2024 01:58:51.993784904 CEST4434972164.233.176.104192.168.2.5
                      Apr 25, 2024 01:58:52.852781057 CEST49703443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:52.852927923 CEST49703443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:52.853414059 CEST49731443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:52.853492022 CEST4434973123.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:52.853569031 CEST49731443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:52.854969978 CEST49731443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:52.855004072 CEST4434973123.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:53.010507107 CEST4434970323.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:53.010534048 CEST4434970323.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:53.183312893 CEST4434973123.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:53.183387995 CEST49731443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:53.242054939 CEST49731443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:53.242089033 CEST4434973123.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:53.242345095 CEST4434973123.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:53.242407084 CEST49731443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:53.243906021 CEST49731443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:53.243941069 CEST4434973123.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:53.245136976 CEST49731443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:53.245151043 CEST4434973123.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:53.568789959 CEST4434973123.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:53.568854094 CEST49731443192.168.2.523.1.237.91
                      Apr 25, 2024 01:58:53.569377899 CEST4434973123.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:53.569416046 CEST4434973123.1.237.91192.168.2.5
                      Apr 25, 2024 01:58:53.569470882 CEST49731443192.168.2.523.1.237.91
                      Apr 25, 2024 01:59:41.366134882 CEST49737443192.168.2.564.233.176.104
                      Apr 25, 2024 01:59:41.366183996 CEST4434973764.233.176.104192.168.2.5
                      Apr 25, 2024 01:59:41.366236925 CEST49737443192.168.2.564.233.176.104
                      Apr 25, 2024 01:59:41.366833925 CEST49737443192.168.2.564.233.176.104
                      Apr 25, 2024 01:59:41.366846085 CEST4434973764.233.176.104192.168.2.5
                      Apr 25, 2024 01:59:41.599000931 CEST4434973764.233.176.104192.168.2.5
                      Apr 25, 2024 01:59:41.610569954 CEST49737443192.168.2.564.233.176.104
                      Apr 25, 2024 01:59:41.610586882 CEST4434973764.233.176.104192.168.2.5
                      Apr 25, 2024 01:59:41.611109018 CEST4434973764.233.176.104192.168.2.5
                      Apr 25, 2024 01:59:41.613317013 CEST49737443192.168.2.564.233.176.104
                      Apr 25, 2024 01:59:41.613487005 CEST4434973764.233.176.104192.168.2.5
                      Apr 25, 2024 01:59:41.663938999 CEST49737443192.168.2.564.233.176.104
                      Apr 25, 2024 01:59:51.594268084 CEST4434973764.233.176.104192.168.2.5
                      Apr 25, 2024 01:59:51.594441891 CEST4434973764.233.176.104192.168.2.5
                      Apr 25, 2024 01:59:51.594511032 CEST49737443192.168.2.564.233.176.104
                      Apr 25, 2024 01:59:52.066945076 CEST49737443192.168.2.564.233.176.104
                      Apr 25, 2024 01:59:52.066989899 CEST4434973764.233.176.104192.168.2.5

                      UDP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Apr 25, 2024 01:58:37.346638918 CEST53579981.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:37.349606037 CEST53529751.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:38.387465954 CEST53613921.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:39.836083889 CEST5859753192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:39.836230993 CEST4991253192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:39.949141026 CEST53585971.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:39.959961891 CEST53499121.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:40.594352007 CEST5309853192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:40.594540119 CEST6072753192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:40.706983089 CEST53530981.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:40.708398104 CEST53607271.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:40.753180027 CEST53553481.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:40.784853935 CEST5540453192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:40.785100937 CEST5883753192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:40.895760059 CEST53554041.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:40.897684097 CEST53588371.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:41.281888962 CEST5432953192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:41.282042980 CEST6498853192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:41.283711910 CEST6212853192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:41.283879042 CEST6440753192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:41.314158916 CEST6486253192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:41.314903975 CEST5977153192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:41.392004013 CEST53543291.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:41.392498016 CEST53649881.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:41.393788099 CEST53621281.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:41.394490004 CEST53644071.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:41.424957991 CEST53648621.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:41.424992085 CEST53597711.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:44.247858047 CEST6358453192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:44.248408079 CEST6340253192.168.2.51.1.1.1
                      Apr 25, 2024 01:58:44.358593941 CEST53634021.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:44.359020948 CEST53635841.1.1.1192.168.2.5
                      Apr 25, 2024 01:58:56.370450974 CEST53645101.1.1.1192.168.2.5
                      Apr 25, 2024 01:59:15.264991045 CEST53507261.1.1.1192.168.2.5
                      Apr 25, 2024 01:59:36.995213032 CEST53506341.1.1.1192.168.2.5
                      Apr 25, 2024 01:59:38.212636948 CEST53558491.1.1.1192.168.2.5

                      DNS Queries

                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                      Apr 25, 2024 01:58:39.836083889 CEST192.168.2.51.1.1.10x4e97Standard query (0)shining-melodic-magnesium.glitch.meA (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:39.836230993 CEST192.168.2.51.1.1.10xdd4aStandard query (0)shining-melodic-magnesium.glitch.me65IN (0x0001)false
                      Apr 25, 2024 01:58:40.594352007 CEST192.168.2.51.1.1.10x9552Standard query (0)aadcdn.msftauth.netA (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:40.594540119 CEST192.168.2.51.1.1.10xe966Standard query (0)aadcdn.msftauth.net65IN (0x0001)false
                      Apr 25, 2024 01:58:40.784853935 CEST192.168.2.51.1.1.10xaa4aStandard query (0)shining-melodic-magnesium.glitch.meA (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:40.785100937 CEST192.168.2.51.1.1.10x5c15Standard query (0)shining-melodic-magnesium.glitch.me65IN (0x0001)false
                      Apr 25, 2024 01:58:41.281888962 CEST192.168.2.51.1.1.10xb9cfStandard query (0)upload.wikimedia.orgA (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:41.282042980 CEST192.168.2.51.1.1.10x2725Standard query (0)upload.wikimedia.org65IN (0x0001)false
                      Apr 25, 2024 01:58:41.283711910 CEST192.168.2.51.1.1.10x3925Standard query (0)aadcdn.msftauth.netA (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:41.283879042 CEST192.168.2.51.1.1.10x9184Standard query (0)aadcdn.msftauth.net65IN (0x0001)false
                      Apr 25, 2024 01:58:41.314158916 CEST192.168.2.51.1.1.10xf344Standard query (0)www.google.comA (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:41.314903975 CEST192.168.2.51.1.1.10x867Standard query (0)www.google.com65IN (0x0001)false
                      Apr 25, 2024 01:58:44.247858047 CEST192.168.2.51.1.1.10xed65Standard query (0)upload.wikimedia.orgA (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:44.248408079 CEST192.168.2.51.1.1.10x7960Standard query (0)upload.wikimedia.org65IN (0x0001)false

