Edit tour

Windows Analysis Report
[Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm

Overview

General Information

Sample name:	[Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm
Analysis ID:	1665597
MD5:	16cde94f8e003392ff139f8b2afcd81b
SHA1:	e481d88d9d1fcd15b98c707096c41a3131ce67f0
SHA256:	e086e5815cdd21831d445881dd7459865bfa4386def0239731a16a56584dc3ed
Infos:

Detection

HTMLPhisher

Score:	84
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Yara detected HtmlPhish45

HTML IFrame injector detected

HTML Script injector detected

HTML document with suspicious name

HTML file submission containing password form

HTML page contains obfuscated javascript

Detected TCP or UDP traffic on non-standard ports

HTML body contains password input but no form action

HTML page contains hidden javascript code

IP address seen in connection with other malware

Invalid 'forgot password' link found

Invalid 'sign-in options' or 'sign-up' link found

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4132 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2220,i,12153333222681571098,509529815984060871,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2248 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6256 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\[Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.5.pages.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
0.4.pages.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
0.3.pages.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security

HTTP traffic detected: POST /app/godag.php HTTP/1.1Host: erfectries.jamesolflt.bondConnection: keep-aliveContent-Length: 56sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-www-form-urlencoded; charset=UTF-8sec-ch-ua-mobile: ?0Origin: https://0j3grwfigpnmnimq.mybeautycare.pk:8443Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://0j3grwfigpnmnimq.mybeautycare.pk:8443/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_84.3.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_78.3.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_84.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
Source: chromecache_84.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
Source: chromecache_84.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
Source: chromecache_84.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
Source: chromecache_84.3.dr	String found in binary or memory: https://bugs.jquery.com/ticket/12359
Source: chromecache_84.3.dr	String found in binary or memory: https://bugs.jquery.com/ticket/13378
Source: chromecache_84.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: chromecache_84.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
Source: chromecache_84.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_84.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: chromecache_84.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_84.3.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: chromecache_84.3.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
Source: chromecache_79.3.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_84.3.dr	String found in binary or memory: https://github.com/eslint/eslint/issues/3229
Source: chromecache_84.3.dr	String found in binary or memory: https://github.com/eslint/eslint/issues/6125
Source: chromecache_84.3.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: chromecache_84.3.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: chromecache_84.3.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: chromecache_79.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_79.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_84.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: chromecache_84.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#category-listed
Source: chromecache_84.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
Source: chromecache_84.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
Source: chromecache_84.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
Source: chromecache_84.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
Source: chromecache_84.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
Source: chromecache_84.3.dr	String found in binary or memory: https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
Source: chromecache_84.3.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_84.3.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_84.3.dr	String found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
Source: chromecache_84.3.dr	String found in binary or memory: https://jsperf.com/thor-indexof-vs-for/5
Source: chromecache_84.3.dr	String found in binary or memory: https://promisesaplus.com/#point-48
Source: chromecache_84.3.dr	String found in binary or memory: https://promisesaplus.com/#point-54
Source: chromecache_84.3.dr	String found in binary or memory: https://promisesaplus.com/#point-57
Source: chromecache_84.3.dr	String found in binary or memory: https://promisesaplus.com/#point-59
Source: chromecache_84.3.dr	String found in binary or memory: https://promisesaplus.com/#point-61
Source: chromecache_84.3.dr	String found in binary or memory: https://promisesaplus.com/#point-64
Source: chromecache_84.3.dr	String found in binary or memory: https://promisesaplus.com/#point-75
Source: chromecache_84.3.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_84.3.dr	String found in binary or memory: https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_84.3.dr	String found in binary or memory: https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 74.125.138.104:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.218.74:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.218.74:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.218.74:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.33.12:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.33.12:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.57.106:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.57.106:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.101.194:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.96.111.2:443 -> 192.168.2.4:49795 version: TLS 1.2

System Summary

HTML document with suspicious name

Source: Name includes: [Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm

Initial sample: detail

Source: classification engine

Classification label: mal84.phis.winHTM@24/30@26/14

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2220,i,12153333222681571098,509529815984060871,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2248 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\[Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2220,i,12153333222681571098,509529815984060871,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2248 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\[Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm

HTTP Parser: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	0%	Avira URL Cloud	safe
https://erfectries.jamesolflt.bond/app/godag.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ooc-g2.tm-4.office.com	52.96.111.2	true	false	high
e329293.dscd.akamaiedge.net	96.7.218.74	true	false	high
sdfsdfsdfsdfsdf.stamba.com	172.67.200.32	true	false	unknown
code.jquery.com	151.101.194.137	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
s-part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
www.google.com	74.125.138.104	true	false	high
0j3grwfigpnmnimq.mybeautycare.pk	104.21.112.1	true	false	unknown
erfectries.jamesolflt.bond	104.21.57.106	true	false	high
LYH-efz.ms-acdc.office.com	52.97.101.194	true	false	high
_2025._https.sdfsdfsdfsdfsdf.stamba.com	unknown	unknown	false	unknown
outlook.office.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
_8443._https.0j3grwfigpnmnimq.mybeautycare.pk	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://code.jquery.com/jquery-3.2.1.slim.min.js	false		high
https://erfectries.jamesolflt.bond/app/godag.php	false	Avira URL Cloud: malware	unknown
https://outlook.office.com/	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://code.jquery.com/jquery-3.1.1.min.js	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg	false		high
file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	true	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.3.1.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	false		high
https://outlook.office.com/mail/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://bugs.webkit.org/show_bug.cgi?id=136851	chromecache_84.3.dr	false	high
http://jquery.org/license	chromecache_84.3.dr	false	high
https://jsperf.com/thor-indexof-vs-for/5	chromecache_84.3.dr	false	high
https://bugs.jquery.com/ticket/12359	chromecache_84.3.dr	false	high
https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/	chromecache_84.3.dr	false	high
https://html.spec.whatwg.org/#strip-and-collapse-whitespace	chromecache_84.3.dr	false	high
https://promisesaplus.com/#point-75	chromecache_84.3.dr	false	high
https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a	chromecache_84.3.dr	false	high
https://drafts.csswg.org/cssom/#common-serializing-idioms	chromecache_84.3.dr	false	high
https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled	chromecache_84.3.dr	false	high
https://bugs.webkit.org/show_bug.cgi?id=29084	chromecache_84.3.dr	false	high
https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace	chromecache_84.3.dr	false	high
https://github.com/eslint/eslint/issues/6125	chromecache_84.3.dr	false	high
https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled	chromecache_84.3.dr	false	high
https://github.com/jquery/jquery/pull/557)	chromecache_84.3.dr	false	high
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_79.3.dr	false	high
https://bugs.chromium.org/p/chromium/issues/detail?id=378607	chromecache_84.3.dr	false	high
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	chromecache_84.3.dr	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	chromecache_84.3.dr	false	high
https://bugs.chromium.org/p/chromium/issues/detail?id=470258	chromecache_84.3.dr	false	high
http://opensource.org/licenses/MIT).	chromecache_78.3.dr	false	high
https://bugs.jquery.com/ticket/13378	chromecache_84.3.dr	false	high
https://promisesaplus.com/#point-64	chromecache_84.3.dr	false	high
https://promisesaplus.com/#point-61	chromecache_84.3.dr	false	high
https://drafts.csswg.org/cssom/#resolved-values	chromecache_84.3.dr	false	high
https://bugs.chromium.org/p/chromium/issues/detail?id=589347	chromecache_84.3.dr	false	high
https://html.spec.whatwg.org/multipage/syntax.html#attributes-2	chromecache_84.3.dr	false	high
https://promisesaplus.com/#point-59	chromecache_84.3.dr	false	high
https://jsperf.com/getall-vs-sizzle/2	chromecache_84.3.dr	false	high
https://promisesaplus.com/#point-57	chromecache_84.3.dr	false	high
https://github.com/eslint/eslint/issues/3229	chromecache_84.3.dr	false	high
https://promisesaplus.com/#point-54	chromecache_84.3.dr	false	high
https://html.spec.whatwg.org/multipage/forms.html#category-listed	chromecache_84.3.dr	false	high
https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled	chromecache_84.3.dr	false	high
https://developer.mozilla.org/en-US/docs/CSS/display	chromecache_84.3.dr	false	high
https://jquery.org/license	chromecache_84.3.dr	false	high
https://jquery.com/	chromecache_84.3.dr	false	high
https://getbootstrap.com)	chromecache_79.3.dr	false	high
https://bugs.webkit.org/show_bug.cgi?id=137337	chromecache_84.3.dr	false	high
https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled	chromecache_84.3.dr	false	high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_79.3.dr	false	high
https://promisesaplus.com/#point-48	chromecache_84.3.dr	false	high
https://github.com/jquery/sizzle/pull/225	chromecache_84.3.dr	false	high
https://sizzlejs.com/	chromecache_84.3.dr	false	high
https://bugs.chromium.org/p/chromium/issues/detail?id=449857	chromecache_84.3.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.97.101.194	LYH-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.1.33.12	unknown	United States	20940	AKAMAI-ASN1EU	false
74.125.138.104	www.google.com	United States	15169	GOOGLEUS	false
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
96.7.218.74	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
104.21.57.106	erfectries.jamesolflt.bond	United States	13335	CLOUDFLARENETUS	false
52.96.111.2	ooc-g2.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.67.200.32	sdfsdfsdfsdfsdf.stamba.com	United States	13335	CLOUDFLARENETUS	false
104.21.112.1	0j3grwfigpnmnimq.mybeautycare.pk	United States	13335	CLOUDFLARENETUS	false
104.21.92.240	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false

