Edit tour

Windows Analysis Report
https://indiadomainstore.com/mt/

Overview

General Information

Sample URL:	https://indiadomainstore.com/mt/
Analysis ID:	1432128
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML page contains hidden URLs or javascript code

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=1948,i,2694083351701983556,4194912050434543017,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3856 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://indiadomainstore.com/mt/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://emailactivation.ru/

HTTP Parser: Base64 decoded: (function(){ var a = function() {try{return !!window.addEventListener} catch(e) {return !1} }, b = function(b, c) {a() ? document.addEventListener("DOMContentLoaded", b, c) : document.attachEvent("onreadystatechange", b)}; b(functi...

Source: https://emailactivation.ru/

HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49731 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.5:49720 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49731 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /mt/ HTTP/1.1Host: indiadomainstore.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: emailactivation.ruConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: emailactivation.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; fdLUwBQFXFKl3GT693-SqoGX1x8=6qvSXxbRb8EjyH18cJIK45pMK2s
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: emailactivation.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://emailactivation.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; fdLUwBQFXFKl3GT693-SqoGX1x8=6qvSXxbRb8EjyH18cJIK45pMK2s; C6QreykZJ2QreksuEu6WFq_CZ9U=1714136310; rqu3pOw_ZPXX1dR1ok1XdEkPgSA=1714222710; UFNzeJOLZfqEYYSgo-aYCYReZk8=GPwTdFDhafcP_N9s_j77I3VYMcA
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/471dc2adc340/main.js HTTP/1.1Host: emailactivation.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; fdLUwBQFXFKl3GT693-SqoGX1x8=6qvSXxbRb8EjyH18cJIK45pMK2s; C6QreykZJ2QreksuEu6WFq_CZ9U=1714136310; rqu3pOw_ZPXX1dR1ok1XdEkPgSA=1714222710; UFNzeJOLZfqEYYSgo-aYCYReZk8=GPwTdFDhafcP_N9s_j77I3VYMcA
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/jsd/r/87a6be920d5c0291 HTTP/1.1Host: emailactivation.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; fdLUwBQFXFKl3GT693-SqoGX1x8=6qvSXxbRb8EjyH18cJIK45pMK2s; C6QreykZJ2QreksuEu6WFq_CZ9U=1714136310; rqu3pOw_ZPXX1dR1ok1XdEkPgSA=1714222710; UFNzeJOLZfqEYYSgo-aYCYReZk8=GPwTdFDhafcP_N9s_j77I3VYMcA; cf_clearance=Tc5RfabE1ciRaLHcXwCvY2IbvFtmd0DldZc2fceJv7w-1714136312-1.0.1.1-SVPSC7ju.rqf8dbfDqdtOoz1yvngzgjEQsvlQLElZ447Q99jzNtHrhqAYUJbwz6KqmQD89hRQNlgke6qe2yMUw

Source: global traffic	DNS traffic detected: DNS query: indiadomainstore.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: emailactivation.ru
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: verify2factor.com
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Host: emailactivation.ruConnection: keep-aliveContent-Length: 22sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Requested-TimeStamp-Expire: sec-ch-ua-mobile: ?0X-Requested-TimeStamp-Combination: X-Requested-Type-Combination: GETContent-type: application/x-www-form-urlencodedX-Requested-Type: GETUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-with: XMLHttpRequestX-Requested-TimeStamp: yiu5FwMiHTZLGa0p4rHEWrqf7Wo: 45282449sec-ch-ua-platform: "Windows"Accept: */*Origin: https://emailactivation.ruSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://emailactivation.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; fdLUwBQFXFKl3GT693-SqoGX1x8=6qvSXxbRb8EjyH18cJIK45pMK2s

Source: global traffic

HTTP traffic detected: HTTP/1.1 503 Service UnavailableDate: Fri, 26 Apr 2024 12:58:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Content-Type-Options: nosniffX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-XSS-Protection: 1; mode=blockSet-Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; path=/; expires=Sat, 27-Apr-24 12:58:16 GMT; Max-Age=86400;Set-Cookie: 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; path=/; expires=Sat, 27-Apr-24 12:58:16 GMT; Max-Age=86400;Set-Cookie: fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; path=/; expires=Sat, 27-Apr-24 12:58:16 GMT; Max-Age=86400;Set-Cookie: 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; path=/; expires=Sat, 27-Apr-24 12:58:16 GMT; Max-Age=86400;X-Frame-Options: SAMEORIGINCache-Control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheExpires: 0CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6lYAs6hSmZYEERdTrnFCQAb5z9GmlYAt0KVZNVAxL50X%2Btl4IiBs7Bg9kdK2hbKfZ4DSBaz1Wa%2B7pFZLl1mrTpGZYmFV%2FpgUq7SnsUTbUobmSNobQJ1tv9U2HywlQzWRPYzZnH8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 87a6be920d5c0291-MIAalt-svc: h3=":443"; ma=86400

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.5:49720 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@21/8@27/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=1948,i,2694083351701983556,4194912050434543017,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://indiadomainstore.com/mt/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=1948,i,2694083351701983556,4194912050434543017,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://indiadomainstore.com/mt/	0%	Avira URL Cloud	safe
https://indiadomainstore.com/mt/	4%	Virustotal		Browse

Source	Detection	Scanner	Label
https://emailactivation.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/471dc2adc340/main.js	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
https://emailactivation.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js	0%	Avira URL Cloud	safe
https://emailactivation.ru/cdn-cgi/challenge-platform/h/b/jsd/r/87a6be920d5c0291	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
google.com	142.250.217.238	true	false	high
emailactivation.ru	104.21.39.79	true	false	unknown
indiadomainstore.com	172.67.198.238	true	false	unknown
www.google.com	142.250.189.132	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
verify2factor.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://emailactivation.ru/cdn-cgi/challenge-platform/h/b/jsd/r/87a6be920d5c0291	false	Avira URL Cloud: safe	unknown
https://emailactivation.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/471dc2adc340/main.js	false	Avira URL Cloud: safe	unknown
https://emailactivation.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=g09FHivCyclPho%2Fn%2Fd8tly4sulR9VpI6V8uLw4OSCd%2FiJdmNEs3Q2gAKBYaezc%2BLU5FszRx3QzkXOimFbesrlbKJxYiCEoLTJcdcafubU6bdqSEfG0VKkkAzVD5y%2FKll9rfzW7Q%3D	false		high
https://indiadomainstore.com/mt/	false		unknown
about:blank	false	Avira URL Cloud: safe	low
https://emailactivation.ru/	false		unknown
https://a.nel.cloudflare.com/report/v4?s=6lYAs6hSmZYEERdTrnFCQAb5z9GmlYAt0KVZNVAxL50X%2Btl4IiBs7Bg9kdK2hbKfZ4DSBaz1Wa%2B7pFZLl1mrTpGZYmFV%2FpgUq7SnsUTbUobmSNobQJ1tv9U2HywlQzWRPYzZnH8%3D	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.198.238	indiadomainstore.com	United States	13335	CLOUDFLARENETUS	false
142.250.189.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.67.143.202	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.39.79	emailactivation.ru	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432128
Start date and time:	2024-04-26 14:57:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://indiadomainstore.com/mt/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@21/8@27/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.178.50.35, 142.251.107.84, 142.250.217.206, 34.104.35.123, 199.232.214.172, 20.114.59.183, 192.229.211.108, 199.232.210.172, 13.85.23.206, 13.95.31.18, 172.217.165.195
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:58:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.970923009084321
Encrypted:	false
SSDEEP:	48:8xdQWTwy3p6HWidAKZdA19ehwiZUklqehKlxy+3:88WcWpDrxy
MD5:	2EB4419845F3F6CBF7CE1B2EE7EC3DEB
SHA1:	6167E51CCAEBEECDA2B7F7EEAE0B0797BA862A2A
SHA-256:	6B5BCAD4C59AF78D0A1D4A5EE7089A8C5AF227A2B53E927D66F1697CD1E48602
SHA-512:	92167A01D24A4FD0405A4C742178FA82EF74B69E837D3608BF83C1675106174A4614488859BEA580873F41B6AAEFDDBA16ADAA2B815247775DED5A419D3F30F7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......i...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XEg....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XEg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XEg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XEg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XJg...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#.z_.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:58:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.98848676875617
Encrypted:	false
SSDEEP:	48:8rdQWTwy3p6HWidAKZdA1weh/iZUkAQkqehZlxy+2:86WcWpx9Q4xy
MD5:	94A0E16DE09AB9C54DACF38F79652A58
SHA1:	305A6FE0C17F2672A2CFDD7E43EB52105ACE5FFA
SHA-256:	AC3ACB80F1F1E66BA18E19604A861448BDE77AB7CF518076CCD8932C5B029708
SHA-512:	B44220CA0D5ABA4E42302DAFAEBCE0C42DC1024913003007E4E7D9972EFE28ABFD2A3C4FC3275948662A226C55E26F752238A1AFB7EFE66B4C80153F3521AA1A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....P.i...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XEg....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XEg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XEg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XEg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XJg...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#.z_.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.000808915484557
Encrypted:	false
SSDEEP:	48:8xCdQWTwy3psHWidAKZdA14tseh7sFiZUkmgqeh7sPlxy+BX:8xVWcWpHnfxy
MD5:	C5C5C24B1CD5554F976ADF8AB2331BE9
SHA1:	789A769D1DB5D6E639C9B5F5155C2E73632E5217
SHA-256:	B2025555625180143F32436108CF8B44EA5DED6F46C8FE3A616BA8077F9BA6C5
SHA-512:	BFD8287B847BB24C56D578464C5968907BFE4CF4835C91D05EE43BD587D8A9398843FA47EA7AECBB909792FBCDE895D8D8F6382A4961AE42967930BC211039E4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XEg....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XEg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XEg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XEg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#.z_.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:58:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9875549699302386
Encrypted:	false
SSDEEP:	48:8GdQWTwy3p6HWidAKZdA1vehDiZUkwqehNlxy+R:8hWcWpyVxy
MD5:	B9A0B1A109F82D8471EF8F2A3A271A76
SHA1:	8D863955C44179BDB4192868C751FEE62813DEFD
SHA-256:	D61FFFDDB0536A017618176DE80F3A35A393E98D21061D7D86CF511B08CD37A0
SHA-512:	4491F77BB5E59D20A9F684335C7841BD3890D8B1DEC92B990C2C9C784A3AA9845DB3B7901D2F21874F7A3B68ED28A3FCEF079FB86AD491F8B8C3FB3505F60FD8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....(?~i...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XEg....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XEg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XEg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XEg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XJg...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#.z_.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:58:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9755972989846815
Encrypted:	false
SSDEEP:	48:8xdQWTwy3p6HWidAKZdA1hehBiZUk1W1qehblxy+C:88WcWpC9hxy
MD5:	C939BB87FD94C199FFDF2E5F468C4A83
SHA1:	2F922557584C7D616690B4E462BC01B24502E0D8
SHA-256:	1E4AD30F2D7AE0D29E5ECC3A89BF15025C80AD45D5FE2D4AD60B7BE349DC5BB5
SHA-512:	72843A1070C22AE22CDC94BB080D13D07950B41B666A9B1040F9463E6EC628C449ECFB99C434A9F00BF4D9C0005284F98F7A3CAF67FF3C73599CDC4F51BB9224
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....l.i...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XEg....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XEg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XEg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XEg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XJg...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#.z_.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:58:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.986110755803059
Encrypted:	false
SSDEEP:	48:89dQWTwy3p6HWidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbFlxy+yT+:8AWcWp8T/TbxWOvTbfxy7T
MD5:	378343B5F43D81B242D3194FAD6735A6
SHA1:	7054CCB61D24CC26CA7764D496AB8B409191C8D2
SHA-256:	64F9AB6E13083A90999A9D53FEC4ABA44244566A2C977F4EBA47DAAD45BCCA32
SHA-512:	E649A3B7F817B59A60FE07C17D949DD1B4811E0A91071967253A95D68A45500279BA4EC06ACBA3EED2933CEAD3E5E38287EC5696AE088BFDC2456960680C2206
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......ki...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XEg....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XEg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XEg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XEg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XJg...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#.z_.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7891), with no line terminators
Category:	downloaded
Size (bytes):	7891
Entropy (8bit):	5.774223978995124
Encrypted:	false
SSDEEP:	96:hgS/0AGqZl+Rh5QD7X9ZkydK98dhMGtxMHftUqd1cIATa5XUTE5kKULFqc3:y+0AGqPghyD7Xzky08dhHM17JFUTM2
MD5:	9CE2734EF825D04A38D167403F44F658
SHA1:	EF900806745227100A5FE6464E93DC429AE57DA6
SHA-256:	0127F5A5AC70C2F9528C06768E7E5FB1E4F492AA21454586E04D69D4D2EEB5C1
SHA-512:	DD43273ACE6C900D0BC707C01668307C4828B1D3682C0D156D71590C936014FE2A8C091C86B97F81506DEAF9A2B3AEDE4E9816BBDC3982270E57FE16C8940072
Malicious:	false
Reputation:	low
URL:	https://emailactivation.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/471dc2adc340/main.js
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(V,g,h,i,j,k,o,s){V=b,function(c,e,U,f,C){for(U=b,f=c();!![];)try{if(C=-parseInt(U(391))/1(-parseInt(U(334))/2)+parseInt(U(380))/3+parseInt(U(314))/4(parseInt(U(331))/5)+-parseInt(U(353))/6+-parseInt(U(325))/7(-parseInt(U(300))/8)+parseInt(U(373))/9(parseInt(U(335))/10)+-parseInt(U(294))/11*(parseInt(U(366))/12),C===e)break;else f.push(f.shift())}catch(D){f.push(f.shift())}}(a,494884),g=this\|\|self,h=g[V(384)],i=function(W,e,f,C){return W=V,e=String[W(295)],f={'h':function(D){return null==D?'':f.g(D,6,function(E,X){return X=b,X(364)[X(304)](E)})},'g':function(D,E,F,Y,G,H,I,J,K,L,M,N,O,P,Q,R,S,T){if(Y=W,null==D)return'';for(H={},I={},J='',K=2,L=3,M=2,N=[],O=0,P=0,Q=0;Q<D[Y(341)];Q+=1)if(R=D[Y(304)](Q),Object[Y(312)][Y(330)][Y(367)](H,R)\|\|(H[R]=L++,I[R]=!0),S=J+R,Object[Y(312)][Y(330)][Y(367)](H,S))J=S;else{if(Object[Y(312)][Y(330)][Y(367)](I,J)){if(256>J[Y(311)](0)){for(G=0;G<M;O<<=1,P==E-1?(P=0,N[Y(346)](F(O)),O=0):P++,G++);for(T=J[Y(311)](0),