                      DNS Answers

                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                      Apr 25, 2024 01:58:39.949141026 CEST1.1.1.1192.168.2.50x4e97No error (0)shining-melodic-magnesium.glitch.me44.214.198.122A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:39.949141026 CEST1.1.1.1192.168.2.50x4e97No error (0)shining-melodic-magnesium.glitch.me18.235.65.101A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:40.706983089 CEST1.1.1.1192.168.2.50x9552No error (0)aadcdn.msftauth.netcs1100.wpc.omegacdn.netCNAME (Canonical name)IN (0x0001)false
                      Apr 25, 2024 01:58:40.706983089 CEST1.1.1.1192.168.2.50x9552No error (0)cs1100.wpc.omegacdn.net152.199.4.44A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:40.708398104 CEST1.1.1.1192.168.2.50xe966No error (0)aadcdn.msftauth.netcs1100.wpc.omegacdn.netCNAME (Canonical name)IN (0x0001)false
                      Apr 25, 2024 01:58:40.895760059 CEST1.1.1.1192.168.2.50xaa4aNo error (0)shining-melodic-magnesium.glitch.me44.214.198.122A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:40.895760059 CEST1.1.1.1192.168.2.50xaa4aNo error (0)shining-melodic-magnesium.glitch.me18.235.65.101A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:41.392004013 CEST1.1.1.1192.168.2.50xb9cfNo error (0)upload.wikimedia.org208.80.154.240A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:41.393788099 CEST1.1.1.1192.168.2.50x3925No error (0)aadcdn.msftauth.netcs1100.wpc.omegacdn.netCNAME (Canonical name)IN (0x0001)false
                      Apr 25, 2024 01:58:41.393788099 CEST1.1.1.1192.168.2.50x3925No error (0)cs1100.wpc.omegacdn.net152.199.4.44A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:41.394490004 CEST1.1.1.1192.168.2.50x9184No error (0)aadcdn.msftauth.netcs1100.wpc.omegacdn.netCNAME (Canonical name)IN (0x0001)false
                      Apr 25, 2024 01:58:41.424957991 CEST1.1.1.1192.168.2.50xf344No error (0)www.google.com64.233.176.104A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:41.424957991 CEST1.1.1.1192.168.2.50xf344No error (0)www.google.com64.233.176.106A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:41.424957991 CEST1.1.1.1192.168.2.50xf344No error (0)www.google.com64.233.176.99A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:41.424957991 CEST1.1.1.1192.168.2.50xf344No error (0)www.google.com64.233.176.103A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:41.424957991 CEST1.1.1.1192.168.2.50xf344No error (0)www.google.com64.233.176.105A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:41.424957991 CEST1.1.1.1192.168.2.50xf344No error (0)www.google.com64.233.176.147A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:41.424992085 CEST1.1.1.1192.168.2.50x867No error (0)www.google.com65IN (0x0001)false
                      Apr 25, 2024 01:58:44.359020948 CEST1.1.1.1192.168.2.50xed65No error (0)upload.wikimedia.org208.80.154.240A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:58:52.622229099 CEST1.1.1.1192.168.2.50x8572No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                      Apr 25, 2024 01:58:52.622229099 CEST1.1.1.1192.168.2.50x8572No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:59:06.091204882 CEST1.1.1.1192.168.2.50x7322No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                      Apr 25, 2024 01:59:06.091204882 CEST1.1.1.1192.168.2.50x7322No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:59:30.325536966 CEST1.1.1.1192.168.2.50x9ccNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                      Apr 25, 2024 01:59:30.325536966 CEST1.1.1.1192.168.2.50x9ccNo error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:59:49.739330053 CEST1.1.1.1192.168.2.50xdcb6No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                      Apr 25, 2024 01:59:49.739330053 CEST1.1.1.1192.168.2.50xdcb6No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:59:53.169657946 CEST1.1.1.1192.168.2.50x41f8No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                      Apr 25, 2024 01:59:53.169657946 CEST1.1.1.1192.168.2.50x41f8No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false

                      HTTP Request Dependency Graph

                      • shining-melodic-magnesium.glitch.me
                      • https:
                        • aadcdn.msftauth.net
                        • upload.wikimedia.org
                        • www.bing.com
                      • fs.microsoft.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.54971344.214.198.1224436400C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2024-04-24 23:58:40 UTC693OUTGET /rvicendDev.html HTTP/1.1
                      Host: shining-melodic-magnesium.glitch.me
                      Connection: keep-alive
                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                      sec-ch-ua-mobile: ?0
                      sec-ch-ua-platform: "Windows"
                      Upgrade-Insecure-Requests: 1
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                      Sec-Fetch-Site: none
                      Sec-Fetch-Mode: navigate
                      Sec-Fetch-User: ?1
                      Sec-Fetch-Dest: document
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      2024-04-24 23:58:40 UTC506INHTTP/1.1 200 OK
                      Date: Wed, 24 Apr 2024 23:58:40 GMT
                      Content-Type: text/html; charset=utf-8
                      Content-Length: 4274
                      Connection: close
                      x-amz-id-2: QYgUCVvmMil+fXI8R/obaBxKz4tHrKmDZYEQIL5PYRcZakmZvxNKtYF4yBBxFIacMNRfXhgWvQ8=
                      x-amz-request-id: YX6TBVB4ZMBY7QQJ
                      last-modified: Wed, 24 Apr 2024 06:00:44 GMT
                      etag: "f6edd152435965f96a6ae58c10e618e9"
                      x-amz-server-side-encryption: AES256
                      cache-control: no-cache
                      x-amz-version-id: kpiG5fAttfPYRm74G5nisVDlUV71Tq8Z
                      accept-ranges: bytes
                      server: AmazonS3
                      2024-04-24 23:58:40 UTC4274INData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 45 78 63 65 6c 20 4d 6f 62 69 6c 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 70 6c 6f 61 64 2e 77 69 6b 69 6d 65 64 69 61 2e 6f 72 67 2f 77 69 6b 69 70 65 64 69 61 2f 63 6f 6d 6d 6f 6e 73 2f 74 68
                      Data Ascii: <html><head><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /><title>Excel Mobile</title> <link rel="icon" href="https://upload.wikimedia.org/wikipedia/commons/th