Private

IP
192.168.2.4
192.168.2.14

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1665597
Start date and time:	2025-04-15 17:28:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	[Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm
Detection:	MAL
Classification:	mal84.phis.winHTM@24/30@26/14
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .htm

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.215.94, 64.233.177.139, 64.233.177.113, 64.233.177.101, 64.233.177.102, 64.233.177.100, 64.233.177.138, 142.251.15.84, 172.253.124.101, 172.253.124.100, 172.253.124.102, 172.253.124.138, 172.253.124.113, 172.253.124.139, 64.233.185.102, 64.233.185.113, 64.233.185.101, 64.233.185.138, 64.233.185.139, 64.233.185.100, 74.125.138.113, 74.125.138.101, 74.125.138.139, 74.125.138.100, 74.125.138.138, 74.125.138.102, 74.125.138.95, 142.250.9.95, 108.177.122.95, 142.250.105.95, 74.125.136.95, 64.233.185.95, 172.217.215.95, 74.125.21.95, 173.194.219.95, 172.253.124.95, 64.233.177.95, 173.194.219.102, 173.194.219.139, 173.194.219.101, 173.194.219.138, 173.194.219.100, 173.194.219.113, 74.125.21.102, 74.125.21.139, 74.125.21.100, 74.125.21.138, 74.125.21.101, 74.125.21.113, 173.194.219.94, 108.177.122.113, 108.177.122.101, 108.177.122.138, 108.177.122.139, 108.177.122.102, 108.177.122.100, 74.125.136.138, 74.125.136.101, 74.125.136.100, 74.125.136.139, 74.125.136.102, 74.
Excluded domains from analysis (whitelisted): logincdn.msauth.net, clients1.google.com, fs.microsoft.com, lgincdnmsftuswe2.azureedge.net, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ajax.googleapis.com, aadcdnoriginwus2.azureedge.net, clientservices.googleapis.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, lgincdnmsftuswe2.afd.azureedge.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
52.97.101.194	Ekim_Fatura_Turkcell.exe	Get hash	malicious	Unknown	Browse
23.1.33.12	https://sgoutreach.com/mt/lte?tid=10575540077886&lid=1&targetURL=https://gamma.app/docs/Camozzi-Automation-Ltd-3uaq1u1p10l4wlv?mode=present#card-fwba4n8sto7tjss	Get hash	malicious	HTMLPhisher	Browse
	Remittance_AdviceCopy.svg	Get hash	malicious	HTMLPhisher	Browse
	winchancho_combined.exe	Get hash	malicious	Unknown	Browse
	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	http://cf-ipfs.com	Get hash	malicious	Unknown	Browse
	https://webex-install.com	Get hash	malicious	NetSupport RAT	Browse
	https://binaprecast-my.sharepoint.com/:f:/g/personal/maf_binareadymix_com/EtQwnFsihkNFvAMJsmvHcx0Bs5D77utYZ4PAxlNctboJVg?e=KLtKEO	Get hash	malicious	Unknown	Browse
	edge_x86_KB91412024.exe	Get hash	malicious	Unknown	Browse
104.18.10.207	http://desifoodcorner.wb4.xyz/	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
	SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.10211.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.10211.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.32268.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.4633.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.21631.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.14541.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
code.jquery.com	original.eml	Get hash	malicious	Gabagool	Browse	151.101.2.137
	http://dqljfazx.manamahealth.com/rd/4SPyzj6305fzFg150badyxifgmp318RGPFBXSDASLOMKH3927WAAX41792T12?WYEZw8o1HZ0PSjUue-WkMbNTGsBj-NIobqD	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://tu.gaboras.com.tr	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://sgoutreach.com/mt/lte?tid=10575540077886&lid=1&targetURL=https://gamma.app/docs/Camozzi-Automation-Ltd-3uaq1u1p10l4wlv?mode=present#card-fwba4n8sto7tjss	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://dev.puremro.com/outbound?id=3&src=dir.page&url=https://kevor.nhsaportal.com#test@mydomain.com	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	51432d9c-9841-e335-3af4-cd8efc8e1781.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.130.137
	https://www.canva.com/design/DAGkrWrtDYc/rqRwWN8FmLdYxvJvAW4Uag/view?utm_content=DAGkrWrtDYc&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h5db7899ba7	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	Remittance_AdviceCopy.svg	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	copy.svg	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	M365_Subscription_INV350777356477.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
e329293.dscd.akamaiedge.net	https://bjcgghbjchdgbfbghdgghbjchdgbfbggbfbg.sharefile.eu/share/view/sce3352de88ff40309b639a23a0046fb1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	96.7.218.74
	https://degrgd.dailyenglish.it.com/ODIWCBlb	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	96.7.218.8
	html.html	Get hash	malicious	HTMLPhisher	Browse	96.7.218.8
	https://url.de.m.mimecastprotect.com/s/woPuCPj0KAcKxPVkWHzf5cxVN9d?domain=campaign-statistics.com	Get hash	malicious	HTMLPhisher	Browse	23.203.48.16
	https://campaign-statistics.com/link_click/b4Z6O2-Vv6KGnO-3eiq15/3b7f6a01a70ab8eaf5ab4d4058e199c0	Get hash	malicious	HTMLPhisher	Browse	96.7.218.8
	https://sgoutreach.com/mt/lte?tid=10575540077886&lid=1&targetURL=https://gamma.app/docs/Camozzi-Automation-Ltd-3uaq1u1p10l4wlv?mode=present#card-fwba4n8sto7tjss	Get hash	malicious	HTMLPhisher	Browse	23.1.33.12
	https://www.canva.com/design/DAGkrWrtDYc/rqRwWN8FmLdYxvJvAW4Uag/view?utm_content=DAGkrWrtDYc&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h5db7899ba7	Get hash	malicious	HTMLPhisher	Browse	96.7.218.8
	Remittance_AdviceCopy.svg	Get hash	malicious	HTMLPhisher	Browse	96.7.218.74
	copy.svg	Get hash	malicious	HTMLPhisher	Browse	96.7.218.74
	https://mastressicoglass.my	Get hash	malicious	HTMLPhisher	Browse	96.7.218.8
ooc-g2.tm-4.office.com	https://1234567890123456.bayareasantaclausexperience.com:8443/impact?1234567890123456789012345=no@no.com	Get hash	malicious	HTMLPhisher	Browse	40.99.232.210
	Invoice Confirmation Subscription_2EZHMA9.htm	Get hash	malicious	HTMLPhisher	Browse	40.97.4.1
	Provider Document.html	Get hash	malicious	HTMLPhisher	Browse	52.96.242.18
	https://rsedis.online/?fvrjsszu=d51be19066e55b8a6064b9e0a3b0572f4b01f273b84fffd0d3341ca42e38f44ce5080783bb2651cabe6d2dea6cc950fb15bbe3875845e12a194a042ee82c07c2	Get hash	malicious	HTMLPhisher	Browse	52.96.111.2
	MDE_File_Sample_6967f7cc37c242205a7b3340c6732722fcd79584.zip	Get hash	malicious	HTMLPhisher	Browse	40.104.46.18
	http://support.delfi.com	Get hash	malicious	Unknown	Browse	52.96.239.178
	https://thetti-my.sharepoint.com/:f:/p/kellieblack/EtssBivICL5BgQEDfbETZP4BZsoHTOyxYMnSj46dgeiAiA?e=0t2fdm	Get hash	malicious	HTMLPhisher	Browse	40.97.190.18
	460138.pdf	Get hash	malicious	Unknown	Browse	52.96.109.226
	https://api.mixpanel.com/track?data=eyJldmVudCI6ICIkY2FtcGFpZ25fbGlua19jbGljayIsICJwcm9wZXJ0aWVzIjogeyJjYW1wYWlnbl9pZCI6IDUzNzgyMDQsICJkaXN0aW5jdF9pZCI6ICIxNjE4OTgiLCAibWVzc2FnZV9pZCI6IDEyMTE1MDgsICJ0b2tlbiI6ICI4NDhlOGVjYTBjYjdmNGRjZWE1ODljMWIxMTg2NmQ2YSIsICJ0eXBlIjogImVtYWlsIiwgInVybCI6ICJodHRwOi8vd3d3LmdvbGZnYW1lYm9vay5jb20ifX0=&redirect=https://tornillosind.com.mx/g63c/6195742747/Daversapartners/?nl=anVsaWUud3JhcHBAZGF2ZXJzYXBhcnRuZXJzLmNvbQ==	Get hash	malicious	Unknown	Browse	40.97.4.1
	http://lookerstudio%2e%67%6f%6f%67%6c%65%2e%63%6f%6d/s/tVpHSqKmotA	Get hash	malicious	HTMLPhisher	Browse	40.99.149.98