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 14:58:07.612692118 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:07.612694025 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:07.706440926 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:17.244899988 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:17.262912035 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:17.386106968 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:18.792675972 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:18.792789936 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:20.117458105 CEST	49710	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.117525101 CEST	443	49710	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.117602110 CEST	49710	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.117866039 CEST	49710	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.117898941 CEST	443	49710	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.118398905 CEST	49711	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.118465900 CEST	443	49711	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.118535995 CEST	49711	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.118931055 CEST	49711	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.118967056 CEST	443	49711	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.383080006 CEST	443	49711	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.386250019 CEST	443	49710	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.409336090 CEST	49710	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.409374952 CEST	443	49710	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.409626007 CEST	49711	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.409663916 CEST	443	49711	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.410769939 CEST	443	49711	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.410868883 CEST	49711	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.411091089 CEST	443	49710	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.411180019 CEST	49710	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.422110081 CEST	49711	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.422219992 CEST	443	49711	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.422765017 CEST	49710	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.422889948 CEST	443	49710	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.422943115 CEST	49711	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.422961950 CEST	443	49711	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.508958101 CEST	49711	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:20.628134966 CEST	443	49710	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:20.628253937 CEST	49710	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:21.333859921 CEST	49713	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:58:21.333929062 CEST	443	49713	142.250.189.132	192.168.2.5
Apr 26, 2024 14:58:21.334013939 CEST	49713	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:58:21.334264040 CEST	49713	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:58:21.334299088 CEST	443	49713	142.250.189.132	192.168.2.5
Apr 26, 2024 14:58:21.667697906 CEST	443	49713	142.250.189.132	192.168.2.5
Apr 26, 2024 14:58:21.667978048 CEST	49713	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:58:21.668019056 CEST	443	49713	142.250.189.132	192.168.2.5
Apr 26, 2024 14:58:21.669449091 CEST	443	49713	142.250.189.132	192.168.2.5
Apr 26, 2024 14:58:21.669516087 CEST	49713	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:58:21.804362059 CEST	49713	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:58:21.804527044 CEST	443	49713	142.250.189.132	192.168.2.5
Apr 26, 2024 14:58:21.952685118 CEST	49713	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:58:21.952702045 CEST	443	49713	142.250.189.132	192.168.2.5
Apr 26, 2024 14:58:22.138786077 CEST	49713	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:58:23.165523052 CEST	443	49711	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:23.165635109 CEST	443	49711	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:23.165687084 CEST	49711	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:26.317223072 CEST	49711	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:26.317248106 CEST	443	49711	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:27.006393909 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.006464958 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.006535053 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.006818056 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.006834984 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.240165949 CEST	49715	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:27.240197897 CEST	443	49715	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:27.240272999 CEST	49715	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:27.242225885 CEST	49715	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:27.242244005 CEST	443	49715	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:27.271414995 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.271728039 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.271747112 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.273241997 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.273305893 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.465158939 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.465384007 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.468142986 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.468184948 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.521753073 CEST	443	49715	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:27.521823883 CEST	49715	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:27.529370070 CEST	49715	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:27.529386997 CEST	443	49715	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:27.529911995 CEST	443	49715	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:27.676131010 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.676666975 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.697375059 CEST	49715	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:27.840564013 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.840651989 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.840698004 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.840699911 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.840725899 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.840776920 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.840784073 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.840828896 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.840922117 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.840929985 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.840935946 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.840975046 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.840985060 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.841089010 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.841137886 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.872992992 CEST	49715	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:27.901112080 CEST	49714	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:27.901130915 CEST	443	49714	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:27.920116901 CEST	443	49715	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:28.005842924 CEST	443	49715	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:28.005991936 CEST	443	49715	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:28.006074905 CEST	49715	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:28.043049097 CEST	49716	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:28.043068886 CEST	443	49716	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:28.043451071 CEST	49716	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:28.043840885 CEST	49716	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:28.043853045 CEST	443	49716	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:28.045247078 CEST	49717	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:28.045253038 CEST	443	49717	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:28.045599937 CEST	49717	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:28.045872927 CEST	49717	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:28.045885086 CEST	443	49717	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:28.048707008 CEST	49718	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:28.048732042 CEST	443	49718	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:28.048880100 CEST	49718	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:28.049052000 CEST	49718	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:28.049071074 CEST	443	49718	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:28.064313889 CEST	49715	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:28.064321041 CEST	443	49715	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:28.353502989 CEST	443	49717	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:28.372612953 CEST	443	49716	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:28.411384106 CEST	49717	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:28.539381981 CEST	49716	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:29.081388950 CEST	443	49718	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:29.240401030 CEST	49718	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.142951965 CEST	49718	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.143004894 CEST	443	49718	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.144553900 CEST	443	49718	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.152420998 CEST	49716	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:30.152453899 CEST	443	49716	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:30.154159069 CEST	443	49716	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:30.154191971 CEST	443	49716	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:30.154232025 CEST	49716	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:30.163189888 CEST	49717	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.163202047 CEST	443	49717	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.163774014 CEST	443	49717	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.164078951 CEST	49716	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:30.164175034 CEST	443	49716	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:30.164695978 CEST	49718	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.164911985 CEST	443	49718	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.165438890 CEST	49717	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.165522099 CEST	443	49717	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.166342974 CEST	49716	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:30.166349888 CEST	443	49716	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:30.166510105 CEST	49718	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.166735888 CEST	49717	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.208123922 CEST	443	49718	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.208163023 CEST	443	49717	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.298857927 CEST	443	49717	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.299032927 CEST	443	49717	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.299118042 CEST	49717	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.341367960 CEST	49716	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:30.341388941 CEST	443	49716	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:30.341505051 CEST	443	49716	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:30.341548920 CEST	49716	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:30.346530914 CEST	49716	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:30.346543074 CEST	443	49716	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:30.349318027 CEST	49719	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:30.349397898 CEST	443	49719	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:30.349473000 CEST	49717	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.349478960 CEST	443	49717	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.349493980 CEST	49719	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:30.349935055 CEST	49719	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:30.349973917 CEST	443	49719	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:30.359328985 CEST	49720	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:30.359401941 CEST	443	49720	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:30.359473944 CEST	49720	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:30.360167980 CEST	49720	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:30.360184908 CEST	443	49720	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:30.620839119 CEST	443	49720	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:30.620935917 CEST	49720	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:30.623315096 CEST	49720	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:30.623327971 CEST	443	49720	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:30.624428034 CEST	443	49720	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:30.625771999 CEST	49720	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:30.656318903 CEST	443	49718	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.656392097 CEST	443	49718	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.656451941 CEST	49718	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.657516003 CEST	49718	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.657542944 CEST	443	49718	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.668131113 CEST	443	49720	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:30.802303076 CEST	49722	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.802347898 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.802433968 CEST	49722	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.803123951 CEST	49723	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.803169012 CEST	443	49723	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.803297043 CEST	49723	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.803369045 CEST	49722	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.803385019 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.803677082 CEST	49723	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:30.803689003 CEST	443	49723	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:30.868200064 CEST	443	49720	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:30.868309975 CEST	443	49720	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:30.868390083 CEST	49720	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:30.877312899 CEST	49720	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:30.877335072 CEST	443	49720	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:30.877348900 CEST	49720	443	192.168.2.5	23.193.120.112