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      1192.168.2.54971244.214.198.1224436400C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2024-04-24 23:58:40 UTC746OUTGET /rvicendDev.html HTTP/1.1
                      Host: shining-melodic-magnesium.glitch.me
                      Connection: keep-alive
                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                      sec-ch-ua-mobile: ?0
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      sec-ch-ua-platform: "Windows"
                      Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: image
                      Referer: https://shining-melodic-magnesium.glitch.me/rvicendDev.html
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      If-None-Match: "f6edd152435965f96a6ae58c10e618e9"
                      If-Modified-Since: Wed, 24 Apr 2024 06:00:44 GMT
                      2024-04-24 23:58:40 UTC414INHTTP/1.1 304 Not Modified
                      Date: Wed, 24 Apr 2024 23:58:40 GMT
                      Connection: close
                      x-amz-id-2: dkil64qt6bXsabZQRVeoacKOjmT6At2ndNWFrnYAFad6+RZXttosbhl1S3JyTIN+ttKXlzo8fciV3d9BQ7oUd1wGBoxh5To3
                      x-amz-request-id: YX6MGXH82XH1FADR
                      last-modified: Wed, 24 Apr 2024 06:00:44 GMT
                      etag: "f6edd152435965f96a6ae58c10e618e9"
                      cache-control: no-cache
                      x-amz-version-id: kpiG5fAttfPYRm74G5nisVDlUV71Tq8Z
                      server: AmazonS3


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      2192.168.2.549716152.199.4.444436400C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2024-04-24 23:58:41 UTC675OUTGET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1
                      Host: aadcdn.msftauth.net
                      Connection: keep-alive
                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                      sec-ch-ua-mobile: ?0
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      sec-ch-ua-platform: "Windows"
                      Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                      Sec-Fetch-Site: cross-site
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: image
                      Referer: https://shining-melodic-magnesium.glitch.me/
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      2024-04-24 23:58:41 UTC737INHTTP/1.1 200 OK
                      Access-Control-Allow-Origin: *
                      Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
                      Age: 2735741
                      Cache-Control: public, max-age=31536000
                      Content-MD5: nzaLxFgP7ZB3dfMcaybWzw==
                      Content-Type: image/svg+xml
                      Date: Wed, 24 Apr 2024 23:58:41 GMT
                      Etag: 0x8D79A1B9F5E121A
                      Last-Modified: Thu, 16 Jan 2020 00:32:52 GMT
                      Server: ECAcc (agc/7F76)
                      Vary: Accept-Encoding
                      X-Cache: HIT
                      x-ms-blob-type: BlockBlob
                      x-ms-lease-status: unlocked
                      x-ms-request-id: 76c53dc6-501e-00c2-6dc1-7d8866000000
                      x-ms-version: 2009-09-19
                      Content-Length: 3651
                      Connection: close
                      2024-04-24 23:58:41 UTC3651INData Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30
                      Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      3192.168.2.54971844.214.198.1224436400C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2024-04-24 23:58:41 UTC374OUTGET /rvicendDev.html HTTP/1.1
                      Host: shining-melodic-magnesium.glitch.me
                      Connection: keep-alive
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept: */*
                      Sec-Fetch-Site: none
                      Sec-Fetch-Mode: cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      2024-04-24 23:58:41 UTC506INHTTP/1.1 200 OK
                      Date: Wed, 24 Apr 2024 23:58:41 GMT
                      Content-Type: text/html; charset=utf-8
                      Content-Length: 4274
                      Connection: close
                      x-amz-id-2: kg+Lt+h5/qNcjFpdyqwIjWN0kJUG3sjAaL6pj833fHGsCt1z8s3/5+FGsW06R85HCtf0hwhYcIA=
                      x-amz-request-id: FENV11XVXJ9BYQQT
                      last-modified: Wed, 24 Apr 2024 06:00:44 GMT
                      etag: "f6edd152435965f96a6ae58c10e618e9"
                      x-amz-server-side-encryption: AES256
                      cache-control: no-cache
                      x-amz-version-id: kpiG5fAttfPYRm74G5nisVDlUV71Tq8Z
                      accept-ranges: bytes
                      server: AmazonS3
                      2024-04-24 23:58:41 UTC4274INData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 45 78 63 65 6c 20 4d 6f 62 69 6c 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 70 6c 6f 61 64 2e 77 69 6b 69 6d 65 64 69 61 2e 6f 72 67 2f 77 69 6b 69 70 65 64 69 61 2f 63 6f 6d 6d 6f 6e 73 2f 74 68
                      Data Ascii: <html><head><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /><title>Excel Mobile</title> <link rel="icon" href="https://upload.wikimedia.org/wikipedia/commons/th