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	njo.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	104.21.96.1
	https://www.acceleratedusa.net	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.16.138.209
	PO 768733 - 6750.exe	Get hash	malicious	FormBook	Browse	104.21.22.160
	https://disppslyyy2.z13.web.core.windows.net/Wi012nh1delpSh012/index.html?Aniph=1-877-337-5457&_event=4fb5a3fdd9137d70fdfb00640f749955	Get hash	malicious	TechSupportScam	Browse	104.17.25.14
	original.eml	Get hash	malicious	Gabagool	Browse	104.17.25.14
	random.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.205.184
	https://app.any.run/tasks/73c453d2-b4e8-4d61-94da-f398f08adabb	Get hash	malicious	Unknown	Browse	104.26.6.135
	PURCHASE OKK.vbs	Get hash	malicious	FormBook	Browse	104.22.69.199
	https://app.any.run/tasks/73c453d2-b4e8-4d61-94da-f398f08adabb	Get hash	malicious	Unknown	Browse	172.67.20.89
	Draft_Copy_00983232.vbe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
CLOUDFLARENETUS	njo.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	104.21.96.1
	https://www.acceleratedusa.net	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.16.138.209
	PO 768733 - 6750.exe	Get hash	malicious	FormBook	Browse	104.21.22.160
	https://disppslyyy2.z13.web.core.windows.net/Wi012nh1delpSh012/index.html?Aniph=1-877-337-5457&_event=4fb5a3fdd9137d70fdfb00640f749955	Get hash	malicious	TechSupportScam	Browse	104.17.25.14
	original.eml	Get hash	malicious	Gabagool	Browse	104.17.25.14
	random.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.205.184
	https://app.any.run/tasks/73c453d2-b4e8-4d61-94da-f398f08adabb	Get hash	malicious	Unknown	Browse	104.26.6.135
	PURCHASE OKK.vbs	Get hash	malicious	FormBook	Browse	104.22.69.199
	https://app.any.run/tasks/73c453d2-b4e8-4d61-94da-f398f08adabb	Get hash	malicious	Unknown	Browse	172.67.20.89
	Draft_Copy_00983232.vbe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
MICROSOFT-CORP-MSN-AS-BLOCKUS	original.eml	Get hash	malicious	Gabagool	Browse	40.79.141.152
	nK8noQeiXl.exe	Get hash	malicious	HTMLPhisher, CryptOne, LummaC Stealer, Socks5Systemz, Tofsee	Browse	52.101.41.22
	https://compliancetracking.cfainstitute.org/amc-form?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5OGFkMTQzLWM0YzEtNDIwYi05OWQ4LTRlODM2ZmFiNjQ4NyIsIm5iZiI6MTc0NDY2NTI5OSwiZXhwIjoxNzQ1MjcwMDk5LCJpYXQiOjE3NDQ2NjUyOTksImlzcyI6Imh0dHBzOi8vc3RhbmRhcmRzY29tcGxpYW5jZXRyYWNraW5nYXBpLmNmYWluc3RpdHV0ZS5vcmcvIn0.l4SBJnn8huVpuJVgzl7oq2riSJ7NbE6i7-Sgdch3E3s	Get hash	malicious	Unknown	Browse	20.190.157.1
	Newsletter (276Ko).msg	Get hash	malicious	Unknown	Browse	20.189.173.23
	http://universityorthony.com	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://149.154.157.69/+CSCOE+/logon.html?q=BzFdUyAIO1l2Dy4KJSEyQRNXAiweJ0gIHjI%3D	Get hash	malicious	Unknown	Browse	150.171.27.10
	Fatura.pdf	Get hash	malicious	Unknown	Browse	52.109.16.3
	Complete via DocuSign_ #Dailycer_Doc. Signature required 4_14_2025.eml	Get hash	malicious	HTMLPhisher	Browse	52.123.129.14
	https://url.de.m.mimecastprotect.com/s/woPuCPj0KAcKxPVkWHzf5cxVN9d?domain=campaign-statistics.com	Get hash	malicious	HTMLPhisher	Browse	13.107.6.156
	xd.mips.elf	Get hash	malicious	Mirai	Browse	40.70.104.26
AKAMAI-ASN1EU	random.exe	Get hash	malicious	Credential Flusher	Browse	23.47.204.64
	original.eml	Get hash	malicious	Gabagool	Browse	23.55.253.31
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.47.204.51
	https://compliancetracking.cfainstitute.org/amc-form?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5OGFkMTQzLWM0YzEtNDIwYi05OWQ4LTRlODM2ZmFiNjQ4NyIsIm5iZiI6MTc0NDY2NTI5OSwiZXhwIjoxNzQ1MjcwMDk5LCJpYXQiOjE3NDQ2NjUyOTksImlzcyI6Imh0dHBzOi8vc3RhbmRhcmRzY29tcGxpYW5jZXRyYWNraW5nYXBpLmNmYWluc3RpdHV0ZS5vcmcvIn0.l4SBJnn8huVpuJVgzl7oq2riSJ7NbE6i7-Sgdch3E3s	Get hash	malicious	Unknown	Browse	23.0.175.163
	https://bjcgghbjchdgbfbghdgghbjchdgbfbggbfbg.sharefile.eu/share/view/sce3352de88ff40309b639a23a0046fb1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	96.7.218.74
	https://degrgd.dailyenglish.it.com/ODIWCBlb	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	96.7.218.8
	https://149.154.157.69/+CSCOE+/logon.html?q=BzFdUyAIO1l2Dy4KJSEyQRNXAiweJ0gIHjI%3D	Get hash	malicious	Unknown	Browse	23.55.252.135
	Fatura.pdf	Get hash	malicious	Unknown	Browse	23.55.253.31
	html.html	Get hash	malicious	HTMLPhisher	Browse	104.104.244.200
	Complete via DocuSign_ #Dailycer_Doc. Signature required 4_14_2025.eml	Get hash	malicious	HTMLPhisher	Browse	23.48.246.139