Apr 26, 2024 14:58:30.877356052 CEST	443	49720	23.193.120.112	192.168.2.5
Apr 26, 2024 14:58:31.063760042 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.064815998 CEST	443	49723	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.067357063 CEST	49722	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.067379951 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.067655087 CEST	49723	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.067665100 CEST	443	49723	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.068053007 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.068073034 CEST	443	49723	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.069103003 CEST	49723	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.069166899 CEST	443	49723	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.069617987 CEST	49722	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.069747925 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.070082903 CEST	49723	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.070199013 CEST	49722	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.112159967 CEST	443	49723	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.116143942 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.364223003 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.364320993 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.364368916 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.364377975 CEST	49722	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.364399910 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.364470005 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.364504099 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.364510059 CEST	49722	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.364517927 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.364542007 CEST	49722	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.365016937 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.365087032 CEST	49722	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.380784988 CEST	49722	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.380857944 CEST	443	49722	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.548130035 CEST	49726	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.548201084 CEST	443	49726	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.548291922 CEST	49726	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.549041986 CEST	49726	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.549058914 CEST	443	49726	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.676295996 CEST	443	49713	142.250.189.132	192.168.2.5
Apr 26, 2024 14:58:31.676356077 CEST	443	49713	142.250.189.132	192.168.2.5
Apr 26, 2024 14:58:31.676479101 CEST	49713	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:58:31.691304922 CEST	443	49719	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:31.693006992 CEST	49719	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:31.693033934 CEST	443	49719	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:31.693411112 CEST	443	49719	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:31.694969893 CEST	49719	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:31.695046902 CEST	443	49719	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:31.695214987 CEST	49719	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:31.740128994 CEST	443	49719	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:31.795919895 CEST	49713	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:58:31.795945883 CEST	443	49713	142.250.189.132	192.168.2.5
Apr 26, 2024 14:58:31.811780930 CEST	443	49726	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.812040091 CEST	49726	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.812069893 CEST	443	49726	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.813251019 CEST	443	49726	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.813607931 CEST	49726	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.813755035 CEST	49726	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.813760996 CEST	443	49726	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.813781023 CEST	443	49726	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:31.813852072 CEST	49726	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.813864946 CEST	49726	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:31.813884020 CEST	443	49726	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:32.027946949 CEST	443	49719	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:32.028057098 CEST	443	49719	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:32.028302908 CEST	49719	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:32.029934883 CEST	49719	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:58:32.029951096 CEST	443	49719	35.190.80.1	192.168.2.5
Apr 26, 2024 14:58:32.098108053 CEST	443	49726	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:32.098293066 CEST	443	49726	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:32.098364115 CEST	49726	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:32.099138021 CEST	49726	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:32.099165916 CEST	443	49726	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:32.099180937 CEST	49726	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:32.099244118 CEST	49726	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:32.207427979 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:32.207544088 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:32.208389044 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:32.208416939 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:32.208494902 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:32.211797953 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:32.211812973 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:32.413109064 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:32.413125992 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:32.589503050 CEST	49733	443	192.168.2.5	172.67.143.202
Apr 26, 2024 14:58:32.589520931 CEST	443	49733	172.67.143.202	192.168.2.5
Apr 26, 2024 14:58:32.589737892 CEST	49733	443	192.168.2.5	172.67.143.202
Apr 26, 2024 14:58:32.590156078 CEST	49733	443	192.168.2.5	172.67.143.202
Apr 26, 2024 14:58:32.590169907 CEST	443	49733	172.67.143.202	192.168.2.5
Apr 26, 2024 14:58:32.678122997 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:32.678200006 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:32.696722031 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:32.696733952 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:32.697468996 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:32.697524071 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:32.698049068 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:32.698113918 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:32.698184967 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:32.698193073 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:32.848608971 CEST	443	49733	172.67.143.202	192.168.2.5
Apr 26, 2024 14:58:32.848871946 CEST	49733	443	192.168.2.5	172.67.143.202
Apr 26, 2024 14:58:32.848881006 CEST	443	49733	172.67.143.202	192.168.2.5
Apr 26, 2024 14:58:32.849742889 CEST	443	49733	172.67.143.202	192.168.2.5
Apr 26, 2024 14:58:32.849806070 CEST	49733	443	192.168.2.5	172.67.143.202
Apr 26, 2024 14:58:32.850145102 CEST	49733	443	192.168.2.5	172.67.143.202
Apr 26, 2024 14:58:32.850193977 CEST	443	49733	172.67.143.202	192.168.2.5
Apr 26, 2024 14:58:32.850306034 CEST	49733	443	192.168.2.5	172.67.143.202
Apr 26, 2024 14:58:32.850312948 CEST	443	49733	172.67.143.202	192.168.2.5
Apr 26, 2024 14:58:32.950524092 CEST	49733	443	192.168.2.5	172.67.143.202
Apr 26, 2024 14:58:32.964997053 CEST	443	49723	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:32.965071917 CEST	443	49723	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:32.965174913 CEST	49723	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:32.967972040 CEST	49723	443	192.168.2.5	104.21.39.79
Apr 26, 2024 14:58:32.967988014 CEST	443	49723	104.21.39.79	192.168.2.5
Apr 26, 2024 14:58:33.146297932 CEST	443	49733	172.67.143.202	192.168.2.5
Apr 26, 2024 14:58:33.146353960 CEST	443	49733	172.67.143.202	192.168.2.5
Apr 26, 2024 14:58:33.146665096 CEST	49733	443	192.168.2.5	172.67.143.202
Apr 26, 2024 14:58:33.147053957 CEST	49733	443	192.168.2.5	172.67.143.202
Apr 26, 2024 14:58:33.147085905 CEST	443	49733	172.67.143.202	192.168.2.5
Apr 26, 2024 14:58:33.210900068 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:33.210963964 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:33.211510897 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:33.211559057 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:33.211574078 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 26, 2024 14:58:33.211620092 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 26, 2024 14:58:35.369972944 CEST	443	49710	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:35.370060921 CEST	443	49710	172.67.198.238	192.168.2.5
Apr 26, 2024 14:58:35.370208979 CEST	49710	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:35.576767921 CEST	49710	443	192.168.2.5	172.67.198.238
Apr 26, 2024 14:58:35.576787949 CEST	443	49710	172.67.198.238	192.168.2.5
Apr 26, 2024 14:59:21.470463991 CEST	49738	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:59:21.470523119 CEST	443	49738	142.250.189.132	192.168.2.5
Apr 26, 2024 14:59:21.470649004 CEST	49738	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:59:21.470988035 CEST	49738	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:59:21.471004009 CEST	443	49738	142.250.189.132	192.168.2.5
Apr 26, 2024 14:59:21.862704992 CEST	443	49738	142.250.189.132	192.168.2.5
Apr 26, 2024 14:59:21.863148928 CEST	49738	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:59:21.863209009 CEST	443	49738	142.250.189.132	192.168.2.5
Apr 26, 2024 14:59:21.864320993 CEST	443	49738	142.250.189.132	192.168.2.5
Apr 26, 2024 14:59:21.865339041 CEST	49738	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:59:21.865518093 CEST	443	49738	142.250.189.132	192.168.2.5
Apr 26, 2024 14:59:21.916117907 CEST	49738	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:59:28.375693083 CEST	49739	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:28.375763893 CEST	443	49739	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:28.376018047 CEST	49739	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:28.376365900 CEST	49739	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:28.376400948 CEST	443	49739	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:28.697441101 CEST	443	49739	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:28.732248068 CEST	49739	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:28.732316971 CEST	443	49739	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:28.733843088 CEST	443	49739	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:28.733932018 CEST	49739	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:28.735411882 CEST	49739	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:28.735512972 CEST	443	49739	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:28.735815048 CEST	49739	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:28.735832930 CEST	443	49739	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:28.791421890 CEST	49739	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:29.034017086 CEST	443	49739	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.034113884 CEST	443	49739	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.034197092 CEST	49739	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:29.049837112 CEST	49739	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:29.049874067 CEST	443	49739	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.051290035 CEST	49740	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:29.051342010 CEST	443	49740	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.051476002 CEST	49740	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:29.051796913 CEST	49740	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:29.051810980 CEST	443	49740	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.373523951 CEST	443	49740	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.374001026 CEST	49740	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:29.374012947 CEST	443	49740	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.374492884 CEST	443	49740	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.374999046 CEST	49740	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:29.375085115 CEST	443	49740	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.375341892 CEST	49740	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:29.416126013 CEST	443	49740	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.709894896 CEST	443	49740	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.709983110 CEST	443	49740	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.710174084 CEST	49740	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:29.710366011 CEST	49740	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:29.710382938 CEST	443	49740	35.190.80.1	192.168.2.5