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      4192.168.2.549719208.80.154.2404436400C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2024-04-24 23:58:41 UTC746OUTGET /wikipedia/commons/thumb/3/34/Microsoft_Office_Excel_%282019%E2%80%93present%29.svg/2203px-Microsoft_Office_Excel_%282019%E2%80%93present%29.svg.png HTTP/1.1
                      Host: upload.wikimedia.org
                      Connection: keep-alive
                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                      sec-ch-ua-mobile: ?0
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      sec-ch-ua-platform: "Windows"
                      Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                      Sec-Fetch-Site: cross-site
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: image
                      Referer: https://shining-melodic-magnesium.glitch.me/
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      2024-04-24 23:58:41 UTC1101INHTTP/1.1 200 OK
                      date: Wed, 24 Apr 2024 05:47:12 GMT
                      etag: 39f9670257cf2c47b21177e26205540a
                      server: ATS/9.1.4
                      content-type: image/png
                      content-disposition: inline;filename*=UTF-8''Microsoft_Office_Excel_%282019%E2%80%93present%29.svg.png
                      last-modified: Sat, 02 Mar 2024 07:17:32 GMT
                      content-length: 100727
                      age: 65489
                      x-cache: cp1103 miss, cp1103 hit/68
                      x-cache-status: hit-front
                      server-timing: cache;desc="hit-front", host;desc="cp1103"
                      strict-transport-security: max-age=106384710; includeSubDomains; preload
                      report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
                      nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
                      x-client-ip: 185.152.66.230
                      x-content-type-options: nosniff
                      access-control-allow-origin: *
                      access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
                      timing-allow-origin: *
                      accept-ranges: bytes
                      connection: close
                      2024-04-24 23:58:41 UTC13797INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 08 9b 00 00 08 01 08 06 00 00 00 40 b0 73 8b 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 80 00 49 44 41 54 78 da ec dd 7b b8 65 67 5d 27 f8 df bb f7 3e e7 d4 25 95 14 b9 27 20 49 2a d0 28 08 11 08 8a 04 4d 40 74 44 3b 81 68 83 e2 05 1d 85 d0 cd d3 2d 3a 8e 62 ab 60 05 15 08 f6 74 4f db ea 0c 3e 8d 68 08 b6 93 b6 1d 9f 91 46 51 47 18 2e 3a 2a a2 36 3a 4e f7 68 a3 d8 88 28 10 92 54 aa ea 5c f6 7a e7 8f 0a 21 21 a9 d4 3a 67 dd f6 5a ef e7 f3 3c dd 08 55 95 75 7e 97 b5 ce 3e 2b df 5a 2b 05 00 00 bb 73 f4 e8 ec ca
                      Data Ascii: PNGIHDR@sgAMAa cHRMz&u0`:pQ<bKGDIDATx{eg]'>%' I*(M@tD;h-:b`tO>hFQG.:*6:Nh(T\z!!:gZ<Uu~>+Z+s
                      2024-04-24 23:58:42 UTC16320INData Raw: 53 45 75 f7 96 53 11 00 00 00 0a 77 da b0 c9 c7 f7 6d 7e 4d 44 ba a0 dd c3 8d 2f 64 e2 de 68 93 ee ad d8 97 63 98 83 34 76 b2 4f 33 31 6b 7a dc 25 21 13 da bf 2e 79 65 8e e5 d0 28 1b de f1 51 ec 92 0f a2 2e e0 0f 32 3f ef ac c9 8c a5 ba d3 d3 4d 00 00 00 a0 74 a7 0d 9b a4 98 bd b4 bd c3 8c eb 6f 53 ba 2f 3a b1 ee 19 e6 20 8d f5 ca 1c 45 d3 bc ad fd 76 df 9c cb 38 45 bd 32 c7 72 58 0d df a7 3b 3e 8f ec 92 cf 64 4a 3e ad f9 45 87 22 cd 66 d3 18 cf b1 ad 88 ad ca a9 09 00 00 00 05 7b c8 bb 1c 17 be e1 f9 57 46 e4 67 b5 73 88 f1 fc 6d 4a f7 45 27 d6 3d 03 1d ac b1 42 26 8a a6 79 5b b3 59 d3 ea d8 bc 3c 46 d5 9a 34 cd 59 af d0 46 d9 25 57 32 25 9f b1 a4 b4 98 c5 ec 9c 7d 93 a9 cb d3 4d 00 00 00 a0 6c 0f 19 36 99 57 d5 8b 22 22 35 fb 47 8f ef 95 39 4c a4 7b 6e
                      Data Ascii: SEuSwm~MD/dhc4vO31kz%!.ye(Q.2?MtoS/: Ev8E2rX;>dJ>E"f{WFgsmJE'=B&y[Y<F4YF%W2%}Ml6W""5G9L{n
                      2024-04-24 23:58:42 UTC16320INData Raw: c6 7b 28 dc 84 75 76 75 c5 81 ff 38 29 ba 1a f6 df 95 5b 0d 35 79 d7 24 41 34 99 64 73 e9 02 bf 66 a2 ac 00 00 00 80 0a ea 5b b3 49 e9 9a 4c 22 3c a5 a9 28 0f ba 8d 38 ab 9a 2e f1 44 5d f2 c0 b5 71 c3 53 f7 aa 77 ba e5 d0 0d 77 57 d3 16 f0 4a 44 f1 6b 6b ef 1c 0b cc 3a b7 a2 4d d8 af 6f bd 24 fe f9 e2 63 26 a2 4a ab a1 bd 77 8d ee 1b 0d 45 d1 e7 cb 16 dc 64 a2 b4 00 00 00 80 8a ea 5d b3 49 37 1f 88 e4 df 64 e2 29 4d e5 78 d0 dd ed 51 4b 8e 7a a4 c6 77 46 fd 32 a6 77 75 a8 7d 3e d6 e6 4b ae 11 6b 2f b4 5c ca 0b be 21 57 60 48 b3 0d 1c 1a df 5a ef 33 0a 36 61 2f bf 3d 3e 7e 72 ed ef 4c 44 55 96 86 5e 5d dc df 58 e5 dc f8 fb 9a 49 df 2f ab c9 04 00 00 00 a0 2f 7a d6 6c d2 c3 23 73 f2 e1 29 4d 25 79 d0 2d bb b3 1a 75 c5 26 e9 e1 57 9f 89 b3 6f ff 87 35 80 6e
                      Data Ascii: {(uvu8)[5y$A4dsf[IL"<(8.D]qSwwWJDkk:Mo$c&JwEd]I7d)MxQKzwF2wu}>Kk/\!W`HZ36a/=>~rLDU^]XI//zl#s)M%y-u&Wo5n
                      2024-04-24 23:58:42 UTC16320INData Raw: 25 d4 0b e9 6c 2e 5d d0 97 0f 6a 77 ab f4 42 ba ef b1 56 d3 95 ae e9 08 c7 60 01 00 00 00 24 42 b3 49 29 38 32 27 ad 58 4b ef fa 0f 47 01 d5 2d 97 0e bd fc d4 98 de d9 21 06 90 b1 9f 5c fb bb 78 fa 8d 97 7a 59 eb 5e 48 67 73 69 2f a4 73 0d 62 8a 5b 84 14 6b 3a c2 31 58 6a 1a 00 00 00 a0 f6 34 9b 14 2a bf 27 53 9a 4c d2 89 b5 21 17 59 47 0a a8 ae b9 f4 f0 ab 4f c7 6f 6e fb bb 58 40 86 1e 7f fd b9 f8 d5 cd 7f ee 65 ad 7b 21 dd f7 cb 7a 21 9d eb 60 52 3e 32 27 c5 9a 76 64 8e 9a 06 00 00 00 48 80 66 93 c2 e4 d7 64 92 e2 3f 24 2c 57 9c 35 99 a4 31 24 05 54 f7 5c fa f1 35 bf 8d 97 df 1e 2f 2e 90 45 79 37 1a 71 d0 a5 bf 88 a9 1d d3 7b b8 84 fa 9a 49 36 97 f6 42 3a d7 c1 38 32 47 4d e7 50 d3 8e c1 52 d3 00 00 00 00 79 d3 6c 92 bb 92 1e 99 43 25 e3 5c ca 61 27 17
                      Data Ascii: %l.]jwBV`$BI)82'XKG-!\xzY^Hgsi/sb[k:1Xj4*'SL!YGOonX@e{!z!`R>2'vdHfd?$,W51$T\5/.Ey7q{I6B:82GMPRylC%\a'
                      2024-04-24 23:58:42 UTC16320INData Raw: 32 27 81 fb 74 19 62 ad c9 24 e7 c1 a8 e9 74 26 c8 9f 77 00 00 00 40 05 79 a3 d8 53 9a 4c 84 b3 d0 8b 8b 73 ee 31 4a a8 06 0f d8 70 d7 58 71 de 25 c4 3d 51 77 3d f7 50 5c 72 df 38 35 5d 50 4d 3f f8 d2 13 f1 a7 7b af 92 88 09 6b 6b 6d 8d 93 76 3a f8 7d 0d 7f 3d c8 45 47 e6 a4 b1 57 2e f8 c8 1c 7f ea e4 38 18 35 ad a6 01 00 00 00 4a 4e b3 49 4f 68 32 a9 55 28 1b 95 ca 25 b1 2e 67 82 d4 27 2e 4b 0c 5f 30 0e dc 70 57 b1 4f d8 b1 63 ce 8c 46 a3 a1 a6 0b ac e9 e3 ae 3c ab fe 5f 96 61 a6 56 59 60 e9 d8 7b ad 1d 7a b6 59 70 bc 46 1a 93 53 70 93 49 a1 8d 26 a9 fd 31 a9 a6 d3 99 1c 7f de 01 00 00 00 15 a7 d9 a4 3b 4a fb 35 13 2a 17 4a 47 e6 d4 24 41 ea f5 f2 aa 35 5a e2 e4 1d 0f 8e 01 ed fd e5 40 a2 46 3d 74 53 5c fb f8 5d 6a ba 60 cf bc f1 52 fc f6 f6 4b 25 64 e2
                      Data Ascii: 2'tb$t&w@ySLs1JpXq%=Qw=P\r85]PM?{kkmv:}=EGW.85JNIOh2U(%.g'.K_0pWOcF<_aVY`{zYpFSpI&1;J5*JG$A5Z@F=tS\]j`RK%d
                      2024-04-24 23:58:42 UTC16320INData Raw: 76 f3 4a d3 9a d6 b4 a6 35 ad e9 7e 1f 67 5d 6b 5a d3 9a d6 b4 a6 01 00 00 00 ea d4 bf c5 26 26 c5 06 ce 44 77 37 63 36 d1 ad 69 4d 97 f5 f9 d6 b4 a6 35 ad 69 4d f7 a6 6b 4d 6b 5a d3 9a 06 00 00 00 60 6a fd 59 6c e2 e6 d5 c0 99 e8 ee 66 dc 26 ba 07 dd b5 57 e6 68 5a d3 9a d6 b4 a6 35 ad 69 d7 df 9a d6 b4 ae 01 00 00 00 2a 30 ff c5 26 26 ba 07 ce cd ab 6e c6 6c a2 5b d3 03 3c 88 9a d6 74 a9 4d d7 7a ae d6 b4 a6 35 ad 69 4d eb 5a d3 06 03 00 00 00 d0 d2 fc 16 9b 98 e8 2e 80 89 ee e9 c7 ec e6 95 a6 35 5d de e7 5b d7 9a d6 b4 a6 35 ad 69 4d bb fe d6 b4 a6 c5 0a 00 00 00 94 6d 3e 8b 4d 4c 8a 0d 9c 89 ee 6e c6 6c a2 5b d3 9a 2e eb f3 ad 69 4d 6b 5a d3 9a ee 4d d7 9e 24 a8 69 4d 6b da 01 04 00 00 00 98 a9 bc 8b 4d 4c 8a 0d 9c 9b 57 dd 8c db 44 b7 a6 07 78 00 dd
                      Data Ascii: vJ5~g]kZ&&Dw7c6iM5iMkMkZ`jYlf&WhZ5i*0&&nl[<tMz5iMZ.5][5iMm>MLnl[.iMkZM$iMkMLWDx
                      2024-04-24 23:58:42 UTC5330INData Raw: 00 00 00 5a b3 d8 04 00 00 00 00 00 00 00 80 d6 2c 36 01 00 00 00 00 00 00 00 a0 35 8b 4d 00 00 00 00 00 00 00 00 68 cd 62 13 00 00 00 00 00 00 00 00 5a b3 d8 04 00 00 00 00 00 00 00 80 d6 2c 36 01 00 00 00 00 00 00 00 a0 35 8b 4d 00 00 00 00 00 00 00 00 68 cd 62 13 00 00 00 00 00 00 00 00 5a b3 d8 04 00 00 00 00 00 00 00 80 d6 2c 36 01 00 00 00 00 00 00 00 a0 35 8b 4d 00 00 00 00 00 00 00 00 68 cd 62 13 00 00 00 00 00 00 00 00 5a b3 d8 04 00 00 00 00 00 00 00 80 d6 2c 36 01 00 00 00 00 00 00 00 a0 35 8b 4d 00 00 00 00 00 00 00 00 68 cd 62 13 00 00 00 00 00 00 00 00 5a b3 d8 04 00 00 00 00 00 00 00 80 d6 2c 36 01 00 00 00 00 00 00 00 a0 35 8b 4d 00 00 00 00 00 00 00 00 68 cd 62 13 00 00 00 00 00 00 00 00 5a b3 d8 04 00 00 00 00 00 00 00 80 d6 2c 36 01 00
                      Data Ascii: Z,65MhbZ,65MhbZ,65MhbZ,65MhbZ,65MhbZ,6