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32012)
Category:	downloaded
Size (bytes):	69597
Entropy (8bit):	5.369216080582935
Encrypted:	false
SSDEEP:	1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT
MD5:	5F48FC77CAC90C4778FA24EC9C57F37D
SHA1:	9E89D1515BC4C371B86F4CB1002FD8E377C1829F
SHA-256:	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
SHA-512:	CAB8C4AFA1D8E3A8B7856EE29AE92566D44CEEAD70C8D533F2C98A976D77D0E1D314719B5C6A473789D8C6B21EBB4B89A6B0EC2E1C9C618FB1437EBC77D3A269
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://code.jquery.com/jquery-3.2.1.slim.min.js
Preview:	/! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_e

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19015)
Category:	downloaded
Size (bytes):	19188
Entropy (8bit):	5.212814407014048
Encrypted:	false
SSDEEP:	384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb964:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ3f
MD5:	70D3FDA195602FE8B75E0097EED74DDE
SHA1:	C3B977AA4B8DFB69D651E07015031D385DED964B
SHA-256:	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
SHA-512:	51AFFB5A8CFD2F93B473007F6987B19A0A1A0FB970DDD59EF45BD77A355D82ABBBD60468837A09823496411E797F05B1F962AE93C725ED4C00D514BA40269D14
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Preview:	/. Copyright (C) Federico Zivolo 2017. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. /(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto\|scroll)/.test(r+s+p)?e:n(o(e))}function r(e){var o=e&&e.offsetParent,i=o&&o.nodeName;return i&&'BODY'!==i&&'HTML'!==i?-1!==['TD','TABLE'].indexOf(o.nodeName)&&'static'===t(o,'position')?r(o):o:e?e.ownerDocument.documentElement:document.documentElement}functio

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48664)
Category:	downloaded
Size (bytes):	48944
Entropy (8bit):	5.272507874206726
Encrypted:	false
SSDEEP:	768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B
MD5:	14D449EB8876FA55E1EF3C2CC52B0C17
SHA1:	A9545831803B1359CFEED47E3B4D6BAE68E40E99
SHA-256:	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
SHA-512:	00D9069B9BD29AD0DAA0503F341D67549CCE28E888E1AFFD1A2A45B64A4C1BC460D81CFC4751857F991F2F4FB3D2572FD97FCA651BA0C2B0255530209B182F22
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign\|\|function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&e.hasOwnProperty("default")?e.default:e,n=n&&n.hasOwnProp

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	513
Entropy (8bit):	4.720499940334011
Encrypted:	false
SSDEEP:	12:t4BdU/uRqv6DLfBHKFWJCDLfBSU1pRXIFl+MJ4bADc:t4TU/uRff0EcfIU1XXU+t2c
MD5:	A9CC2824EF3517B6C4160DCF8FF7D410
SHA1:	8DB9AEBAD84CA6E4225BFDD2458FF3821CC4F064
SHA-256:	34F9DB946E89F031A80DFCA7B16B2B686469C9886441261AE70A44DA1DFA2D58
SHA-512:	AA3DDAB0A1CFF9533F9A668ABA4FB5E3D75ED9F8AFF8A1CAA4C29F9126D85FF4529E82712C0119D2E81035D1CE1CC491FF9473384D211317D4D00E0E234AD97F
Malicious:	false
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><title>assets</title><path d="M18,11.578v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944.594.594L7.617,11.578Z" fill="#404040"/><path d="M10.944,7.056l.594.594L7.617,11.578H18v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944m0-.141-.071.07L5.929,11.929,5.858,12l.071.071,4.944,4.944.071.07.071-.07.594-.595.071-.07-.071-.071L7.858,12.522H18.1V11.478H7.858l3.751-3.757.071-.071-.071-.07-.594-.595-.071-.07Z" fill="#404040"/></svg>