Apr 26, 2024 14:59:29.710414886 CEST	49740	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:29.710423946 CEST	49740	443	192.168.2.5	35.190.80.1
Apr 26, 2024 14:59:31.848495007 CEST	443	49738	142.250.189.132	192.168.2.5
Apr 26, 2024 14:59:31.848660946 CEST	443	49738	142.250.189.132	192.168.2.5
Apr 26, 2024 14:59:31.848721981 CEST	49738	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:59:33.527559996 CEST	49738	443	192.168.2.5	142.250.189.132
Apr 26, 2024 14:59:33.527590036 CEST	443	49738	142.250.189.132	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 14:58:17.261852026 CEST	53	60361	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:17.393070936 CEST	53	59024	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:19.869772911 CEST	52919	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:19.869925022 CEST	56577	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:19.960473061 CEST	53	60283	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:19.997545004 CEST	53	52919	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:19.998644114 CEST	53	56577	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:21.201037884 CEST	58198	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:21.201492071 CEST	49814	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:21.327265024 CEST	53	49814	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:21.327313900 CEST	53	58198	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:26.533616066 CEST	63528	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:26.535361052 CEST	51412	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:26.925578117 CEST	53	51412	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:27.003043890 CEST	53	63528	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:27.883502960 CEST	51513	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:27.884320974 CEST	55706	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:28.009004116 CEST	53	51513	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:28.009212971 CEST	53	55706	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:32.104999065 CEST	57310	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:32.105242014 CEST	57503	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:32.489453077 CEST	53	57503	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:32.588074923 CEST	53	57310	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:32.969913006 CEST	56692	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:32.970158100 CEST	60135	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:33.097906113 CEST	53	56692	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:33.098928928 CEST	53	60135	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:33.099581957 CEST	64242	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:33.259778976 CEST	53	64242	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:33.378710985 CEST	62920	53	192.168.2.5	8.8.8.8
Apr 26, 2024 14:58:33.379277945 CEST	50564	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:33.505110025 CEST	53	50564	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:33.535635948 CEST	53	62920	8.8.8.8	192.168.2.5
Apr 26, 2024 14:58:35.508577108 CEST	49897	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:35.508812904 CEST	54116	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:35.636570930 CEST	53	49897	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:35.666790009 CEST	53	54116	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:40.785068035 CEST	60999	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:40.785494089 CEST	60084	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:40.943486929 CEST	53	60999	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:40.945461035 CEST	53	60084	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:40.972181082 CEST	51702	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:41.097335100 CEST	53	51702	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:42.496970892 CEST	53	62744	1.1.1.1	192.168.2.5
Apr 26, 2024 14:58:57.479166031 CEST	64391	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:58:57.608434916 CEST	53	64391	1.1.1.1	192.168.2.5
Apr 26, 2024 14:59:01.839483976 CEST	53	59522	1.1.1.1	192.168.2.5
Apr 26, 2024 14:59:11.198740959 CEST	62073	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:59:11.199192047 CEST	65272	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:59:11.327832937 CEST	53	62073	1.1.1.1	192.168.2.5
Apr 26, 2024 14:59:11.328094959 CEST	53	65272	1.1.1.1	192.168.2.5
Apr 26, 2024 14:59:11.329967976 CEST	57208	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:59:11.483951092 CEST	53	57208	1.1.1.1	192.168.2.5
Apr 26, 2024 14:59:16.952331066 CEST	53	59200	1.1.1.1	192.168.2.5
Apr 26, 2024 14:59:24.544184923 CEST	53	49592	1.1.1.1	192.168.2.5
Apr 26, 2024 14:59:28.220160007 CEST	56575	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:59:28.220508099 CEST	62773	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:59:28.345840931 CEST	53	56575	1.1.1.1	192.168.2.5
Apr 26, 2024 14:59:28.346193075 CEST	53	62773	1.1.1.1	192.168.2.5
Apr 26, 2024 14:59:29.667632103 CEST	51261	53	192.168.2.5	1.1.1.1
Apr 26, 2024 14:59:29.792934895 CEST	53	51261	1.1.1.1	192.168.2.5
Apr 26, 2024 14:59:44.433923006 CEST	53	61584	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 14:58:19.869772911 CEST	192.168.2.5	1.1.1.1	0x3c7a	Standard query (0)	indiadomainstore.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:19.869925022 CEST	192.168.2.5	1.1.1.1	0xaada	Standard query (0)	indiadomainstore.com	65	IN (0x0001)	false
Apr 26, 2024 14:58:21.201037884 CEST	192.168.2.5	1.1.1.1	0xc590	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:21.201492071 CEST	192.168.2.5	1.1.1.1	0x3631	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 14:58:26.533616066 CEST	192.168.2.5	1.1.1.1	0x333d	Standard query (0)	emailactivation.ru	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:26.535361052 CEST	192.168.2.5	1.1.1.1	0x620f	Standard query (0)	emailactivation.ru	65	IN (0x0001)	false
Apr 26, 2024 14:58:27.883502960 CEST	192.168.2.5	1.1.1.1	0xe21e	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:27.884320974 CEST	192.168.2.5	1.1.1.1	0x8da5	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Apr 26, 2024 14:58:32.104999065 CEST	192.168.2.5	1.1.1.1	0x1afd	Standard query (0)	emailactivation.ru	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:32.105242014 CEST	192.168.2.5	1.1.1.1	0xeb2	Standard query (0)	emailactivation.ru	65	IN (0x0001)	false
Apr 26, 2024 14:58:32.969913006 CEST	192.168.2.5	1.1.1.1	0xe71b	Standard query (0)	verify2factor.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:32.970158100 CEST	192.168.2.5	1.1.1.1	0x93a3	Standard query (0)	verify2factor.com	65	IN (0x0001)	false
Apr 26, 2024 14:58:33.099581957 CEST	192.168.2.5	1.1.1.1	0x8619	Standard query (0)	verify2factor.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:33.378710985 CEST	192.168.2.5	8.8.8.8	0x718b	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:33.379277945 CEST	192.168.2.5	1.1.1.1	0xd7d5	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:35.508577108 CEST	192.168.2.5	1.1.1.1	0xf0b7	Standard query (0)	verify2factor.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:35.508812904 CEST	192.168.2.5	1.1.1.1	0x9c54	Standard query (0)	verify2factor.com	65	IN (0x0001)	false
Apr 26, 2024 14:58:40.785068035 CEST	192.168.2.5	1.1.1.1	0xbeb	Standard query (0)	verify2factor.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:40.785494089 CEST	192.168.2.5	1.1.1.1	0x634f	Standard query (0)	verify2factor.com	65	IN (0x0001)	false
Apr 26, 2024 14:58:40.972181082 CEST	192.168.2.5	1.1.1.1	0x343	Standard query (0)	verify2factor.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:57.479166031 CEST	192.168.2.5	1.1.1.1	0x1f0c	Standard query (0)	verify2factor.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:59:11.198740959 CEST	192.168.2.5	1.1.1.1	0x23cc	Standard query (0)	verify2factor.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:59:11.199192047 CEST	192.168.2.5	1.1.1.1	0x8611	Standard query (0)	verify2factor.com	65	IN (0x0001)	false
Apr 26, 2024 14:59:11.329967976 CEST	192.168.2.5	1.1.1.1	0x1012	Standard query (0)	verify2factor.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:59:28.220160007 CEST	192.168.2.5	1.1.1.1	0x592	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:59:28.220508099 CEST	192.168.2.5	1.1.1.1	0x63b	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Apr 26, 2024 14:59:29.667632103 CEST	192.168.2.5	1.1.1.1	0x533a	Standard query (0)	verify2factor.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 14:58:19.997545004 CEST	1.1.1.1	192.168.2.5	0x3c7a	No error (0)	indiadomainstore.com		172.67.198.238	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:19.997545004 CEST	1.1.1.1	192.168.2.5	0x3c7a	No error (0)	indiadomainstore.com		104.21.60.176	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:19.998644114 CEST	1.1.1.1	192.168.2.5	0xaada	No error (0)	indiadomainstore.com			65	IN (0x0001)	false
Apr 26, 2024 14:58:21.327265024 CEST	1.1.1.1	192.168.2.5	0x3631	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 14:58:21.327313900 CEST	1.1.1.1	192.168.2.5	0xc590	No error (0)	www.google.com		142.250.189.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:26.925578117 CEST	1.1.1.1	192.168.2.5	0x620f	No error (0)	emailactivation.ru			65	IN (0x0001)	false
Apr 26, 2024 14:58:27.003043890 CEST	1.1.1.1	192.168.2.5	0x333d	No error (0)	emailactivation.ru		104.21.39.79	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:27.003043890 CEST	1.1.1.1	192.168.2.5	0x333d	No error (0)	emailactivation.ru		172.67.143.202	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:28.009004116 CEST	1.1.1.1	192.168.2.5	0xe21e	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:31.936636925 CEST	1.1.1.1	192.168.2.5	0x282d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:31.936636925 CEST	1.1.1.1	192.168.2.5	0x282d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:31.945580959 CEST	1.1.1.1	192.168.2.5	0x1762	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 14:58:31.945580959 CEST	1.1.1.1	192.168.2.5	0x1762	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:32.489453077 CEST	1.1.1.1	192.168.2.5	0xeb2	No error (0)	emailactivation.ru			65	IN (0x0001)	false
Apr 26, 2024 14:58:32.588074923 CEST	1.1.1.1	192.168.2.5	0x1afd	No error (0)	emailactivation.ru		172.67.143.202	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:32.588074923 CEST	1.1.1.1	192.168.2.5	0x1afd	No error (0)	emailactivation.ru		104.21.39.79	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:33.097906113 CEST	1.1.1.1	192.168.2.5	0xe71b	Name error (3)	verify2factor.com	none	none	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:33.098928928 CEST	1.1.1.1	192.168.2.5	0x93a3	Name error (3)	verify2factor.com	none	none	65	IN (0x0001)	false
Apr 26, 2024 14:58:33.259778976 CEST	1.1.1.1	192.168.2.5	0x8619	Name error (3)	verify2factor.com	none	none	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:33.505110025 CEST	1.1.1.1	192.168.2.5	0xd7d5	No error (0)	google.com		142.250.217.238	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:33.535635948 CEST	8.8.8.8	192.168.2.5	0x718b	No error (0)	google.com		142.250.113.139	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:33.535635948 CEST	8.8.8.8	192.168.2.5	0x718b	No error (0)	google.com		142.250.113.113	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:33.535635948 CEST	8.8.8.8	192.168.2.5	0x718b	No error (0)	google.com		142.250.113.138	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:33.535635948 CEST	8.8.8.8	192.168.2.5	0x718b	No error (0)	google.com		142.250.113.102	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:33.535635948 CEST	8.8.8.8	192.168.2.5	0x718b	No error (0)	google.com		142.250.113.101	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:33.535635948 CEST	8.8.8.8	192.168.2.5	0x718b	No error (0)	google.com		142.250.113.100	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:35.636570930 CEST	1.1.1.1	192.168.2.5	0xf0b7	Name error (3)	verify2factor.com	none	none	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:35.666790009 CEST	1.1.1.1	192.168.2.5	0x9c54	Name error (3)	verify2factor.com	none	none	65	IN (0x0001)	false
Apr 26, 2024 14:58:40.943486929 CEST	1.1.1.1	192.168.2.5	0xbeb	Name error (3)	verify2factor.com	none	none	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:40.945461035 CEST	1.1.1.1	192.168.2.5	0x634f	Name error (3)	verify2factor.com	none	none	65	IN (0x0001)	false
Apr 26, 2024 14:58:41.097335100 CEST	1.1.1.1	192.168.2.5	0x343	Name error (3)	verify2factor.com	none	none	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:58:57.608434916 CEST	1.1.1.1	192.168.2.5	0x1f0c	Name error (3)	verify2factor.com	none	none	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:59:11.327832937 CEST	1.1.1.1	192.168.2.5	0x23cc	Name error (3)	verify2factor.com	none	none	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:59:11.328094959 CEST	1.1.1.1	192.168.2.5	0x8611	Name error (3)	verify2factor.com	none	none	65	IN (0x0001)	false
Apr 26, 2024 14:59:11.483951092 CEST	1.1.1.1	192.168.2.5	0x1012	Name error (3)	verify2factor.com	none	none	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:59:28.345840931 CEST	1.1.1.1	192.168.2.5	0x592	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:59:29.792934895 CEST	1.1.1.1	192.168.2.5	0x533a	Name error (3)	verify2factor.com	none	none	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:59:32.880709887 CEST	1.1.1.1	192.168.2.5	0x206	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 26, 2024 14:59:32.880709887 CEST	1.1.1.1	192.168.2.5	0x206	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