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      5192.168.2.549720152.199.4.444436400C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2024-04-24 23:58:41 UTC420OUTGET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1
                      Host: aadcdn.msftauth.net
                      Connection: keep-alive
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept: */*
                      Sec-Fetch-Site: none
                      Sec-Fetch-Mode: cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      2024-04-24 23:58:41 UTC737INHTTP/1.1 200 OK
                      Access-Control-Allow-Origin: *
                      Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
                      Age: 2735741
                      Cache-Control: public, max-age=31536000
                      Content-MD5: nzaLxFgP7ZB3dfMcaybWzw==
                      Content-Type: image/svg+xml
                      Date: Wed, 24 Apr 2024 23:58:41 GMT
                      Etag: 0x8D79A1B9F5E121A
                      Last-Modified: Thu, 16 Jan 2020 00:32:52 GMT
                      Server: ECAcc (agc/7F76)
                      Vary: Accept-Encoding
                      X-Cache: HIT
                      x-ms-blob-type: BlockBlob
                      x-ms-lease-status: unlocked
                      x-ms-request-id: 76c53dc6-501e-00c2-6dc1-7d8866000000
                      x-ms-version: 2009-09-19
                      Content-Length: 3651
                      Connection: close
                      2024-04-24 23:58:41 UTC3651INData Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30
                      Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      6192.168.2.54972423.63.206.91443
                      TimestampBytes transferredDirectionData
                      2024-04-24 23:58:44 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                      Connection: Keep-Alive
                      Accept: */*
                      Accept-Encoding: identity
                      User-Agent: Microsoft BITS/7.8
                      Host: fs.microsoft.com
                      2024-04-24 23:58:44 UTC467INHTTP/1.1 200 OK
                      Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                      Content-Type: application/octet-stream
                      ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                      Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                      Server: ECAcc (chd/0758)
                      X-CID: 11
                      X-Ms-ApiVersion: Distribute 1.2
                      X-Ms-Region: prod-eus-z1
                      Cache-Control: public, max-age=198291
                      Date: Wed, 24 Apr 2024 23:58:44 GMT
                      Connection: close
                      X-CID: 2