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	513
Entropy (8bit):	4.720499940334011
Encrypted:	false
SSDEEP:	12:t4BdU/uRqv6DLfBHKFWJCDLfBSU1pRXIFl+MJ4bADc:t4TU/uRff0EcfIU1XXU+t2c
MD5:	A9CC2824EF3517B6C4160DCF8FF7D410
SHA1:	8DB9AEBAD84CA6E4225BFDD2458FF3821CC4F064
SHA-256:	34F9DB946E89F031A80DFCA7B16B2B686469C9886441261AE70A44DA1DFA2D58
SHA-512:	AA3DDAB0A1CFF9533F9A668ABA4FB5E3D75ED9F8AFF8A1CAA4C29F9126D85FF4529E82712C0119D2E81035D1CE1CC491FF9473384D211317D4D00E0E234AD97F
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><title>assets</title><path d="M18,11.578v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944.594.594L7.617,11.578Z" fill="#404040"/><path d="M10.944,7.056l.594.594L7.617,11.578H18v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944m0-.141-.071.07L5.929,11.929,5.858,12l.071.071,4.944,4.944.071.07.071-.07.594-.595.071-.07-.071-.071L7.858,12.522H18.1V11.478H7.858l3.751-3.757.071-.071-.071-.07-.594-.595-.071-.07Z" fill="#404040"/></svg>

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32030)
Category:	downloaded
Size (bytes):	86709
Entropy (8bit):	5.367391365596119
Encrypted:	false
SSDEEP:	1536:9NhEyjjTikEJO4edXXe9J578go6MWXqcVhrLyB4Lw13sh2bzrl1+iuH7U3gBORDT:jxcq0hrLZwpsYbmzORDU8Cu5
MD5:	E071ABDA8FE61194711CFC2AB99FE104
SHA1:	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
SHA-256:	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
SHA-512:	53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
Malicious:	false
URL:	https://code.jquery.com/jquery-3.1.1.min.js
Preview:	/! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	271751
Entropy (8bit):	5.0685414131801165
Encrypted:	false
SSDEEP:	6144:+tah6/K+TCtlMhTze/RZcYmDizK8dB7alFys/WL/umH4N0IPfKu5AA11vrIY:9pZcYmDcHwFygmY1PfjAA1Br3
MD5:	6A07DA9FAE934BAF3F749E876BBFDD96
SHA1:	46A436EBA01C79ACDB225757ED80BF54BAD6416B
SHA-256:	D8AA24ECC6CECB1A60515BC093F1C9DA38A0392612D9AB8AE0F7F36E6EEE1FAD
SHA-512:	E525248B09A6FB4022244682892E67BBF64A3E875EB889DB43B0A24AB4A75077B5D5D26943CA382750D4FEBC3883193F3BE581A4660065B6FC7B5EC20C4A044B
Malicious:	false
URL:	https://code.jquery.com/jquery-3.3.1.js
Preview:	/!. jQuery JavaScript Library v3.3.1. * https://jquery.com/. . Includes Sizzle.js. * https://sizzlejs.com/. . Copyright JS Foundation and other contributors. * Released under the MIT license. * https://jquery.org/license. . Date: 2018-01-20T17:24Z. */.( function( global, factory ) {..."use strict";...if ( typeof module === "object" && typeof module.exports === "object" ) {....// For CommonJS and CommonJS-like environments where a proper `window`...// is present, execute the factory and get jQuery....// For environments that do not have a `window` with a `document`...// (such as Node.js), expose a factory as module.exports....// This accentuates the need for the creation of a real `window`....// e.g. var jQuery = require("jquery")(window);...// See ticket #14549 for more info....module.exports = global.document ?....factory( global, true ) :....function( w ) {.....if ( !w.document ) {......throw new Error( "jQuery requires a window with a document" );.....}.....return factor

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:	3:/7YnnSvr8jOhR:TgnSvrye
MD5:	AEBD164195BA2B6D71262E74BBF0BE1A
SHA1:	87428A3573EDE4DFE89649F8ADB002194E1EA31C
SHA-256:	EB4B8C0EBE0DE4E276DEAD7189026C07C0EA138FA12AF974D511F4ED399CEB58
SHA-512:	3E4696FC23D7A0B43AD6FAF99B353F1C2B4799B54966D0811FCF7E57B16ADD471A9E83B5CC48C7E4BCF012D263A3AB0A1DC7FA66ED5AA79E64D8CEDCFDECAAF7
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCWvSkhU2x6L7EgUNJ3dOLBIFDVI1gWQhZpBs5Jidflg=?alt=proto
Preview:	ChIKBw0nd04sGgAKBw1SNYFkGgA=

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zstandard compressed data (v0.8+), Dictionary ID: None
Category:	downloaded
Size (bytes):	17214
Entropy (8bit):	7.983319974635515
Encrypted:	false
SSDEEP:	384:BeyEXp4Rrg4uHdlqNpdjUdhN2O0Bm7bOmQ1MSAqvSLG4SNbcW79ibZ:EyE5K1rdwBj7bOWSAqvSDKVsbZ
MD5:	05C6AAA2662D58B138E73431493C13B2
SHA1:	FC034B817D8000148C5E018F85112511D7E9FDE8
SHA-256:	F9912B730AF6A4608817D8322B46E3F5F314A6F32BACFD0EC660BEA9284006E9
SHA-512:	9659EB33547A4B6BB0952E032913C9D7C114D894A223DF5D1F4F1F9BD0EB6AE662492801E11884F654A375B82C484DF29543DA2BB73C99BD9C1371BE7524BFAC
Malicious:	false
URL:	https://0j3grwfigpnmnimq.mybeautycare.pk:8443/impact?zBhe7e7RxuDbbqsQYGrSDPO4k=sarah@trac9.com
Preview:	(./..X...zk{...JD..P...[i".bn.(..7..?%....P...M[...I.2`...h.....[..WX#.H[I5Z.^.2...[...F....l...-...=.m.;Gjf.....].r......mo..B.4.p..\....F...L.. .....5.}.!...&.8..R?.W..M$9.1.+...I.5........D......r..m.d-......^..w...y.....Y..#...>...q....Y..<.6.L.%k..>OC.......#c.......G..7QBp.KD6.....=.........C....X...b...!....6.l....)...L....+..5.5+.)......=...U...;"....g....kc.)Pb..J.c..L.,..J..R....yh...4............E.........E..r...g.Y..mXF..K..s.EW.l..l......@.p.....o..n..[.B.D.N..!......0...+.5.......4...U.......R..Su.F...^!"....).j.....G..o.....7.......x....E.E..Y.).E....."F+V.C....y..M..A:.xLK.p.EG1..1.H.2.}...E..o.....".._D(......:........;R..$..Q.\bme......F..o...^.E.C.H..... ..L....o]...M$......i...8.3..0..G...=.."....EF..6.e.i..l.~`.H.L.V.L..W...C.~`vH.\/@...-).........s\.)..k\.GB....._T.p.1h./R.R...E........."...h....-..o...n.Ng..K..$.JN...2f9.f.00Q...+..:......5....=.............+D..<.@.BnJ..R.....b....~+[.f...2x."2..`..w