indiadomainstore.com

emailactivation.ru

https:

www.bing.com

fs.microsoft.com

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	172.67.198.238	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:20 UTC	666	OUT	GET /mt/ HTTP/1.1 Host: indiadomainstore.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:58:23 UTC	929	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 12:58:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=18a7ceb0e0d3636d1e354cc8641725cd; path=/ location: https://emailactivation.ru/ Vary: User-Agent CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fgc1WvY%2FJ%2B5fKnm2WfYnomiiHBSISmhKn6soEAl9xbgbuJnOI963CKRsWYpUnNaKEyvjMnXRAG7K3LZvUgjgezdwtO%2F%2BvP40O%2B%2Bk82mw0bxHICCP2VBJ3jB0%2B0O%2Fy8Ml6oVKYhfcMQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 87a6be66c9cd5c6c-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 12:58:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	104.21.39.79	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:27 UTC	661	OUT	GET / HTTP/1.1 Host: emailactivation.ru Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:58:27 UTC	1369	IN	HTTP/1.1 503 Service Unavailable Date: Fri, 26 Apr 2024 12:58:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-XSS-Protection: 1; mode=block Set-Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; path=/; expires=Sat, 27-Apr-24 12:58:16 GMT; Max-Age=86400; Set-Cookie: 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; path=/; expires=Sat, 27-Apr-24 12:58:16 GMT; Max-Age=86400; Set-Cookie: fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; path=/; expires=Sat, 27-Apr-24 12:58:16 GMT; Max-Age=86400; Set-Cookie: 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; path=/; expires=Sat, 27-Apr-24 12:58:16 GMT; Max-Age=86400; X-Frame-Options: SAMEORIGIN Cache-Control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: 0 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6lYAs6hSmZYEERdTrnFCQAb5z9GmlYAt0KVZNVAxL50X%2Btl4IiBs7Bg9kdK2hbKfZ4DSBaz1Wa%2B7pFZLl1mrTpGZYmFV%2FpgUq7SnsUTbUobmSNobQJ1tv9U2HywlQzWRPYzZnH8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a6be920d5c0291-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 12:58:27 UTC	1369	IN	Data Raw: 31 64 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d Data Ascii: 1d91<!DOCTYPE html><html><head><meta charset="utf-8" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" /><meta name="viewport" content="width=device-width, initial-
2024-04-26 12:58:27 UTC	1369	IN	Data Raw: 4b 48 64 6f 49 43 55 67 4d 54 41 77 4b 53 6b 67 65 77 6f 67 49 43 41 67 49 43 41 67 49 48 59 67 50 53 42 30 63 6e 56 6c 4f 77 6f 67 49 43 41 67 66 51 70 39 43 69 38 76 64 69 41 39 49 48 52 79 64 57 55 37 49 43 38 76 64 47 56 7a 64 43 42 32 59 58 49 67 62 6e 56 73 62 47 56 6b 49 47 39 31 64 43 42 31 63 32 56 6b 49 47 5a 76 63 69 42 6b 5a 57 4a 31 5a 32 64 70 62 6d 63 67 63 48 56 79 63 47 39 7a 5a 51 70 70 5a 69 41 6f 64 69 41 39 50 53 42 30 63 6e 56 6c 4b 53 42 37 43 69 41 67 49 43 41 67 49 43 41 67 65 47 68 30 64 48 41 75 63 32 56 30 55 6d 56 78 64 57 56 7a 64 45 68 6c 59 57 52 6c 63 69 67 6e 4e 6e 6b 74 56 45 56 6d 64 33 68 76 61 7a 56 51 4e 30 4a 6b 52 31 55 74 4e 57 56 32 4f 58 42 34 4d 47 31 6a 4a 79 77 67 4a 32 74 34 4d 6d 45 74 57 44 6c 6a 56 57 59 Data Ascii: KHdoICUgMTAwKSkgewogICAgICAgIHYgPSB0cnVlOwogICAgfQp9Ci8vdiA9IHRydWU7IC8vdGVzdCB2YXIgbnVsbGVkIG91dCB1c2VkIGZvciBkZWJ1Z2dpbmcgcHVycG9zZQppZiAodiA9PSB0cnVlKSB7CiAgICAgICAgeGh0dHAuc2V0UmVxdWVzdEhlYWRlcignNnktVEVmd3hvazVQN0JkR1UtNWV2OXB4MG1jJywgJ2t4MmEtWDljVWY
2024-04-26 12:58:27 UTC	1369	IN	Data Raw: 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 76 4c 32 70 68 64 6d 46 7a 59 33 4a 70 63 48 51 67 63 48 56 36 65 6d 78 6c 49 47 5a 76 63 69 42 69 63 6d 39 33 63 32 56 79 49 48 52 76 49 47 5a 70 5a 33 56 79 5a 53 42 76 64 58 51 67 64 47 38 67 5a 32 56 30 49 47 46 75 63 33 64 6c 63 67 6f 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 42 70 5a 69 67 68 64 32 6c 75 5a 47 39 33 4c 6c 39 77 61 47 46 75 64 47 39 74 49 48 78 38 49 43 46 33 61 57 35 6b 62 33 63 75 59 32 46 73 62 46 42 6f 59 57 35 30 62 32 30 70 65 79 38 71 63 47 68 68 62 6e 52 76 62 57 70 7a 4b 69 38 4b 61 57 59 6f 49 58 64 70 62 6d 52 76 64 79 35 66 58 33 42 6f 59 57 35 30 62 32 31 68 63 79 6c 37 4c 79 70 77 61 47 46 75 64 47 39 74 59 58 4d 67 55 47 Data Ascii: gICAgICAgICAgICAvL2phdmFzY3JpcHQgcHV6emxlIGZvciBicm93c2VyIHRvIGZpZ3VyZSBvdXQgdG8gZ2V0IGFuc3dlcgogICAgICAgICAgICAgICAgICAgICAgICBpZighd2luZG93Ll9waGFudG9tIHx8ICF3aW5kb3cuY2FsbFBoYW50b20pey8qcGhhbnRvbWpzKi8KaWYoIXdpbmRvdy5fX3BoYW50b21hcyl7LypwaGFudG9tYXMgUG
2024-04-26 12:58:27 UTC	1369	IN	Data Raw: 63 32 4e 79 61 58 42 30 49 48 42 31 65 6e 70 73 5a 51 6f 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 42 32 59 58 49 67 65 47 68 30 64 48 41 67 50 53 42 75 5a 58 63 67 57 45 31 4d 53 48 52 30 63 46 4a 6c 63 58 56 6c 63 33 51 6f 4b 54 73 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 65 47 68 30 64 48 41 75 62 32 35 79 5a 57 46 6b 65 58 4e 30 59 58 52 6c 59 32 68 68 62 6d 64 6c 49 44 30 67 5a 6e 56 75 59 33 52 70 62 32 34 6f 4b 53 42 37 43 69 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 61 57 59 67 4b 48 68 6f 64 48 52 77 4c 6e 4a 6c 59 57 52 35 55 33 52 68 64 47 55 67 50 54 30 Data Ascii: c2NyaXB0IHB1enpsZQogICAgICAgICAgICAgICAgICAgICAgICB2YXIgeGh0dHAgPSBuZXcgWE1MSHR0cFJlcXVlc3QoKTsKICAgICAgICAgICAgICAgICAgICAgICAgeGh0dHAub25yZWFkeXN0YXRlY2hhbmdlID0gZnVuY3Rpb24oKSB7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaWYgKHhodHRwLnJlYWR5U3RhdGUgPT0
2024-04-26 12:58:27 UTC	1369	IN	Data Raw: 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 42 33 61 57 35 6b 62 33 63 75 62 47 39 6a 59 58 52 70 62 32 34 75 63 6d 56 73 62 32 46 6b 4b 43 6b 37 43 69 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 42 39 43 6e 30 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 42 39 43 69 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 48 30 37 43 69 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 48 68 6f Data Ascii: CAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3aW5kb3cubG9jYXRpb24ucmVsb2FkKCk7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB9Cn0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgICAgICAgICAgICAgIH07CiAgICAgICAgICAgICAgICAgICAgICAgIHho
2024-04-26 12:58:27 UTC	732	IN	Data Raw: 62 73 6f 6c 75 74 65 27 3b 5f 30 78 68 2e 73 74 79 6c 65 2e 74 6f 70 20 3d 20 30 3b 5f 30 78 68 2e 73 74 79 6c 65 2e 6c 65 66 74 20 3d 20 30 3b 5f 30 78 68 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 20 3d 20 27 6e 6f 6e 65 27 3b 5f 30 78 68 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 20 3d 20 27 68 69 64 64 65 6e 27 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 5f 30 78 68 29 3b 66 75 6e 63 74 69 6f 6e 20 68 61 6e 64 6c 65 72 28 29 20 7b 76 61 72 20 5f 30 78 69 20 3d 20 5f 30 78 68 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 20 7c 7c 20 5f 30 78 68 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 3b 69 66 20 28 5f 30 78 69 29 20 7b 76 61 72 20 5f 30 78 6a 20 3d 20 5f 30 78 69 2e 63 72 65 61 74 Data Ascii: bsolute';_0xh.style.top = 0;_0xh.style.left = 0;_0xh.style.border = 'none';_0xh.style.visibility = 'hidden';document.body.appendChild(_0xh);function handler() {var _0xi = _0xh.contentDocument \|\| _0xh.contentWindow.document;if (_0xi) {var _0xj = _0xi.creat
2024-04-26 12:58:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	23.193.120.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:27 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 12:58:28 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0712) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=65165 Date: Fri, 26 Apr 2024 12:58:27 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49716	35.190.80.1	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:30 UTC	543	OUT	OPTIONS /report/v4?s=6lYAs6hSmZYEERdTrnFCQAb5z9GmlYAt0KVZNVAxL50X%2Btl4IiBs7Bg9kdK2hbKfZ4DSBaz1Wa%2B7pFZLl1mrTpGZYmFV%2FpgUq7SnsUTbUobmSNobQJ1tv9U2HywlQzWRPYzZnH8%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://emailactivation.ru Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:58:30 UTC	336	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Fri, 26 Apr 2024 12:58:30 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	104.21.39.79	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:30 UTC	1107	OUT	POST / HTTP/1.1 Host: emailactivation.ru Connection: keep-alive Content-Length: 22 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Requested-TimeStamp-Expire: sec-ch-ua-mobile: ?0 X-Requested-TimeStamp-Combination: X-Requested-Type-Combination: GET Content-type: application/x-www-form-urlencoded X-Requested-Type: GET User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Requested-with: XMLHttpRequest X-Requested-TimeStamp: yiu5FwMiHTZLGa0p4rHEWrqf7Wo: 45282449 sec-ch-ua-platform: "Windows" Accept: / Origin: https://emailactivation.ru Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://emailactivation.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; fdLUwBQFXFKl3GT693-SqoGX1x8=6qvSXxbRb8EjyH18cJIK45pMK2s
2024-04-26 12:58:30 UTC	22	OUT	Data Raw: 6e 61 6d 65 31 3d 48 65 6e 72 79 26 6e 61 6d 65 32 3d 46 6f 72 64 Data Ascii: name1=Henry&name2=Ford
2024-04-26 12:58:30 UTC	1292	IN	HTTP/1.1 204 No Content Date: Fri, 26 Apr 2024 12:58:30 GMT Connection: close X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-XSS-Protection: 1; mode=block Set-Cookie: fdLUwBQFXFKl3GT693-SqoGX1x8=6qvSXxbRb8EjyH18cJIK45pMK2s; path=/; expires=Sat, 27-Apr-24 12:58:30 GMT; Max-Age=86400; Set-Cookie: C6QreykZJ2QreksuEu6WFq_CZ9U=1714136310; path=/; expires=Sat, 27-Apr-24 12:58:30 GMT; Max-Age=86400; Set-Cookie: rqu3pOw_ZPXX1dR1ok1XdEkPgSA=1714222710; path=/; expires=Sat, 27-Apr-24 12:58:30 GMT; Max-Age=86400; Set-Cookie: UFNzeJOLZfqEYYSgo-aYCYReZk8=GPwTdFDhafcP_N9s_j77I3VYMcA; path=/; expires=Sat, 27-Apr-24 12:58:30 GMT; Max-Age=86400; X-Frame-Options: SAMEORIGIN Cache-Control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: 0 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2e4zpsUPbG4%2BYF0PFcYodLfKZAskwydou9vTUToBpOFlDWe%2FaJbNdfGr65IbDjVOeNLJYvVmFJYeAYfhWnQromka4%2FFiOQFvZFBBFFYT2VALRqNn1RFpgpzeDXip7k7Pr7aTBxI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a6bea2eceb25b5-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49717	104.21.39.79	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:30 UTC	788	OUT	GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1 Host: emailactivation.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; fdLUwBQFXFKl3GT693-SqoGX1x8=6qvSXxbRb8EjyH18cJIK45pMK2s
2024-04-26 12:58:30 UTC	652	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 12:58:30 GMT Content-Length: 0 Connection: close access-control-allow-origin: * location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/471dc2adc340/main.js cache-control: max-age=300, public Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BkljuFKg94laJnxhVhmTAzzwz1Hj0XrCzIqDP0TzOFd9kzkiLf%2BErSIHX4BPFQZQrX0ipFJiNKjgBSamws5fjp4lvEF%2BWvO28Yccyyx0Buvmq8jDm0KaoIMj007%2FSSK0cbPfMgo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a6bea2e836da6f-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49720	23.193.120.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:30 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 12:58:30 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=65175 Date: Fri, 26 Apr 2024 12:58:30 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 12:58:30 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49723	104.21.39.79	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:31 UTC	1082	OUT	GET / HTTP/1.1 Host: emailactivation.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://emailactivation.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; fdLUwBQFXFKl3GT693-SqoGX1x8=6qvSXxbRb8EjyH18cJIK45pMK2s; C6QreykZJ2QreksuEu6WFq_CZ9U=1714136310; rqu3pOw_ZPXX1dR1ok1XdEkPgSA=1714222710; UFNzeJOLZfqEYYSgo-aYCYReZk8=GPwTdFDhafcP_N9s_j77I3VYMcA
2024-04-26 12:58:32 UTC	932	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 12:58:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-XSS-Protection: 1; mode=block Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=d89637a851356d65502081a67fef55fc; path=/ location: https://verify2factor.com CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tjmxowlqk1xLfcc0K1gyVB0rdWTxs3Zv%2BGBZ%2B15Y9U6j0H11LCGi%2FGg3nuq7oOe%2B562ADinZmS6Kw0DujEL1Co2%2Fr3K2cr0QT41FRW8XRlIkrtqqSm%2F1t%2F9ojNZoEUd5sU9eTHw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a6bea98c74a687-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 12:58:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49722	104.21.39.79	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:31 UTC	942	OUT	GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/471dc2adc340/main.js HTTP/1.1 Host: emailactivation.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; fdLUwBQFXFKl3GT693-SqoGX1x8=6qvSXxbRb8EjyH18cJIK45pMK2s; C6QreykZJ2QreksuEu6WFq_CZ9U=1714136310; rqu3pOw_ZPXX1dR1ok1XdEkPgSA=1714222710; UFNzeJOLZfqEYYSgo-aYCYReZk8=GPwTdFDhafcP_N9s_j77I3VYMcA
2024-04-26 12:58:31 UTC	653	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:58:31 GMT Content-Type: application/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-content-type-options: nosniff cache-control: max-age=14400, public vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fm8tRH21aXWkuA9ttuTESkHdhD18sQs53EegKybifYP1wJi8SYaWObk96fa4W4clIgrWD82fN01YSWdJJ8eZocVexOQy0wQyRyWUJShcX8vD9fPkWnngq2z7X3VC9oSyPTOO5y4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a6bea98d0a25be-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 12:58:31 UTC	716	IN	Data Raw: 31 65 64 33 0d 0a 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 3d 7b 63 46 50 57 76 3a 27 62 27 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 56 2c 67 2c 68 2c 69 2c 6a 2c 6b 2c 6f 2c 73 29 7b 56 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 65 2c 55 2c 66 2c 43 29 7b 66 6f 72 28 55 3d 62 2c 66 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 43 3d 2d 70 61 72 73 65 49 6e 74 28 55 28 33 39 31 29 29 2f 31 2a 28 2d 70 61 72 73 65 49 6e 74 28 55 28 33 33 34 29 29 2f 32 29 2b 70 61 72 73 65 49 6e 74 28 55 28 33 38 30 29 29 2f 33 2b 70 61 72 73 65 49 6e 74 28 55 28 33 31 34 29 29 2f 34 2a 28 70 61 72 73 65 49 6e 74 28 55 28 33 33 31 29 29 2f 35 29 2b 2d 70 61 72 73 65 49 6e 74 28 55 28 33 35 33 29 29 2f 36 2b 2d 70 61 72 73 65 49 6e 74 28 55 28 33 32 35 29 29 Data Ascii: 1ed3window._cf_chl_opt={cFPWv:'b'};~function(V,g,h,i,j,k,o,s){V=b,function(c,e,U,f,C){for(U=b,f=c();!![];)try{if(C=-parseInt(U(391))/1(-parseInt(U(334))/2)+parseInt(U(380))/3+parseInt(U(314))/4(parseInt(U(331))/5)+-parseInt(U(353))/6+-parseInt(U(325))
2024-04-26 12:58:31 UTC	1369	IN	Data Raw: 50 3d 30 2c 51 3d 30 3b 51 3c 44 5b 59 28 33 34 31 29 5d 3b 51 2b 3d 31 29 69 66 28 52 3d 44 5b 59 28 33 30 34 29 5d 28 51 29 2c 4f 62 6a 65 63 74 5b 59 28 33 31 32 29 5d 5b 59 28 33 33 30 29 5d 5b 59 28 33 36 37 29 5d 28 48 2c 52 29 7c 7c 28 48 5b 52 5d 3d 4c 2b 2b 2c 49 5b 52 5d 3d 21 30 29 2c 53 3d 4a 2b 52 2c 4f 62 6a 65 63 74 5b 59 28 33 31 32 29 5d 5b 59 28 33 33 30 29 5d 5b 59 28 33 36 37 29 5d 28 48 2c 53 29 29 4a 3d 53 3b 65 6c 73 65 7b 69 66 28 4f 62 6a 65 63 74 5b 59 28 33 31 32 29 5d 5b 59 28 33 33 30 29 5d 5b 59 28 33 36 37 29 5d 28 49 2c 4a 29 29 7b 69 66 28 32 35 36 3e 4a 5b 59 28 33 31 31 29 5d 28 30 29 29 7b 66 6f 72 28 47 3d 30 3b 47 3c 4d 3b 4f 3c 3c 3d 31 2c 50 3d 3d 45 2d 31 3f 28 50 3d 30 2c 4e 5b 59 28 33 34 36 29 5d 28 46 28 4f 29 Data Ascii: P=0,Q=0;Q<D[Y(341)];Q+=1)if(R=D[Y(304)](Q),Object[Y(312)][Y(330)][Y(367)](H,R)\|\|(H[R]=L++,I[R]=!0),S=J+R,Object[Y(312)][Y(330)][Y(367)](H,S))J=S;else{if(Object[Y(312)][Y(330)][Y(367)](I,J)){if(256>J[Y(311)](0)){for(G=0;G<M;O<<=1,P==E-1?(P=0,N[Y(346)](F(O)
2024-04-26 12:58:31 UTC	1369	IN	Data Raw: 46 28 4f 29 29 3b 62 72 65 61 6b 7d 65 6c 73 65 20 50 2b 2b 3b 72 65 74 75 72 6e 20 4e 5b 59 28 33 35 39 29 5d 28 27 27 29 7d 2c 27 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 44 2c 5a 29 7b 72 65 74 75 72 6e 20 5a 3d 57 2c 44 3d 3d 6e 75 6c 6c 3f 27 27 3a 44 3d 3d 27 27 3f 6e 75 6c 6c 3a 66 2e 69 28 44 5b 5a 28 33 34 31 29 5d 2c 33 32 37 36 38 2c 66 75 6e 63 74 69 6f 6e 28 45 2c 61 30 29 7b 72 65 74 75 72 6e 20 61 30 3d 5a 2c 44 5b 61 30 28 33 31 31 29 5d 28 45 29 7d 29 7d 2c 27 69 27 3a 66 75 6e 63 74 69 6f 6e 28 44 2c 45 2c 46 2c 61 31 2c 47 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4e 2c 4f 2c 50 2c 51 2c 52 2c 54 2c 53 29 7b 66 6f 72 28 61 31 3d 57 2c 47 3d 5b 5d 2c 48 3d 34 2c 49 3d 34 2c 4a 3d 33 2c 4b 3d 5b 5d 2c 4e 3d 46 28 30 29 2c 4f 3d 45 2c 50 3d 31 2c Data Ascii: F(O));break}else P++;return N[Y(359)]('')},'j':function(D,Z){return Z=W,D==null?'':D==''?null:f.i(D[Z(341)],32768,function(E,a0){return a0=Z,D[a0(311)](E)})},'i':function(D,E,F,a1,G,H,I,J,K,L,M,N,O,P,Q,R,T,S){for(a1=W,G=[],H=4,I=4,J=3,K=[],N=F(0),O=E,P=1,
2024-04-26 12:58:31 UTC	1369	IN	Data Raw: 69 6f 6e 28 43 2c 44 2c 45 2c 46 2c 61 36 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 29 7b 69 66 28 61 36 3d 56 2c 6e 75 6c 6c 3d 3d 3d 44 7c 7c 76 6f 69 64 20 30 3d 3d 3d 44 29 72 65 74 75 72 6e 20 46 3b 66 6f 72 28 48 3d 6e 28 44 29 2c 43 5b 61 36 28 33 37 35 29 5d 5b 61 36 28 33 36 35 29 5d 26 26 28 48 3d 48 5b 61 36 28 33 36 32 29 5d 28 43 5b 61 36 28 33 37 35 29 5d 5b 61 36 28 33 36 35 29 5d 28 44 29 29 29 2c 48 3d 43 5b 61 36 28 33 30 36 29 5d 5b 61 36 28 33 35 36 29 5d 26 26 43 5b 61 36 28 33 38 37 29 5d 3f 43 5b 61 36 28 33 30 36 29 5d 5b 61 36 28 33 35 36 29 5d 28 6e 65 77 20 43 5b 28 61 36 28 33 38 37 29 29 5d 28 48 29 29 3a 66 75 6e 63 74 69 6f 6e 28 4e 2c 61 37 2c 4f 29 7b 66 6f 72 28 61 37 3d 61 36 2c 4e 5b 61 37 28 33 31 36 29 5d 28 29 2c 4f 3d 30 Data Ascii: ion(C,D,E,F,a6,H,I,J,K,L,M){if(a6=V,null===D\|\|void 0===D)return F;for(H=n(D),C[a6(375)][a6(365)]&&(H=H[a6(362)](C[a6(375)][a6(365)](D))),H=C[a6(306)][a6(356)]&&C[a6(387)]?C[a6(306)][a6(356)](new C[(a6(387))](H)):function(N,a7,O){for(a7=a6,N[a7(316)](),O=0
2024-04-26 12:58:31 UTC	1369	IN	Data Raw: 34 32 34 35 32 52 4f 75 4a 53 78 2c 6a 73 64 2c 73 6f 72 74 2c 6f 62 6a 65 63 74 2c 76 46 64 72 73 66 4b 2c 74 69 6d 65 6f 75 74 2c 43 6f 6e 74 65 6e 74 2d 74 79 70 65 2c 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2c 6c 6f 61 64 69 6e 67 2c 4d 65 73 73 61 67 65 3a 20 2c 66 75 6e 63 74 69 6f 6e 2c 33 35 4c 57 4d 6a 64 63 2c 69 73 41 72 72 61 79 2c 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 68 2f 2c 73 79 6d 62 6f 6c 2c 5f 5f 43 46 24 63 76 24 70 61 72 61 6d 73 2c 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 35 67 42 59 46 66 75 2c 64 2e 63 6f 6f 6b 69 65 2c 61 70 70 65 6e 64 43 68 69 6c 64 2c 32 4d 6b 4c 7a 6e 73 2c 36 30 74 5a 55 45 4c 7a 2c 46 75 6e 63 74 69 6f 6e 2c 72 65 61 64 79 53 74 61 74 65 2c 61 70 70 6c 69 63 Data Ascii: 42452ROuJSx,jsd,sort,object,vFdrsfK,timeout,Content-type,contentWindow,loading,Message: ,function,35LWMjdc,isArray,/cdn-cgi/challenge-platform/h/,symbol,__CF$cv$params,hasOwnProperty,5gBYFfu,d.cookie,appendChild,2MkLzns,60tZUELz,Function,readyState,applic
2024-04-26 12:58:31 UTC	1369	IN	Data Raw: 74 68 5b 61 61 28 33 37 30 29 5d 28 29 3c 63 7d 66 75 6e 63 74 69 6f 6e 20 76 28 61 39 2c 43 2c 44 2c 45 2c 46 2c 47 29 7b 61 39 3d 56 3b 74 72 79 7b 72 65 74 75 72 6e 20 43 3d 68 5b 61 39 28 33 39 37 29 5d 28 61 39 28 33 39 33 29 29 2c 43 5b 61 39 28 33 30 31 29 5d 3d 61 39 28 33 35 38 29 2c 43 5b 61 39 28 33 30 33 29 5d 3d 27 2d 31 27 2c 68 5b 61 39 28 33 35 34 29 5d 5b 61 39 28 33 33 33 29 5d 28 43 29 2c 44 3d 43 5b 61 39 28 33 32 31 29 5d 2c 45 3d 7b 7d 2c 45 3d 48 6d 46 6d 45 71 31 28 44 2c 44 2c 27 27 2c 45 29 2c 45 3d 48 6d 46 6d 45 71 31 28 44 2c 44 5b 61 39 28 32 39 36 29 5d 7c 7c 44 5b 61 39 28 33 30 35 29 5d 2c 27 6e 2e 27 2c 45 29 2c 45 3d 48 6d 46 6d 45 71 31 28 44 2c 43 5b 61 39 28 33 35 35 29 5d 2c 27 64 2e 27 2c 45 29 2c 68 5b 61 39 28 33 Data Ascii: th[aa(370)]()<c}function v(a9,C,D,E,F,G){a9=V;try{return C=h[a9(397)](a9(393)),C[a9(301)]=a9(358),C[a9(303)]='-1',h[a9(354)][a9(333)](C),D=C[a9(321)],E={},E=HmFmEq1(D,D,'',E),E=HmFmEq1(D,D[a9(296)]\|\|D[a9(305)],'n.',E),E=HmFmEq1(D,C[a9(355)],'d.',E),h[a9(3
2024-04-26 12:58:31 UTC	338	IN	Data Raw: 39 35 29 5d 28 66 29 29 7d 66 75 6e 63 74 69 6f 6e 20 42 28 61 65 2c 63 2c 65 2c 66 2c 43 29 7b 69 66 28 61 65 3d 56 2c 63 3d 67 5b 61 65 28 33 32 39 29 5d 2c 21 63 29 72 65 74 75 72 6e 3b 69 66 28 21 79 28 29 29 72 65 74 75 72 6e 3b 28 65 3d 21 5b 5d 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 61 66 2c 44 29 7b 28 61 66 3d 61 65 2c 21 65 29 26 26 28 65 3d 21 21 5b 5d 2c 44 3d 76 28 29 2c 7a 28 63 2e 72 2c 44 2e 72 29 2c 44 2e 65 26 26 41 28 61 66 28 33 38 33 29 2c 44 2e 65 2c 61 66 28 33 31 35 29 29 29 7d 2c 68 5b 61 65 28 33 33 37 29 5d 21 3d 3d 61 65 28 33 32 32 29 29 3f 66 28 29 3a 67 5b 61 65 28 33 34 39 29 5d 3f 68 5b 61 65 28 33 34 39 29 5d 28 61 65 28 33 30 39 29 2c 66 29 3a 28 43 3d 68 5b 61 65 28 33 34 30 29 5d 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d Data Ascii: 95)](f))}function B(ae,c,e,f,C){if(ae=V,c=g[ae(329)],!c)return;if(!y())return;(e=![],f=function(af,D){(af=ae,!e)&&(e=!![],D=v(),z(c.r,D.r),D.e&&A(af(383),D.e,af(315)))},h[ae(337)]!==ae(322))?f():g[ae(349)]?h[ae(349)](ae(309),f):(C=h[ae(340)]\|\|function(){}
2024-04-26 12:58:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49719	35.190.80.1	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:31 UTC	482	OUT	POST /report/v4?s=6lYAs6hSmZYEERdTrnFCQAb5z9GmlYAt0KVZNVAxL50X%2Btl4IiBs7Bg9kdK2hbKfZ4DSBaz1Wa%2B7pFZLl1mrTpGZYmFV%2FpgUq7SnsUTbUobmSNobQJ1tv9U2HywlQzWRPYzZnH8%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 388 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:58:31 UTC	388	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 33 35 30 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 33 39 2e 37 39 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 35 30 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 65 6d 61 69 6c 61 63 74 69 76 61 74 69 6f 6e 2e Data Ascii: [{"age":0,"body":{"elapsed_time":1350,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.39.79","status_code":503,"type":"http.error"},"type":"network-error","url":"https://emailactivation.
2024-04-26 12:58:32 UTC	168	IN	HTTP/1.1 200 OK content-length: 0 date: Fri, 26 Apr 2024 12:58:31 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49726	104.21.39.79	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:31 UTC	1020	OUT	POST /cdn-cgi/challenge-platform/h/b/jsd/r/87a6be920d5c0291 HTTP/1.1 Host: emailactivation.ru Connection: keep-alive Content-Length: 15779 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: / Origin: https://emailactivation.ru Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; fdLUwBQFXFKl3GT693-SqoGX1x8=6qvSXxbRb8EjyH18cJIK45pMK2s; C6QreykZJ2QreksuEu6WFq_CZ9U=1714136310; rqu3pOw_ZPXX1dR1ok1XdEkPgSA=1714222710; UFNzeJOLZfqEYYSgo-aYCYReZk8=GPwTdFDhafcP_N9s_j77I3VYMcA
2024-04-26 12:58:31 UTC	15779	OUT	Data Raw: 7b 22 77 70 22 3a 22 54 79 46 39 4f 57 71 65 4f 4b 46 4f 50 6b 75 71 6a 71 2b 72 5a 39 57 43 72 58 55 72 32 62 32 36 36 57 65 71 4d 38 72 52 34 43 31 34 76 46 72 61 52 47 4a 75 34 4b 71 7a 72 50 6a 46 4e 6e 79 79 72 58 35 36 72 53 72 36 43 36 46 71 72 70 36 71 59 75 73 39 35 4b 79 4c 69 68 39 52 34 42 79 55 58 2d 7a 2b 6b 4e 37 39 59 42 4f 64 55 78 71 2d 38 52 35 32 72 4f 46 46 30 32 61 57 4c 6e 72 6d 4e 6e 76 6c 4c 72 6c 39 6b 61 72 57 64 46 72 32 39 57 57 39 42 50 39 32 72 71 34 72 5a 4b 56 72 71 78 4c 72 74 44 65 58 4e 79 47 71 58 35 6e 46 72 57 44 4c 72 57 75 4a 5a 72 4a 57 72 71 4c 70 76 6f 46 68 7a 55 43 57 4e 57 71 6c 59 55 79 38 4f 42 41 63 6c 52 72 62 39 57 32 77 66 79 72 65 56 79 34 6b 76 52 45 70 4e 72 4a 63 6c 35 42 62 58 39 72 6f 35 62 76 32 Data Ascii: {"wp":"TyF9OWqeOKFOPkuqjq+rZ9WCrXUr2b266WeqM8rR4C14vFraRGJu4KqzrPjFNnyyrX56rSr6C6Fqrp6qYus95KyLih9R4ByUX-z+kN79YBOdUxq-8R52rOFF02aWLnrmNnvlLrl9karWdFr29WW9BP92rq4rZKVrqxLrtDeXNyGqX5nFrWDLrWuJZrJWrqLpvoFhzUCWNWqlYUy8OBAclRrb9W2wfyreVy4kvREpNrJcl5BbX9ro5bv2
2024-04-26 12:58:32 UTC	828	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 12:58:32 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: cf_clearance=Tc5RfabE1ciRaLHcXwCvY2IbvFtmd0DldZc2fceJv7w-1714136312-1.0.1.1-SVPSC7ju.rqf8dbfDqdtOoz1yvngzgjEQsvlQLElZ447Q99jzNtHrhqAYUJbwz6KqmQD89hRQNlgke6qe2yMUw; path=/; expires=Sat, 26-Apr-25 12:58:32 GMT; domain=.emailactivation.ru; HttpOnly; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=quw1ITUYlnmYhT9KFip3sLqELonKpnBPc9wn8XaWEfxQY4PaJCgK%2FNDUYV1J%2FVa44vELbnH1%2BxXm5sFp%2FeFRn7931DP8vNUuOd3ETUEJiCYsCZjyKFJ05rnalVrTuPaUHb1EGoI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a6bead3cff7445-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49731	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:32 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714136277783&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-26 12:58:32 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-26 12:58:32 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-26 12:58:33 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8560D06039BB441EB1B495F125652010 Ref B: LAX311000109005 Ref C: 2024-04-26T12:58:33Z Date: Fri, 26 Apr 2024 12:58:33 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1714136312.112381c2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49733	172.67.143.202	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:58:32 UTC	955	OUT	GET /cdn-cgi/challenge-platform/h/b/jsd/r/87a6be920d5c0291 HTTP/1.1 Host: emailactivation.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 2TugSkTEzn03W2GDlafkqctsv1A=RmGs84oQRZodwekiX2da7zJuBdA; 37_-yBQPCHVBTRLv5o0JKNkN5f0=1714136296; fIVCv9QA-HnfV8Q1ukzDnDWXNyo=1714222696; 5vWX_OqSoatqi0BkQcWsCe_74ug=p70BwFD0HjLe2Vs0x9pwKuDd79A; fdLUwBQFXFKl3GT693-SqoGX1x8=6qvSXxbRb8EjyH18cJIK45pMK2s; C6QreykZJ2QreksuEu6WFq_CZ9U=1714136310; rqu3pOw_ZPXX1dR1ok1XdEkPgSA=1714222710; UFNzeJOLZfqEYYSgo-aYCYReZk8=GPwTdFDhafcP_N9s_j77I3VYMcA; cf_clearance=Tc5RfabE1ciRaLHcXwCvY2IbvFtmd0DldZc2fceJv7w-1714136312-1.0.1.1-SVPSC7ju.rqf8dbfDqdtOoz1yvngzgjEQsvlQLElZ447Q99jzNtHrhqAYUJbwz6KqmQD89hRQNlgke6qe2yMUw
2024-04-26 12:58:33 UTC	710	IN	HTTP/1.1 400 Bad Request Date: Fri, 26 Apr 2024 12:58:33 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: ii0W/Wd0AA4Pwm50oZB9sA==$smkO17ifi0Ouf9Y6IVHWbA== Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g09FHivCyclPho%2Fn%2Fd8tly4sulR9VpI6V8uLw4OSCd%2FiJdmNEs3Q2gAKBYaezc%2BLU5FszRx3QzkXOimFbesrlbKJxYiCEoLTJcdcafubU6bdqSEfG0VKkkAzVD5y%2FKll9rfzW7Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a6beb4b9f309a2-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 12:58:33 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49739	35.190.80.1	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:59:28 UTC	547	OUT	OPTIONS /report/v4?s=g09FHivCyclPho%2Fn%2Fd8tly4sulR9VpI6V8uLw4OSCd%2FiJdmNEs3Q2gAKBYaezc%2BLU5FszRx3QzkXOimFbesrlbKJxYiCEoLTJcdcafubU6bdqSEfG0VKkkAzVD5y%2FKll9rfzW7Q%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://emailactivation.ru Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:59:29 UTC	336	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Fri, 26 Apr 2024 12:59:28 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49740	35.190.80.1	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 12:59:29 UTC	486	OUT	POST /report/v4?s=g09FHivCyclPho%2Fn%2Fd8tly4sulR9VpI6V8uLw4OSCd%2FiJdmNEs3Q2gAKBYaezc%2BLU5FszRx3QzkXOimFbesrlbKJxYiCEoLTJcdcafubU6bdqSEfG0VKkkAzVD5y%2FKll9rfzW7Q%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 447 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 12:59:29 UTC	447	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 35 30 37 32 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 30 34 32 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 31 34 33 2e 32 30 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 30 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 65 6d 61 69 6c 61 63 74 69 76 Data Ascii: [{"age":55072,"body":{"elapsed_time":1042,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"172.67.143.202","status_code":400,"type":"http.error"},"type":"network-error","url":"https://emailactiv
2024-04-26 12:59:29 UTC	168	IN	HTTP/1.1 200 OK content-length: 0 date: Fri, 26 Apr 2024 12:59:29 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	14:58:08
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:58:15
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=1948,i,2694083351701983556,4194912050434543017,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:58:18
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://indiadomainstore.com/mt/"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://indiadomainstore.com/mt/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 63

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5844, Parent PID: 6108

General

Chronological Activities

Analysis Process: chrome.exePID: 5144, Parent PID: 5844

General

Chronological Activities

Analysis Process: chrome.exePID: 3856, Parent PID: 6108

General

Windows Analysis Report
https://indiadomainstore.com/mt/