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      7192.168.2.54972523.63.206.91443
                      TimestampBytes transferredDirectionData
                      2024-04-24 23:58:44 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                      Connection: Keep-Alive
                      Accept: */*
                      Accept-Encoding: identity
                      If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                      Range: bytes=0-2147483646
                      User-Agent: Microsoft BITS/7.8
                      Host: fs.microsoft.com
                      2024-04-24 23:58:44 UTC531INHTTP/1.1 200 OK
                      Content-Type: application/octet-stream
                      Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                      ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                      ApiVersion: Distribute 1.1
                      Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                      X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm
                      Cache-Control: public, max-age=198304
                      Date: Wed, 24 Apr 2024 23:58:44 GMT
                      Content-Length: 55
                      Connection: close
                      X-CID: 2
                      2024-04-24 23:58:44 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                      Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      8192.168.2.549726208.80.154.2404436400C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2024-04-24 23:58:44 UTC491OUTGET /wikipedia/commons/thumb/3/34/Microsoft_Office_Excel_%282019%E2%80%93present%29.svg/2203px-Microsoft_Office_Excel_%282019%E2%80%93present%29.svg.png HTTP/1.1
                      Host: upload.wikimedia.org
                      Connection: keep-alive
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept: */*
                      Sec-Fetch-Site: none
                      Sec-Fetch-Mode: cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      2024-04-24 23:58:44 UTC1101INHTTP/1.1 200 OK
                      date: Wed, 24 Apr 2024 05:47:12 GMT
                      etag: 39f9670257cf2c47b21177e26205540a
                      server: ATS/9.1.4
                      content-type: image/png
                      content-disposition: inline;filename*=UTF-8''Microsoft_Office_Excel_%282019%E2%80%93present%29.svg.png
                      last-modified: Sat, 02 Mar 2024 07:17:32 GMT
                      content-length: 100727
                      age: 65492
                      x-cache: cp1103 miss, cp1103 hit/69
                      x-cache-status: hit-front
                      server-timing: cache;desc="hit-front", host;desc="cp1103"
                      strict-transport-security: max-age=106384710; includeSubDomains; preload
                      report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
                      nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
                      x-client-ip: 185.152.66.230
                      x-content-type-options: nosniff
                      access-control-allow-origin: *
                      access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
                      timing-allow-origin: *
                      accept-ranges: bytes
                      connection: close
                      2024-04-24 23:58:44 UTC13797INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 08 9b 00 00 08 01 08 06 00 00 00 40 b0 73 8b 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 80 00 49 44 41 54 78 da ec dd 7b b8 65 67 5d 27 f8 df bb f7 3e e7 d4 25 95 14 b9 27 20 49 2a d0 28 08 11 08 8a 04 4d 40 74 44 3b 81 68 83 e2 05 1d 85 d0 cd d3 2d 3a 8e 62 ab 60 05 15 08 f6 74 4f db ea 0c 3e 8d 68 08 b6 93 b6 1d 9f 91 46 51 47 18 2e 3a 2a a2 36 3a 4e f7 68 a3 d8 88 28 10 92 54 aa ea 5c f6 7a e7 8f 0a 21 21 a9 d4 3a 67 dd f6 5a ef e7 f3 3c dd 08 55 95 75 7e 97 b5 ce 3e 2b df 5a 2b 05 00 00 bb 73 f4 e8 ec ca
                      Data Ascii: PNGIHDR@sgAMAa cHRMz&u0`:pQ<bKGDIDATx{eg]'>%' I*(M@tD;h-:b`tO>hFQG.:*6:Nh(T\z!!:gZ<Uu~>+Z+s
                      2024-04-24 23:58:45 UTC16320INData Raw: 53 45 75 f7 96 53 11 00 00 00 0a 77 da b0 c9 c7 f7 6d 7e 4d 44 ba a0 dd c3 8d 2f 64 e2 de 68 93 ee ad d8 97 63 98 83 34 76 b2 4f 33 31 6b 7a dc 25 21 13 da bf 2e 79 65 8e e5 d0 28 1b de f1 51 ec 92 0f a2 2e e0 0f 32 3f ef ac c9 8c a5 ba d3 d3 4d 00 00 00 a0 74 a7 0d 9b a4 98 bd b4 bd c3 8c eb 6f 53 ba 2f 3a b1 ee 19 e6 20 8d f5 ca 1c 45 d3 bc ad fd 76 df 9c cb 38 45 bd 32 c7 72 58 0d df a7 3b 3e 8f ec 92 cf 64 4a 3e ad f9 45 87 22 cd 66 d3 18 cf b1 ad 88 ad ca a9 09 00 00 00 05 7b c8 bb 1c 17 be e1 f9 57 46 e4 67 b5 73 88 f1 fc 6d 4a f7 45 27 d6 3d 03 1d ac b1 42 26 8a a6 79 5b b3 59 d3 ea d8 bc 3c 46 d5 9a 34 cd 59 af d0 46 d9 25 57 32 25 9f b1 a4 b4 98 c5 ec 9c 7d 93 a9 cb d3 4d 00 00 00 a0 6c 0f 19 36 99 57 d5 8b 22 22 35 fb 47 8f ef 95 39 4c a4 7b 6e
                      Data Ascii: SEuSwm~MD/dhc4vO31kz%!.ye(Q.2?MtoS/: Ev8E2rX;>dJ>E"f{WFgsmJE'=B&y[Y<F4YF%W2%}Ml6W""5G9L{n
                      2024-04-24 23:58:45 UTC16320INData Raw: c6 7b 28 dc 84 75 76 75 c5 81 ff 38 29 ba 1a f6 df 95 5b 0d 35 79 d7 24 41 34 99 64 73 e9 02 bf 66 a2 ac 00 00 00 80 0a ea 5b b3 49 e9 9a 4c 22 3c a5 a9 28 0f ba 8d 38 ab 9a 2e f1 44 5d f2 c0 b5 71 c3 53 f7 aa 77 ba e5 d0 0d 77 57 d3 16 f0 4a 44 f1 6b 6b ef 1c 0b cc 3a b7 a2 4d d8 af 6f bd 24 fe f9 e2 63 26 a2 4a ab a1 bd 77 8d ee 1b 0d 45 d1 e7 cb 16 dc 64 a2 b4 00 00 00 80 8a ea 5d b3 49 37 1f 88 e4 df 64 e2 29 4d e5 78 d0 dd ed 51 4b 8e 7a a4 c6 77 46 fd 32 a6 77 75 a8 7d 3e d6 e6 4b ae 11 6b 2f b4 5c ca 0b be 21 57 60 48 b3 0d 1c 1a df 5a ef 33 0a 36 61 2f bf 3d 3e 7e 72 ed ef 4c 44 55 96 86 5e 5d dc df 58 e5 dc f8 fb 9a 49 df 2f ab c9 04 00 00 00 a0 2f 7a d6 6c d2 c3 23 73 f2 e1 29 4d 25 79 d0 2d bb b3 1a 75 c5 26 e9 e1 57 9f 89 b3 6f ff 87 35 80 6e
                      Data Ascii: {(uvu8)[5y$A4dsf[IL"<(8.D]qSwwWJDkk:Mo$c&JwEd]I7d)MxQKzwF2wu}>Kk/\!W`HZ36a/=>~rLDU^]XI//zl#s)M%y-u&Wo5n
                      2024-04-24 23:58:45 UTC16320INData Raw: 25 d4 0b e9 6c 2e 5d d0 97 0f 6a 77 ab f4 42 ba ef b1 56 d3 95 ae e9 08 c7 60 01 00 00 00 24 42 b3 49 29 38 32 27 ad 58 4b ef fa 0f 47 01 d5 2d 97 0e bd fc d4 98 de d9 21 06 90 b1 9f 5c fb bb 78 fa 8d 97 7a 59 eb 5e 48 67 73 69 2f a4 73 0d 62 8a 5b 84 14 6b 3a c2 31 58 6a 1a 00 00 00 a0 f6 34 9b 14 2a bf 27 53 9a 4c d2 89 b5 21 17 59 47 0a a8 ae b9 f4 f0 ab 4f c7 6f 6e fb bb 58 40 86 1e 7f fd b9 f8 d5 cd 7f ee 65 ad 7b 21 dd f7 cb 7a 21 9d eb 60 52 3e 32 27 c5 9a 76 64 8e 9a 06 00 00 00 48 80 66 93 c2 e4 d7 64 92 e2 3f 24 2c 57 9c 35 99 a4 31 24 05 54 f7 5c fa f1 35 bf 8d 97 df 1e 2f 2e 90 45 79 37 1a 71 d0 a5 bf 88 a9 1d d3 7b b8 84 fa 9a 49 36 97 f6 42 3a d7 c1 38 32 47 4d e7 50 d3 8e c1 52 d3 00 00 00 00 79 d3 6c 92 bb 92 1e 99 43 25 e3 5c ca 61 27 17
                      Data Ascii: %l.]jwBV`$BI)82'XKG-!\xzY^Hgsi/sb[k:1Xj4*'SL!YGOonX@e{!z!`R>2'vdHfd?$,W51$T\5/.Ey7q{I6B:82GMPRylC%\a'
                      2024-04-24 23:58:45 UTC16320INData Raw: 32 27 81 fb 74 19 62 ad c9 24 e7 c1 a8 e9 74 26 c8 9f 77 00 00 00 40 05 79 a3 d8 53 9a 4c 84 b3 d0 8b 8b 73 ee 31 4a a8 06 0f d8 70 d7 58 71 de 25 c4 3d 51 77 3d f7 50 5c 72 df 38 35 5d 50 4d 3f f8 d2 13 f1 a7 7b af 92 88 09 6b 6b 6d 8d 93 76 3a f8 7d 0d 7f 3d c8 45 47 e6 a4 b1 57 2e f8 c8 1c 7f ea e4 38 18 35 ad a6 01 00 00 00 4a 4e b3 49 4f 68 32 a9 55 28 1b 95 ca 25 b1 2e 67 82 d4 27 2e 4b 0c 5f 30 0e dc 70 57 b1 4f d8 b1 63 ce 8c 46 a3 a1 a6 0b ac e9 e3 ae 3c ab fe 5f 96 61 a6 56 59 60 e9 d8 7b ad 1d 7a b6 59 70 bc 46 1a 93 53 70 93 49 a1 8d 26 a9 fd 31 a9 a6 d3 99 1c 7f de 01 00 00 00 15 a7 d9 a4 3b 4a fb 35 13 2a 17 4a 47 e6 d4 24 41 ea f5 f2 aa 35 5a e2 e4 1d 0f 8e 01 ed fd e5 40 a2 46 3d 74 53 5c fb f8 5d 6a ba 60 cf bc f1 52 fc f6 f6 4b 25 64 e2
                      Data Ascii: 2'tb$t&w@ySLs1JpXq%=Qw=P\r85]PM?{kkmv:}=EGW.85JNIOh2U(%.g'.K_0pWOcF<_aVY`{zYpFSpI&1;J5*JG$A5Z@F=tS\]j`RK%d
                      2024-04-24 23:58:45 UTC16320INData Raw: 76 f3 4a d3 9a d6 b4 a6 35 ad e9 7e 1f 67 5d 6b 5a d3 9a d6 b4 a6 01 00 00 00 ea d4 bf c5 26 26 c5 06 ce 44 77 37 63 36 d1 ad 69 4d 97 f5 f9 d6 b4 a6 35 ad 69 4d f7 a6 6b 4d 6b 5a d3 9a 06 00 00 00 60 6a fd 59 6c e2 e6 d5 c0 99 e8 ee 66 dc 26 ba 07 dd b5 57 e6 68 5a d3 9a d6 b4 a6 35 ad 69 d7 df 9a d6 b4 ae 01 00 00 00 2a 30 ff c5 26 26 ba 07 ce cd ab 6e c6 6c a2 5b d3 03 3c 88 9a d6 74 a9 4d d7 7a ae d6 b4 a6 35 ad 69 4d eb 5a d3 06 03 00 00 00 d0 d2 fc 16 9b 98 e8 2e 80 89 ee e9 c7 ec e6 95 a6 35 5d de e7 5b d7 9a d6 b4 a6 35 ad 69 4d bb fe d6 b4 a6 c5 0a 00 00 00 94 6d 3e 8b 4d 4c 8a 0d 9c 89 ee 6e c6 6c a2 5b d3 9a 2e eb f3 ad 69 4d 6b 5a d3 9a ee 4d d7 9e 24 a8 69 4d 6b da 01 04 00 00 00 98 a9 bc 8b 4d 4c 8a 0d 9c 9b 57 dd 8c db 44 b7 a6 07 78 00 dd
                      Data Ascii: vJ5~g]kZ&&Dw7c6iM5iMkMkZ`jYlf&WhZ5i*0&&nl[<tMz5iMZ.5][5iMm>MLnl[.iMkZM$iMkMLWDx
                      2024-04-24 23:58:45 UTC5330INData Raw: 00 00 00 5a b3 d8 04 00 00 00 00 00 00 00 80 d6 2c 36 01 00 00 00 00 00 00 00 a0 35 8b 4d 00 00 00 00 00 00 00 00 68 cd 62 13 00 00 00 00 00 00 00 00 5a b3 d8 04 00 00 00 00 00 00 00 80 d6 2c 36 01 00 00 00 00 00 00 00 a0 35 8b 4d 00 00 00 00 00 00 00 00 68 cd 62 13 00 00 00 00 00 00 00 00 5a b3 d8 04 00 00 00 00 00 00 00 80 d6 2c 36 01 00 00 00 00 00 00 00 a0 35 8b 4d 00 00 00 00 00 00 00 00 68 cd 62 13 00 00 00 00 00 00 00 00 5a b3 d8 04 00 00 00 00 00 00 00 80 d6 2c 36 01 00 00 00 00 00 00 00 a0 35 8b 4d 00 00 00 00 00 00 00 00 68 cd 62 13 00 00 00 00 00 00 00 00 5a b3 d8 04 00 00 00 00 00 00 00 80 d6 2c 36 01 00 00 00 00 00 00 00 a0 35 8b 4d 00 00 00 00 00 00 00 00 68 cd 62 13 00 00 00 00 00 00 00 00 5a b3 d8 04 00 00 00 00 00 00 00 80 d6 2c 36 01 00
                      Data Ascii: Z,65MhbZ,65MhbZ,65MhbZ,65MhbZ,65MhbZ,6


                      Session IDSource IPSource PortDestination IPDestination Port
                      9192.168.2.54973123.1.237.91443
                      TimestampBytes transferredDirectionData
                      2024-04-24 23:58:53 UTC2148OUTPOST /threshold/xls.aspx HTTP/1.1
                      Origin: https://www.bing.com
                      Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init
                      Accept: */*
                      Accept-Language: en-CH
                      Content-type: text/xml
                      X-Agent-DeviceId: 01000A410900D492
                      X-BM-CBT: 1696428841
                      X-BM-DateFormat: dd/MM/yyyy
                      X-BM-DeviceDimensions: 784x984
                      X-BM-DeviceDimensionsLogical: 784x984
                      X-BM-DeviceScale: 100
                      X-BM-DTZ: 120
                      X-BM-Market: CH
                      X-BM-Theme: 000000;0078d7
                      X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E
                      X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22
                      X-Device-isOptin: false
                      X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}
                      X-Device-OSSKU: 48
                      X-Device-Touch: false
                      X-DeviceID: 01000A410900D492
                      X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh
                      X-MSEdge-ExternalExpType: JointCoord
                      X-PositionerType: Desktop
                      X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI
                      X-Search-CortanaAvailableCapabilities: None
                      X-Search-SafeSearch: Moderate
                      X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time
                      X-UserAgeClass: Unknown
                      Accept-Encoding: gzip, deflate, br
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045
                      Host: www.bing.com
                      Content-Length: 2484
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714003100925&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
                      2024-04-24 23:58:53 UTC1OUTData Raw: 3c
                      Data Ascii: <
                      2024-04-24 23:58:53 UTC2483OUTData Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49
                      Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
                      2024-04-24 23:58:53 UTC479INHTTP/1.1 204 No Content
                      Access-Control-Allow-Origin: *
                      Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                      X-MSEdge-Ref: Ref A: 1D6BCC517D1A455899F8FD7AC61DA781 Ref B: LAX311000111031 Ref C: 2024-04-24T23:58:53Z
                      Date: Wed, 24 Apr 2024 23:58:53 GMT
                      Connection: close
                      Alt-Svc: h3=":443"; ma=93600
                      X-CDN-TraceID: 0.57ed0117.1714003133.66bae97


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:01:58:31
                      Start date:25/04/2024
                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
                      Imagebase:0x7ff715980000
                      File size:3'242'272 bytes
                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:low
                      Has exited:false

                      General

                      Target ID:2
                      Start time:01:58:34
                      Start date:25/04/2024
                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2060,i,11271670896977708482,13358523711605265383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                      Imagebase:0x7ff715980000
                      File size:3'242'272 bytes
                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:low
                      Has exited:false

                      General

                      Target ID:3
                      Start time:01:58:38
                      Start date:25/04/2024
                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://shining-melodic-magnesium.glitch.me/rvicendDev.html"
                      Imagebase:0x7ff715980000
                      File size:3'242'272 bytes
                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:low
                      Has exited:true

                      Disassembly

                      ⊘No disassembly