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61177)
Category:	downloaded
Size (bytes):	110118
Entropy (8bit):	5.288593644108406
Encrypted:	false
SSDEEP:	1536:QpHDgBvguhw+EViazA/PWrF7qvEAFiQcpmUyDzz6yVUns:xktHyVUs
MD5:	29F1D1172158F929B64CC926E4521C0B
SHA1:	AF19579C25EBBFD3BBC82A5AB77479647FE02AB8
SHA-256:	8B6A3B17737161E5FE8C29E401372A94B8E650226CF0CD17B4C3C4DE5B380B11
SHA-512:	DA984750F76BF1795737A507163E4180767D8688E4A55ED343363A831DB0E601702DE4F3AEC4D21F88D014B355CD296B422CABCBC7C8A236AAD65F19FF43383D
Malicious:	false
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1920x1081, components 3
Category:	downloaded
Size (bytes):	83760
Entropy (8bit):	7.907809871171796
Encrypted:	false
SSDEEP:	1536:mOLbXdVvM+BgwLPflu+xPAekUx+kNTq9CXkZrYivV9qmiKscG2LN6C5c7KQP+oZ3:mOLbXdVewLPflu+PbIkM9v/vTLUQc7KY
MD5:	3A53C38A2DC671FB4DAFB29ED2E8D602
SHA1:	6C83CBE368608A866F734A3CAA31A747EBD6339C
SHA-256:	E9D90D78575F9051B6506D28E0C55F4FFA11F7A72F7D7890BC9890A738529617
SHA-512:	DAA7F14355E997E3D077A7ED2FB24C5F2040EF352FE4F05EEC7F96E531EADF107992DC1DFEA72819D57083001AF93396EE310823247E1FDF98470A8775DE6198
Malicious:	false
URL:	https://logincdn.msauth.net/shared/5/images/78_3a53c38a2dc671fb4daf.jpg
Preview:	......JFIF.....H.H.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......9....".............................................................................. ..@..@.. ......R...(.P.@.%A@...,...............`..`.Q......R..R...E.XI...IFTeD.....J.E..H*....APYD.T.T.. .!`...........v.....!`.X.` ....AR....%EPT..(.%J..............`........@%.`.....@.....Q&.&.&...fj.j.a(......J%.JE...a`X...a`X................hJ.....X......@J.Q.-......J..R.(..T..@.b...........D....@..@..@...T..,.....D....Tfj.j.Q.,..b.....).%.......X..`.............i..A`.X..).....X..Q.%.(..D.....-T...@.U.e.J.............%.`...%.`...@.....YD..FTeFf.....XE.....,.........!@..............vI-@........E..DTE.DR.ADQ..K.EY..P.T..@...@J..............)....... X..T..,.(.....`.Q....fn...TID.......P..............@......`J......,.....`Y..K.J@..Q....a.X.QTYR..R.@T.(..................DX...%...,.......E.gW.N..va5#3C.C3P..R.................%..P.@..X......@.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1920x1081, components 3
Category:	dropped
Size (bytes):	83760
Entropy (8bit):	7.907809871171796
Encrypted:	false
SSDEEP:	1536:mOLbXdVvM+BgwLPflu+xPAekUx+kNTq9CXkZrYivV9qmiKscG2LN6C5c7KQP+oZ3:mOLbXdVewLPflu+PbIkM9v/vTLUQc7KY
MD5:	3A53C38A2DC671FB4DAFB29ED2E8D602
SHA1:	6C83CBE368608A866F734A3CAA31A747EBD6339C
SHA-256:	E9D90D78575F9051B6506D28E0C55F4FFA11F7A72F7D7890BC9890A738529617
SHA-512:	DAA7F14355E997E3D077A7ED2FB24C5F2040EF352FE4F05EEC7F96E531EADF107992DC1DFEA72819D57083001AF93396EE310823247E1FDF98470A8775DE6198
Malicious:	false
Preview:	......JFIF.....H.H.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......9....".............................................................................. ..@..@.. ......R...(.P.@.%A@...,...............`..`.Q......R..R...E.XI...IFTeD.....J.E..H*....APYD.T.T.. .!`...........v.....!`.X.` ....AR....%EPT..(.%J..............`........@%.`.....@.....Q&.&.&...fj.j.a(......J%.JE...a`X...a`X................hJ.....X......@J.Q.-......J..R.(..T..@.b...........D....@..@..@...T..,.....D....Tfj.j.Q.,..b.....).%.......X..`.............i..A`.X..).....X..Q.%.(..D.....-T...@.U.e.J.............%.`...%.`...@.....YD..FTeFf.....XE.....,.........!@..............vI-@........E..DTE.DR.ADQ..K.EY..P.T..@...@J..............)....... X..T..,.(.....`.Q....fn...TID.......P..............@......`J......,.....`Y..K.J@..Q....a.X.QTYR..R.@T.(..................DX...%...,.......E.gW.N..va5#3C.C3P..R.................%..P.@..X......@.

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065)
Category:	downloaded
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

Static File Info

General

File type:	HTML document, ASCII text, with CRLF line terminators
Entropy (8bit):	4.922935692847741
TrID:	HyperText Markup Language (13003/1) 100.00%
File name:	[Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm
File size:	5'981 bytes
MD5:	16cde94f8e003392ff139f8b2afcd81b
SHA1:	e481d88d9d1fcd15b98c707096c41a3131ce67f0
SHA256:	e086e5815cdd21831d445881dd7459865bfa4386def0239731a16a56584dc3ed
SHA512:	40fbb454f8996dab10d43bf7d26c32485aec12f43c688e46e311dee91e7aa7a6fa58a3fe6d04b384ed0e309a52a60b0cb57b187db5d7d18508794c03d45ff330
SSDEEP:	96:1h+xF/1CF/UzHecfV6iiiBiFa3g4aIoN31Mk3xiqiCiSiXp:KL1WUzHecgiiiBi0gEoN31x3xiqiCiSi
TLSH:	D7C14325364480115272E37C6FB36A0CF6B19117A701056A7DDC624F8FF668688D3FDC
File Content Preview:	..<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="description" content="418518715379">.. <meta name="robots" content="noindex, nofollow"> Pr

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2025 17:29:20.632273912 CEST	49680	443	192.168.2.4	204.79.197.222
Apr 15, 2025 17:29:21.413458109 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 15, 2025 17:29:21.538233042 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 15, 2025 17:29:21.725641966 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 15, 2025 17:29:22.335035086 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 15, 2025 17:29:23.538175106 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 15, 2025 17:29:25.944396019 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 15, 2025 17:29:30.303755999 CEST	49680	443	192.168.2.4	204.79.197.222
Apr 15, 2025 17:29:30.349872112 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 15, 2025 17:29:30.694385052 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 15, 2025 17:29:30.756930113 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 15, 2025 17:29:31.201811075 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 15, 2025 17:29:31.304020882 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 15, 2025 17:29:32.601560116 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 15, 2025 17:29:35.006557941 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 15, 2025 17:29:35.368103981 CEST	49732	443	192.168.2.4	74.125.138.104
Apr 15, 2025 17:29:35.368146896 CEST	443	49732	74.125.138.104	192.168.2.4
Apr 15, 2025 17:29:35.368356943 CEST	49732	443	192.168.2.4	74.125.138.104
Apr 15, 2025 17:29:35.368530989 CEST	49732	443	192.168.2.4	74.125.138.104
Apr 15, 2025 17:29:35.368546963 CEST	443	49732	74.125.138.104	192.168.2.4
Apr 15, 2025 17:29:35.590054035 CEST	443	49732	74.125.138.104	192.168.2.4
Apr 15, 2025 17:29:35.590173006 CEST	49732	443	192.168.2.4	74.125.138.104
Apr 15, 2025 17:29:35.594754934 CEST	49732	443	192.168.2.4	74.125.138.104
Apr 15, 2025 17:29:35.594769955 CEST	443	49732	74.125.138.104	192.168.2.4
Apr 15, 2025 17:29:35.595048904 CEST	443	49732	74.125.138.104	192.168.2.4
Apr 15, 2025 17:29:35.649025917 CEST	49732	443	192.168.2.4	74.125.138.104
Apr 15, 2025 17:29:37.589128017 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.689111948 CEST	49736	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.710248947 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:37.710334063 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.710738897 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.810446024 CEST	8443	49736	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:37.810524940 CEST	49736	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.810734987 CEST	49736	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.831832886 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:37.835844040 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:37.835880995 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:37.835892916 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:37.835957050 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.839132071 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.839355946 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.839682102 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.931715965 CEST	8443	49736	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:37.935697079 CEST	8443	49736	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:37.935738087 CEST	8443	49736	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:37.935764074 CEST	8443	49736	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:37.935810089 CEST	49736	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.936311960 CEST	49736	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.960443974 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:37.960472107 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:37.960546017 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:37.961105108 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:38.002585888 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.057456970 CEST	8443	49736	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.057471037 CEST	8443	49736	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.057523966 CEST	49736	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:38.082180023 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.524769068 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525342941 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525358915 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525373936 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525386095 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525397062 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525401115 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:38.525408030 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525419950 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525430918 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525444031 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525448084 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:38.525454044 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525465012 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525466919 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:38.525475979 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525481939 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:38.525486946 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525497913 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525507927 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525513887 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:38.525518894 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525530100 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525541067 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:38.525574923 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:38.525619030 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525630951 CEST	8443	49735	104.21.112.1	192.168.2.4
Apr 15, 2025 17:29:38.525676012 CEST	49735	8443	192.168.2.4	104.21.112.1
Apr 15, 2025 17:29:39.227617979 CEST	49737	2025	192.168.2.4	172.67.200.32
Apr 15, 2025 17:29:39.285120964 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.285175085 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.285245895 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.285514116 CEST	49739	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.285608053 CEST	443	49739	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.285682917 CEST	49739	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.285752058 CEST	49740	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.285773993 CEST	443	49740	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.285832882 CEST	49740	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.285981894 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.286000967 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.286520004 CEST	49739	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.286556005 CEST	443	49739	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.286590099 CEST	49740	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.286617041 CEST	443	49740	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.289388895 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.289419889 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.289483070 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.289566040 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.289588928 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.289638996 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.289854050 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.289880037 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.289968014 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.290070057 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.290091991 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.290230989 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.290246010 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.290406942 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.290416956 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.293821096 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.293842077 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.293886900 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.294045925 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.294060946 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.294424057 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.294440985 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.294495106 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.294598103 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.294605017 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.356055975 CEST	49748	2025	192.168.2.4	172.67.200.32
Apr 15, 2025 17:29:39.507963896 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.508018970 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.509272099 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.509279013 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.509624958 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.511080027 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.513614893 CEST	443	49740	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.513757944 CEST	49740	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.514053106 CEST	49740	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.514064074 CEST	443	49740	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.514509916 CEST	443	49739	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.514600992 CEST	49739	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.515014887 CEST	49739	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.515028000 CEST	443	49739	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.515265942 CEST	443	49740	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.515575886 CEST	49740	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.515732050 CEST	443	49739	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.515952110 CEST	49739	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.517865896 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.517869949 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.517971039 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.518830061 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.518830061 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.518843889 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.519069910 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.519156933 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.519166946 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.519370079 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.519579887 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.519783974 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.521651030 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.521754980 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.522422075 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.522497892 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.522584915 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.522594929 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.523382902 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.523392916 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.523540974 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.523739100 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.523829937 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.523969889 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.526467085 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.526547909 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.527684927 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.527693987 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.528139114 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.528367043 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.556273937 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.556279898 CEST	443	49739	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.556298018 CEST	443	49740	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.560300112 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.564265013 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.564275026 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.568269014 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.576263905 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.720964909 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.721215963 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.721267939 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.721292973 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.721374989 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.721426010 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.721434116 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.724488020 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.724540949 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.724550962 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.727965117 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.728012085 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.728020906 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.728511095 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.728519917 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.728914976 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.728960037 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.728961945 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.728977919 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.729021072 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.729032040 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.729326963 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.729352951 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.729367971 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.729377985 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.729408979 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.729424000 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.729429960 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.729463100 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.731456995 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.731522083 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.731528997 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.732347012 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.732384920 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.732393026 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.732408047 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.732440948 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.732779980 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.734345913 CEST	443	49739	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.735027075 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.735078096 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.735093117 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.735265970 CEST	443	49739	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.735352993 CEST	49739	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.735852003 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.736417055 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.736440897 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.736454964 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.736460924 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.736504078 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.736573935 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.736601114 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.736617088 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.736650944 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.736665964 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.736682892 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.736711979 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.738234043 CEST	49739	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.738279104 CEST	443	49739	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.739341974 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.739378929 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.739381075 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.739397049 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.739433050 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.739833117 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.741672993 CEST	443	49740	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.741734028 CEST	443	49740	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.741799116 CEST	49740	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.741825104 CEST	443	49740	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.741878986 CEST	49740	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.742486000 CEST	443	49740	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.742611885 CEST	443	49740	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.742656946 CEST	49740	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.742882967 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.743371964 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.743396997 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.743412971 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.743417978 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.743459940 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.745541096 CEST	49740	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.745563984 CEST	443	49740	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.745587111 CEST	49740	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.745615005 CEST	49740	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.746393919 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.746427059 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.746443033 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.746454954 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.746495962 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.746907949 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.749936104 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.750427008 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.750448942 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.750467062 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.750472069 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.750514984 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.753457069 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.753489017 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.753504992 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.753528118 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.753562927 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.753937006 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.756202936 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.756278992 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.756279945 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.756310940 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.756342888 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.756370068 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.757028103 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.757499933 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.757523060 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.757540941 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.757546902 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.757580996 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.760586977 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.760634899 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.760647058 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.760942936 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.764225006 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.764267921 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.764278889 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.764516115 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.764539957 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.764556885 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.764563084 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.764597893 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.767635107 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.767685890 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.767698050 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.768047094 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.771159887 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.771203995 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.771217108 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.790045023 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.790098906 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.790142059 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.790139914 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.790172100 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.790206909 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.790215969 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.790266991 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.790297031 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.790304899 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.790385962 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.790426970 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.790436983 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.790556908 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.790600061 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.790606976 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.790965080 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.791013002 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.791024923 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.791095972 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.791141987 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.791148901 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.791627884 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.791683912 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.791862965 CEST	49747	443	192.168.2.4	104.17.24.14
Apr 15, 2025 17:29:39.791879892 CEST	443	49747	104.17.24.14	192.168.2.4
Apr 15, 2025 17:29:39.806344986 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 15, 2025 17:29:39.816448927 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.816456079 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.819911957 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.827334881 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.827454090 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.827508926 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.827523947 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.827611923 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.827650070 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.827657938 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.827766895 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.827807903 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.827816010 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.827938080 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.827976942 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.827982903 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.828172922 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.828210115 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.828216076 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.828304052 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.828344107 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.828350067 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.828454018 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.828566074 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.828573942 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.828790903 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.828829050 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.828835964 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.828943014 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.828980923 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.828988075 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.829133034 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.829175949 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.829183102 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.829690933 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.829735041 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.829744101 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.829848051 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.829886913 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.829893112 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.829998016 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.830034971 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.830043077 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.830543995 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.830589056 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.830599070 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.830694914 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.830734968 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.830741882 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.830842972 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.830909967 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.830915928 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.831430912 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.831475973 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.831485987 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.831579924 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.831618071 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.831625938 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.831821918 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.831864119 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.832222939 CEST	49746	443	192.168.2.4	104.18.10.207
Apr 15, 2025 17:29:39.832236052 CEST	443	49746	104.18.10.207	192.168.2.4
Apr 15, 2025 17:29:39.834217072 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.834227085 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.834275961 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.834295034 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.834326029 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.834337950 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.834368944 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.835203886 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.835252047 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.835262060 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.835845947 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.835885048 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.835899115 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.836683035 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.836850882 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.836855888 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.839436054 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.839477062 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.839489937 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.839953899 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.839975119 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.840002060 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.840007067 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.840049028 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.840084076 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.842005014 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.842046976 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.842060089 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.843168020 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.843209982 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.843219042 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.844873905 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.844912052 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.844923973 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.845941067 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.845983982 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.845988989 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.847623110 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.847688913 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.847701073 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.848623991 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.848661900 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.848668098 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.849617004 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.849658012 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.849690914 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.849699974 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.849730015 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.849750042 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.850168943 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.850205898 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.850219011 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.851238012 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.851283073 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.851289034 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.852610111 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.852643967 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.852655888 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.853698015 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.853739023 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.853756905 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.854063988 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.854120016 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.854126930 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.854168892 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.854207039 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.854258060 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.854607105 CEST	49743	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.854621887 CEST	443	49743	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.855092049 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.855127096 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.855139017 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.856165886 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.856209040 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.856214046 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.867741108 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.867759943 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.867803097 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.867813110 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.867846012 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.869455099 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.869479895 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.869512081 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.869528055 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.869549990 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.869554996 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.869577885 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.870346069 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.870388031 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.870397091 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.870407104 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.870413065 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.870434999 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.870470047 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.875371933 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.875435114 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.875447035 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.875567913 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.875614882 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.875925064 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.875935078 CEST	443	49742	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.875950098 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.875979900 CEST	49742	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.881515026 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.881532907 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.881580114 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.881587982 CEST	443	49744	151.101.194.137	192.168.2.4
Apr 15, 2025 17:29:39.881625891 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.881695986 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.881705046 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.893011093 CEST	49749	443	192.168.2.4	23.1.33.12
Apr 15, 2025 17:29:39.893069983 CEST	443	49749	23.1.33.12	192.168.2.4
Apr 15, 2025 17:29:39.893131018 CEST	49749	443	192.168.2.4	23.1.33.12
Apr 15, 2025 17:29:39.893361092 CEST	49750	443	192.168.2.4	23.1.33.12
Apr 15, 2025 17:29:39.893399000 CEST	443	49750	23.1.33.12	192.168.2.4
Apr 15, 2025 17:29:39.893449068 CEST	49750	443	192.168.2.4	23.1.33.12
Apr 15, 2025 17:29:39.893604040 CEST	49749	443	192.168.2.4	23.1.33.12
Apr 15, 2025 17:29:39.893618107 CEST	443	49749	23.1.33.12	192.168.2.4
Apr 15, 2025 17:29:39.893676043 CEST	49750	443	192.168.2.4	23.1.33.12
Apr 15, 2025 17:29:39.893690109 CEST	443	49750	23.1.33.12	192.168.2.4
Apr 15, 2025 17:29:39.928709030 CEST	49744	443	192.168.2.4	151.101.194.137
Apr 15, 2025 17:29:39.928792000 CEST	49738	443	192.168.2.4	96.7.218.74
Apr 15, 2025 17:29:39.945605993 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.945617914 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.945646048 CEST	443	49738	96.7.218.74	192.168.2.4
Apr 15, 2025 17:29:39.946738958 CEST	443	49744	151.101.194.137</

Source: Yara match	File source: 0.5.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.4.pages.csv, type: HTML
Source: Yara match	File source: 0.3.pages.csv, type: HTML

Source: [Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No favicon

Source: global traffic	TCP traffic: 192.168.2.4:49735 -> 104.21.112.1:8443
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 104.21.92.240:2025

Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 23.1.33.12 23.1.33.12
Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207

Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://0j3grwfigpnmnimq.mybeautycare.pk:8443/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://0j3grwfigpnmnimq.mybeautycare.pk:8443/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://0j3grwfigpnmnimq.mybeautycare.pk:8443/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveOrigin: https://0j3grwfigpnmnimq.mybeautycare.pk:8443sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0j3grwfigpnmnimq.mybeautycare.pk:8443/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveOrigin: https://0j3grwfigpnmnimq.mybeautycare.pk:8443sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0j3grwfigpnmnimq.mybeautycare.pk:8443/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://0j3grwfigpnmnimq.mybeautycare.pk:8443/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://0j3grwfigpnmnimq.mybeautycare.pk:8443sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0j3grwfigpnmnimq.mybeautycare.pk:8443/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://0j3grwfigpnmnimq.mybeautycare.pk:8443sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0j3grwfigpnmnimq.mybeautycare.pk:8443/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app/godag.php HTTP/1.1Host: erfectries.jamesolflt.bondConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app/godag.php HTTP/1.1Host: erfectries.jamesolflt.bondConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7e55h6vlpql44h2jrfkbjsm29j
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mail/ HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app/godag.php HTTP/1.1Host: erfectries.jamesolflt.bondConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7e55h6vlpql44h2jrfkbjsm29j
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mail/ HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app/godag.php HTTP/1.1Host: erfectries.jamesolflt.bondConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7e55h6vlpql44h2jrfkbjsm29j
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mail/ HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app/godag.php HTTP/1.1Host: erfectries.jamesolflt.bondConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7e55h6vlpql44h2jrfkbjsm29j
Source: global traffic	HTTP traffic detected: GET /mail/ HTTP/1.1Host: outlook.office.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://0j3grwfigpnmnimq.mybeautycare.pk:8443/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mail/ HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: New script tag found
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: New script tag found
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: New script tag found
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: New script tag found

Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/[Certificate_Details]_[Microsoft_sarah]_Tue,%2015%20Apr%202025%2007_31_02%20-0700.htm	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 0j3grwfigpnmnimq.mybeautycare.pk
Source: global traffic	DNS traffic detected: DNS query: _8443._https.0j3grwfigpnmnimq.mybeautycare.pk
Source: global traffic	DNS traffic detected: DNS query: sdfsdfsdfsdfsdf.stamba.com
Source: global traffic	DNS traffic detected: DNS query: _2025._https.sdfsdfsdfsdfsdf.stamba.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: erfectries.jamesolflt.bond
Source: global traffic	DNS traffic detected: DNS query: outlook.office.com

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report [Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
[Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm