Edit tour

Windows Analysis Report
https://support-ads-team-34d19.firebaseapp.com/form-2122.html

Overview

General Information

Sample URL:	https://support-ads-team-34d19.firebaseapp.com/form-2122.html
Analysis ID:	1447588
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1996,i,14774615609112291354,10908193720494069642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://support-ads-team-34d19.firebaseapp.com/form-2122.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://support-ads-team-34d19.firebaseapp.com/form-2122.html

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Multi AV Scanner detection for submitted file

Source: https://support-ads-team-34d19.firebaseapp.com/form-2122.html

Virustotal: Detection: 20%

Perma Link

Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.4:62877 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:64490 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.126.137
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.126.137
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.126.137
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.126.137
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /form-2122.html HTTP/1.1Host: support-ads-team-34d19.firebaseapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/main.597a1abe.js HTTP/1.1Host: support-ads-team-34d19.firebaseapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support-ads-team-34d19.firebaseapp.com/form-2122.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/main.4dd8a724.css HTTP/1.1Host: support-ads-team-34d19.firebaseapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://support-ads-team-34d19.firebaseapp.com/form-2122.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /resources/meta.svg HTTP/1.1Host: support-ads-team-34d19.firebaseapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://support-ads-team-34d19.firebaseapp.com/form-2122.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /resources/bg.jpeg HTTP/1.1Host: support-ads-team-34d19.firebaseapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://support-ads-team-34d19.firebaseapp.com/form-2122.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /resources/meta.svg HTTP/1.1Host: support-ads-team-34d19.firebaseapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /resources/logo.png HTTP/1.1Host: support-ads-team-34d19.firebaseapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://support-ads-team-34d19.firebaseapp.com/form-2122.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /resources/bg.jpeg HTTP/1.1Host: support-ads-team-34d19.firebaseapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /manifest.json HTTP/1.1Host: support-ads-team-34d19.firebaseapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://support-ads-team-34d19.firebaseapp.com/form-2122.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logo192.png HTTP/1.1Host: support-ads-team-34d19.firebaseapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://support-ads-team-34d19.firebaseapp.com/form-2122.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /resources/logo.png HTTP/1.1Host: support-ads-team-34d19.firebaseapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /logo192.png HTTP/1.1Host: support-ads-team-34d19.firebaseapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: support-ads-team-34d19.firebaseapp.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: sets.json.0.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.0.dr	String found in binary or memory: https://alice.tw
Source: sets.json.0.dr	String found in binary or memory: https://autobild.de
Source: sets.json.0.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.0.dr	String found in binary or memory: https://bild.de
Source: sets.json.0.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.0.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.0.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.0.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.0.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.0.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.0.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.0.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.0.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.0.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.0.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.0.dr	String found in binary or memory: https://chennien.com
Source: sets.json.0.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.0.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.0.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.0.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.0.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.0.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.0.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.0.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.0.dr	String found in binary or memory: https://een.be
Source: sets.json.0.dr	String found in binary or memory: https://efront.com
Source: sets.json.0.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.0.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.0.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.0.dr	String found in binary or memory: https://ella.sv
Source: sets.json.0.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.0.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.0.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.0.dr	String found in binary or memory: https://finn.no
Source: sets.json.0.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.0.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.0.dr	String found in binary or memory: https://gettalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.0.dr	String found in binary or memory: https://grid.id
Source: sets.json.0.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.0.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.0.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.0.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://hapara.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.global
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.0.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.0.dr	String found in binary or memory: https://hearty.app
Source: sets.json.0.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.0.dr	String found in binary or memory: https://hearty.me
Source: sets.json.0.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.0.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.0.dr	String found in binary or memory: https://hj.rs
Source: sets.json.0.dr	String found in binary or memory: https://hjck.com
Source: sets.json.0.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.0.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.0.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.0.dr	String found in binary or memory: https://iolam.it
Source: sets.json.0.dr	String found in binary or memory: https://ishares.com
Source: sets.json.0.dr	String found in binary or memory: https://jagran.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.0.dr	String found in binary or memory: https://kompas.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.0.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.0.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.0.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.0.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.0.dr	String found in binary or memory: https://libero.it
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.0.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.0.dr	String found in binary or memory: https://livemint.com
Source: sets.json.0.dr	String found in binary or memory: https://max.auto
Source: sets.json.0.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.0.dr	String found in binary or memory: https://meo.pt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.0.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.0.dr	String found in binary or memory: https://money.pl
Source: sets.json.0.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://nacion.com
Source: sets.json.0.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.co
Source: sets.json.0.dr	String found in binary or memory: https://nien.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.org
Source: sets.json.0.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.0.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.0.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.0.dr	String found in binary or memory: https://o2.pl
Source: sets.json.0.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.0.dr	String found in binary or memory: https://onet.pl
Source: sets.json.0.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.0.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.0.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.0.dr	String found in binary or memory: https://player.pl
Source: sets.json.0.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.0.dr	String found in binary or memory: https://poalim.site
Source: sets.json.0.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.0.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.0.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.0.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.0.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://radio1.be
Source: sets.json.0.dr	String found in binary or memory: https://radio2.be
Source: sets.json.0.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://repid.org
Source: sets.json.0.dr	String found in binary or memory: https://reshim.org
Source: sets.json.0.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.0.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.0.dr	String found in binary or memory: https://samayam.com
Source: sets.json.0.dr	String found in binary or memory: https://sapo.io
Source: sets.json.0.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.0.dr	String found in binary or memory: https://shock.co
Source: sets.json.0.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.0.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.0.dr	String found in binary or memory: https://songshare.com
Source: sets.json.0.dr	String found in binary or memory: https://songstats.com
Source: sets.json.0.dr	String found in binary or memory: https://sporza.be
Source: sets.json.0.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.0.dr	String found in binary or memory: https://stripe.com
Source: sets.json.0.dr	String found in binary or memory: https://stripe.network
Source: sets.json.0.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.0.dr	String found in binary or memory: https://supereva.it
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.0.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.0.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.0.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.0.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.0.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.0.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.0.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://tvid.in
Source: sets.json.0.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.0.dr	String found in binary or memory: https://unotv.com
Source: sets.json.0.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.0.dr	String found in binary or memory: https://vrt.be
Source: sets.json.0.dr	String found in binary or memory: https://vwo.com
Source: sets.json.0.dr	String found in binary or memory: https://welt.de
Source: sets.json.0.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.0.dr	String found in binary or memory: https://wildix.com
Source: sets.json.0.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.0.dr	String found in binary or memory: https://wingify.com
Source: sets.json.0.dr	String found in binary or memory: https://wordle.at
Source: sets.json.0.dr	String found in binary or memory: https://wp.pl
Source: sets.json.0.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.0.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.0.dr	String found in binary or memory: https://ya.ru
Source: sets.json.0.dr	String found in binary or memory: https://zalo.me
Source: sets.json.0.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://zingmp3.vn

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 62879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_3320_1394265754

Jump to behavior

Source: classification engine

Classification label: mal56.win@17/27@6/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1996,i,14774615609112291354,10908193720494069642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://support-ads-team-34d19.firebaseapp.com/form-2122.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1996,i,14774615609112291354,10908193720494069642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://support-ads-team-34d19.firebaseapp.com/form-2122.html	0%	Avira URL Cloud	safe
https://support-ads-team-34d19.firebaseapp.com/form-2122.html	20%	Virustotal		Browse
https://support-ads-team-34d19.firebaseapp.com/form-2122.html	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://wieistmeineip.de	0%	URL Reputation	safe
https://gliadomain.com	0%	URL Reputation	safe
https://nourishingpursuits.com	0%	URL Reputation	safe
https://songstats.com	0%	URL Reputation	safe
https://mystudentdashboard.com	0%	URL Reputation	safe
https://songshare.com	0%	URL Reputation	safe
https://cardsayings.net	0%	URL Reputation	safe
https://salemovetravel.com	0%	URL Reputation	safe
https://welt.de	0%	URL Reputation	safe
https://cafemedia.com	0%	URL Reputation	safe
https://landyrev.com	0%	URL Reputation	safe
https://salemovefinancial.com	0%	URL Reputation	safe
https://mercadoshops.com.co	0%	Avira URL Cloud	safe
https://landyrev.ru	0%	URL Reputation	safe
https://mercadolivre.com	0%	Avira URL Cloud	safe
https://poalim.xyz	0%	Avira URL Cloud	safe
https://medonet.pl	0%	Avira URL Cloud	safe
https://reshim.org	0%	Avira URL Cloud	safe
https://unotv.com	0%	Avira URL Cloud	safe
https://mercadoshops.com.br	0%	Avira URL Cloud	safe
https://medonet.pl	0%	Virustotal		Browse
https://reshim.org	0%	Virustotal		Browse
https://mercadoshops.com.br	0%	Virustotal		Browse
https://poalim.xyz	0%	Virustotal		Browse
https://joyreactor.cc	0%	Avira URL Cloud	safe
https://joyreactor.cc	1%	Virustotal		Browse
https://baomoi.com	0%	Avira URL Cloud	safe
https://zdrowietvn.pl	0%	Avira URL Cloud	safe
https://supereva.it	0%	Avira URL Cloud	safe
https://elfinancierocr.com	0%	Avira URL Cloud	safe
https://bolasport.com	0%	Avira URL Cloud	safe
https://mercadolivre.com	0%	Virustotal		Browse
https://baomoi.com	0%	Virustotal		Browse
https://unotv.com	0%	Virustotal		Browse
https://zdrowietvn.pl	0%	Virustotal		Browse
https://rws1nvtvt.com	0%	Avira URL Cloud	safe
https://elfinancierocr.com	0%	Virustotal		Browse
https://rws1nvtvt.com	0%	Virustotal		Browse
https://supereva.it	0%	Virustotal		Browse
https://desimartini.com	1%	Virustotal		Browse
https://mercadoshops.com.co	0%	Virustotal		Browse
https://bolasport.com	0%	Virustotal		Browse
https://hearty.gift	0%	Virustotal		Browse
https://desimartini.com	0%	Avira URL Cloud	safe
https://hearty.app	1%	Virustotal		Browse
https://hearty.app	0%	Avira URL Cloud	safe
https://hearty.gift	0%	Avira URL Cloud	safe
https://heartymail.com	0%	Avira URL Cloud	safe
https://radio2.be	0%	Avira URL Cloud	safe
https://mercadoshops.com	0%	Avira URL Cloud	safe
https://support-ads-team-34d19.firebaseapp.com/resources/bg.jpeg	0%	Avira URL Cloud	safe
https://finn.no	0%	Avira URL Cloud	safe
https://hc1.com	0%	Avira URL Cloud	safe
https://kompas.tv	0%	Avira URL Cloud	safe
https://mercadoshops.com	0%	Virustotal		Browse
https://heartymail.com	0%	Virustotal		Browse
https://mercadopago.com.mx	0%	Avira URL Cloud	safe
https://radio2.be	0%	Virustotal		Browse
https://talkdeskqaid.com	0%	Avira URL Cloud	safe
https://mercadopago.com.pe	0%	Avira URL Cloud	safe
https://finn.no	0%	Virustotal		Browse
https://hc1.com	0%	Virustotal		Browse
https://mightytext.net	0%	Avira URL Cloud	safe
https://mercadopago.com.mx	0%	Virustotal		Browse
https://support-ads-team-34d19.firebaseapp.com/logo192.png	0%	Avira URL Cloud	safe
https://talkdeskqaid.com	0%	Virustotal		Browse
https://pudelek.pl	0%	Avira URL Cloud	safe
https://joyreactor.com	0%	Avira URL Cloud	safe
https://mercadopago.com.pe	0%	Virustotal		Browse
https://cookreactor.com	0%	Avira URL Cloud	safe
https://wildixin.com	0%	Avira URL Cloud	safe
https://eworkbookcloud.com	0%	Avira URL Cloud	safe
https://mightytext.net	0%	Virustotal		Browse
https://joyreactor.com	0%	Virustotal		Browse
https://nacion.com	0%	Avira URL Cloud	safe
https://chennien.com	0%	Avira URL Cloud	safe
https://wildixin.com	0%	Virustotal		Browse
https://eworkbookcloud.com	0%	Virustotal		Browse
https://mercadopago.cl	0%	Avira URL Cloud	safe
https://kompas.tv	0%	Virustotal		Browse
https://talkdeskstgid.com	0%	Avira URL Cloud	safe
https://nacion.com	0%	Virustotal		Browse
https://cookreactor.com	0%	Virustotal		Browse
https://pudelek.pl	0%	Virustotal		Browse
https://bonvivir.com	0%	Avira URL Cloud	safe
https://carcostadvisor.be	0%	Avira URL Cloud	safe
https://sapo.io	0%	Avira URL Cloud	safe
https://wpext.pl	0%	Avira URL Cloud	safe
https://chennien.com	0%	Virustotal		Browse
https://poalim.site	0%	Avira URL Cloud	safe
https://blackrockadvisorelite.it	0%	Avira URL Cloud	safe
https://mercadopago.cl	0%	Virustotal		Browse
https://mercadoshops.com.ar	0%	Avira URL Cloud	safe
https://elpais.uy	0%	Avira URL Cloud	safe
https://commentcamarche.com	0%	Avira URL Cloud	safe
https://carcostadvisor.be	0%	Virustotal		Browse
https://tucarro.com.ve	0%	Avira URL Cloud	safe
https://talkdeskstgid.com	0%	Virustotal		Browse
https://rws3nvtvt.com	0%	Avira URL Cloud	safe
https://eleconomista.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
support-ads-team-34d19.firebaseapp.com	199.36.158.100	true	false	unknown
www.google.com	142.250.185.132	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://support-ads-team-34d19.firebaseapp.com/resources/bg.jpeg	false	Avira URL Cloud: safe	unknown
https://support-ads-team-34d19.firebaseapp.com/form-2122.html	true		unknown
https://support-ads-team-34d19.firebaseapp.com/logo192.png	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://wieistmeineip.de	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.co	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://gliadomain.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://poalim.xyz	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mercadolivre.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://reshim.org	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nourishingpursuits.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://medonet.pl	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://unotv.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mercadoshops.com.br	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://joyreactor.cc	sets.json.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://zdrowietvn.pl	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://songstats.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://baomoi.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://supereva.it	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://elfinancierocr.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bolasport.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://rws1nvtvt.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://desimartini.com	sets.json.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://hearty.app	sets.json.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://hearty.gift	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mercadoshops.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://heartymail.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://radio2.be	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://finn.no	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://hc1.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://kompas.tv	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mystudentdashboard.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://songshare.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadopago.com.mx	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://talkdeskqaid.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mercadopago.com.pe	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cardsayings.net	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mightytext.net	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pudelek.pl	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://joyreactor.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cookreactor.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wildixin.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://eworkbookcloud.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nacion.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chennien.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mercadopago.cl	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://talkdeskstgid.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bonvivir.com	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://carcostadvisor.be	sets.json.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://salemovetravel.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://sapo.io	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://wpext.pl	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://welt.de	sets.json.0.dr	false	URL Reputation: safe	unknown
https://poalim.site	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://blackrockadvisorelite.it	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://cafemedia.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.ar	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://elpais.uy	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://landyrev.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://commentcamarche.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://tucarro.com.ve	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://rws3nvtvt.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://eleconomista.net	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadolivre.com.br	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://clmbtech.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://standardsandpraiserepurpose.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://salemovefinancial.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadopago.com.br	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://commentcamarche.net	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://etfacademy.it	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mighty-app.appspot.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://hj.rs	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://hearty.me	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadolibre.com.gt	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://timesinternet.in	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://idbs-staging.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://blackrock.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://idbs-eworkbook.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadolibre.co.cr	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://hjck.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://vrt.be	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://prisjakt.no	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://kompas.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://idbs-dev.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://wingify.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadolibre.cl	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://player.pl	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadopago.com.ar	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadolibre.com.hn	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://linternaute.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://tucarro.com.co	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://landyrev.ru	sets.json.0.dr	false	URL Reputation: safe	unknown
https://clarosports.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://een.be	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://nien.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://punjabijagran.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://cmxd.com.mx	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://tolteck.app	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://grupolpg.sv	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://rws2nvtvt.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://abczdrowie.pl	sets.json.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
199.36.158.100	support-ads-team-34d19.firebaseapp.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447588
Start date and time:	2024-05-26 00:59:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://support-ads-team-34d19.firebaseapp.com/form-2122.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@17/27@6/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 172.217.16.142, 74.125.206.84, 34.104.35.123, 142.250.185.74, 142.250.184.234, 142.250.185.170, 172.217.16.202, 216.58.206.74, 142.250.186.170, 142.250.186.138, 142.250.184.202, 216.58.206.42, 172.217.23.106, 142.250.185.234, 172.217.18.10, 216.58.212.138, 142.250.185.106, 142.250.186.106, 142.250.185.138, 20.114.59.183, 199.232.210.172, 192.229.221.95, 20.166.126.56, 20.242.39.171, 216.58.206.67
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, wu-b-net.trafficmanager.net, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: https://support-ads-team-34d19.firebaseapp.com/form-2122.html Model: Perplexity: mixtral-8x7b-instruct	```json { "loginform": false, "reasons": [ "There is no 'username' or 'email' field in the form.", "There is no 'password' field in the form.", "There is no 'submit' or 'login' button in the form." ] }
m Meta Business Help Centre Get support resources Business Help CHItre Get Support Get Started We have received multiple reports that suggest that pur account has been in violation of our terms of services and community guidelines. As a result, your account is scheduled for review Report no: 2859599362 Please provide us information that will help us investigate Full Name Business Email Address

Input

Output

URL: https://support-ads-team-34d19.firebaseapp.com/form-2122.html Model: Perplexity: mixtral-8x7b-instruct

```json
{
  "loginform": false,
  "reasons": [
    "There is no 'username' or 'email' field in the form.",
    "There is no 'password' field in the form.",
    "There is no 'submit' or 'login' button in the form."
  ]
}

m Meta Business Help Centre Get support resources Business Help CHItre Get Support Get Started We have received multiple reports that suggest that pur account has been in violation of our terms of services and community guidelines. As a result, your account is scheduled for review Report no: 2859599362 Please provide us information that will help us investigate Full Name Business Email Address

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	low
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.011074928584453
Encrypted:	false
SSDEEP:	48:p/hUI1OJi9beAdIih7ak7nEGfpSVzTuc3h0k0Qc/Il:RnODQIK7aRGIVzT7x0FQcS
MD5:	55FAB119C4B25E3B96B68A1412A400B6
SHA1:	BDDA56C51ADEBE8ED0E92658B5020186270085B5
SHA-256:	6DDD430EC4522578FC545E37B7811B740AE9BAE80EBCDBE44ABEF6289B82E2EB
SHA-512:	9833E793F611C0D2160862408935704096DA1D578849C2B89F0C99CF11D3B9B5CDADFAB8CE3CB95E2BAB0EBC832C3A31E18DC1887CE13ABC2B4F9A8669FB72F0
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJqckFSLVVIVm9rYzFLekFkLUhNQTBJZ2RmbEQ5X1J3M3ppLUYzUGxHU1pvIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiQWJUeGNVWWl0ZnVkSnA5NmJ5OGVYQWZEUUpxX3NHWjdVN3hHUnRiaTM2ayJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC41LjIxLjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"DJUEsHDAI0AGK3w3jfw5scOk3HjHnjZ4gxIBDB4YnKUhSi9AvwoibuHc-JTjNxXq4H3u0Mm1kxrYSzJkg_shtc_vtgqBbzDPJxy_eCsqtWMErjzYm8ixkrqZGI4848kNexGROP-eEaLsIEpjFAqVqlWiEgETzbJxgELBWKSOwGGsUGMhx9Op6bhb7wuBVJkq5_H1aksmXJg49Oc6EJj6HSaR4EapNnEcQ8WO7Mj6udA--b6JBVrEOBl

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9163360835085737
Encrypted:	false
SSDEEP:	3:SVOSUQDGAYHXQDJdXVBXHEBGzmyAdV9GA:SV4W/XVBUBXdOA
MD5:	224A1E3D38F496B70BB0A38D237F8FCE
SHA1:	FBC6B5A7C15349EE150549276F58B71674C05513
SHA-256:	1538B4C21BDABACD90069B3EFC35E1FA898694695BCC136B08A2586005645A2D
SHA-512:	A14A6A97C04593427C0D66B5F8D0892AB0887B17CA578B4A283C0625DC9949016BD7D69741BF18E16B94A15BB53021772B5DFF1F6195AA995242482266C8BB20
Malicious:	false
Reputation:	low
Preview:	1.046a7153ace40b4c1fcb2423ffdd0bda38820d2bade6aa5ab6929fe80e4acea3

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.447544204264198
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1gLian:F6VlM8aRWpqS1gLia
MD5:	F67F1900F79CA094D0FC2182B79E7A60
SHA1:	B0C783FB7F8985C82313C2AC4606A820FFEE7C4B
SHA-256:	8EB011F941D5A247352B301DF87300D0881D7E50FDFD1C37CE2F85DCF946499A
SHA-512:	CD1F6C7B717156BE99247CA581F982246B55F419307E4222191F623BE09F5FB2EF6F881EA4BCE0C0DE23BE3F6FCE4D0DE06E66CF2311FCD6FD097C33DF380EE3
Malicious:	false
Reputation:	low
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.5.21.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8141
Entropy (8bit):	4.6184691591564295
Encrypted:	false
SSDEEP:	96:Mon4mdqX1gs1/BNKLcxbdmf56G8RTGXvcxyuP+8qJq:v7qljBkIVDRTGXvcxNsq
MD5:	B63AD3A7023C80F4D2D24BF4AC4145B7
SHA1:	582BFCD098EB6E63B5420F19A81CD3C04D5CD945
SHA-256:	86DFE2A9896CA7CAD92BD313A27ED185339D0E4729EDAEB95C1D6A2CBEBB79AA
SHA-512:	1DE2B098A7C1DC4F12E4DB514960A2366DA0D0672618AD4462D72D25C66D2D81FF02D4CA26FF78FED011CB6A38F2FDA054297EA619EC4662021420ECB64912BA
Malicious:	false
Reputation:	low
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://elpais.com.uy","associatedSites":["https://clubelpais.com.uy","https://paula.com.uy","https://gallito.com.uy"],"ccTLDs":{"https://elpais.com.uy":["https://elpais.uy"]}}.{"primary":"https:/

Chrome Cache Entry: 51

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	7.755237078744874
Encrypted:	false
SSDEEP:	24:27/6LIt7/Z3BJhiEcprbLFKllo3e969YZFzIRE0P6vJL5zMeM/w19:27/6Et7xxvcAo3e9sYZFzIO0S3TMW9
MD5:	2A2B3DCCDA589896E35CC3C75F3B5998
SHA1:	DD0B5969D6826938DA808650E2FA08CB359BEF3B
SHA-256:	AB50A5D6C1ADAAB85FBF6C44DF694A3A0686A0BBE30EC0F67766DE676A370DC7
SHA-512:	541A8313E026DFF6DD3FB1678EFAFF0695981BD6BEB7274C4A67D2EDB3A81B16FA674EBBBC53003BCB9717B289CFD69E4B0934AC277EF4948ECFA4A8D87485FF
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....pHYs.................IDATx..V[..e..z.....P\|..z.Z}P.,.\|iEP.].....f7..f...?....EEQ.b.}R....u_.A.......\6..ds..g.#.'..l2../..{.....9.....c.7x.1xR.../...'1.....r;$M../@.^..N..N.+..O..j.&A_.....r.@>.@...F. k/C.:d.../..#.'.I/.......\|..R.&>...9,l..9$..wqo.(\|...]..}.....e~.......Py...C....~@R....+./.l.P!..G.3...e!.?{..d.<..D .4.L.."Z....?...E7..%..I;k.D..v....O.T.LN.>.it...N..F...3%.b. ....&L..m&b[.........._0I;.[.,<e.(."E.K...z.d~....Z...a.......B.?.....pu..12..6+....$.E.....C.P.2..41W..5.{...\|.z...a.B.....I...........N..!Z..5.E.o..g/._..V5..M.k.w....IX.#..k3...=.g.x....w#V'....W.....I..B.......h-.V.....z...\|...........b.XCt.\|6.1c..a.~...[..c@...r.L..,.+0n......0...e..!.y....r.H*'...XQ....$.;!.i .>7..H.0...0`...........[....u]..~.$....=.s.7M....x.a....8.....w..~c..t#d..m....;...b......Km.%.....f.7d}m.3.._.+s.....Y...,.T.@....`...3..`..[......!.....:....g-.-.6aE5Zl.....6.....yv.D....c...{.h.....d..A.&..

Chrome Cache Entry: 52

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	5347
Entropy (8bit):	7.94375880473395
Encrypted:	false
SSDEEP:	96:gMgJkzj81lSl2dxYAYKsHHVIqApHGoKf4slNb6LQbTehYx5AtKAdmTRwy/Ik2k3:gMct0nKsUwXTbnkeAMA+Twkv
MD5:	33DBDD0177549353EEEB785D02C294AF
SHA1:	7F4F2D68782A7FAFCEDA84554ECAB9B489877500
SHA-256:	C386396EC70DB3608075B5FBFAAC4AB1CCAA86BA05A68AB393EC551EB66C3E00
SHA-512:	E34572CF754FF7E1D0ACB12D8275252230AD1DD9ADC5858E807FEF0FB61AEA82CB1F9CA3EBAB3EEB449460373140105F8D773E7BDDBF6745F9E81CC1546621F4
Malicious:	false
Reputation:	low
URL:	https://support-ads-team-34d19.firebaseapp.com/logo192.png
Preview:	.PNG........IHDR.............e..5....PLTE...d..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..`..a..a..a..a..a..a..a..`..a..a..a..a..a..a..a..a..a..a..a..f..a..c..e..h..H.....'tRNS...#..,..._....E..L..n?X.4Qg.yt.:.....!.....IDATx..[.r.0....l..;>...i...?_-,.)........L'......o..o..o..o..o.x-..F?......&.?B.Y.>....MO.q.......8.r....1.O..'....<...x...h.>.[.q.@L...)...."7....$.../..I.k....T.w...O.V...B8..O_....YI..... .e....0.5SH....\|.../..e8=vbu.\5.......}7r..l.h.O..O.p'8?i.3..O.-....6...CS..3.u..qHc6I..)(........k..LV.....#...,<....t.pz......!...YQ.yZ...C:.a.x.D....\|.\....M.Q..4.6.b..O9.Q.X......wt3...~..0........@..K..d.[T..r..k...@.O.X6$..J........,5....F..#.0._o...Iy....S.....>m..K9%..m.9.W..VJ..uX..Cc...p..+.".......>..)>x..!".#s3...d.'.....4{...H.n..fP......#.....8C.b..."......\@...F...P..Mul..v.&.....2...n~..P#..g.L.......K..7C....IO.--......I..)@.`'..KOY....2r?.C...C(..8....7...M\|68....y........D.U:R.......7.G..W..mT#t...;..[..

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1059
Entropy (8bit):	7.755237078744874
Encrypted:	false
SSDEEP:	24:27/6LIt7/Z3BJhiEcprbLFKllo3e969YZFzIRE0P6vJL5zMeM/w19:27/6Et7xxvcAo3e9sYZFzIO0S3TMW9
MD5:	2A2B3DCCDA589896E35CC3C75F3B5998
SHA1:	DD0B5969D6826938DA808650E2FA08CB359BEF3B
SHA-256:	AB50A5D6C1ADAAB85FBF6C44DF694A3A0686A0BBE30EC0F67766DE676A370DC7
SHA-512:	541A8313E026DFF6DD3FB1678EFAFF0695981BD6BEB7274C4A67D2EDB3A81B16FA674EBBBC53003BCB9717B289CFD69E4B0934AC277EF4948ECFA4A8D87485FF
Malicious:	false
Reputation:	low
URL:	https://support-ads-team-34d19.firebaseapp.com/resources/logo.png
Preview:	.PNG........IHDR... ... .....szz.....pHYs.................IDATx..V[..e..z.....P\|..z.Z}P.,.\|iEP.].....f7..f...?....EEQ.b.}R....u_.A.......\6..ds..g.#.'..l2../..{.....9.....c.7x.1xR.../...'1.....r;$M../@.^..N..N.+..O..j.&A_.....r.@>.@...F. k/C.:d.../..#.'.I/.......\|..R.&>...9,l..9$..wqo.(\|...]..}.....e~.......Py...C....~@R....+./.l.P!..G.3...e!.?{..d.<..D .4.L.."Z....?...E7..%..I;k.D..v....O.T.LN.>.it...N..F...3%.b. ....&L..m&b[.........._0I;.[.,<e.(."E.K...z.d~....Z...a.......B.?.....pu..12..6+....$.E.....C.P.2..41W..5.{...\|.z...a.B.....I...........N..!Z..5.E.o..g/._..V5..M.k.w....IX.#..k3...=.g.x....w#V'....W.....I..B.......h-.V.....z...\|...........b.XCt.\|6.1c..a.~...[..c@...r.L..,.+0n......0...e..!.y....r.H*'...XQ....$.;!.i .>7..H.0...0`...........[....u]..~.$....=.s.7M....x.a....8.....w..~c..t#d..m....;...b......Km.%.....f.7d}m.3.._.+s.....Y...,.T.@....`...3..`..[......!.....:....g-.-.6aE5Zl.....6.....yv.D....c...{.h.....d..A.&..

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x175, components 3
Category:	dropped
Size (bytes):	80630
Entropy (8bit):	7.927891543874801
Encrypted:	false
SSDEEP:	1536:HZ3ox6rWCQwqxWtu3PEUvOdISL4u+bLQYsieGGYeDasF:HZTqCjs4u/hOdxBIj5CF
MD5:	49A366B72644F04EA8EFCCF9550FB0A5
SHA1:	54492AA337FC8EE34297A04FD789D202FBA78D58
SHA-256:	289D99B21FAE145C868238C0C499DCF8E84BEA445B63E47E3406ACFE98E20A34
SHA-512:	4960EF185ED8BF68C72F1F6BC97D1EA83347174BF3823243CEF738BAC33069E302FD1B4850A89F554D08544F4ED206713A3B6CA8A4B2F2E6F4B2374AFC49D71F
Malicious:	false
Reputation:	low
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5347
Entropy (8bit):	7.94375880473395
Encrypted:	false
SSDEEP:	96:gMgJkzj81lSl2dxYAYKsHHVIqApHGoKf4slNb6LQbTehYx5AtKAdmTRwy/Ik2k3:gMct0nKsUwXTbnkeAMA+Twkv
MD5:	33DBDD0177549353EEEB785D02C294AF
SHA1:	7F4F2D68782A7FAFCEDA84554ECAB9B489877500
SHA-256:	C386396EC70DB3608075B5FBFAAC4AB1CCAA86BA05A68AB393EC551EB66C3E00
SHA-512:	E34572CF754FF7E1D0ACB12D8275252230AD1DD9ADC5858E807FEF0FB61AEA82CB1F9CA3EBAB3EEB449460373140105F8D773E7BDDBF6745F9E81CC1546621F4
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............e..5....PLTE...d..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..`..a..a..a..a..a..a..a..`..a..a..a..a..a..a..a..a..a..a..a..f..a..c..e..h..H.....'tRNS...#..,..._....E..L..n?X.4Qg.yt.:.....!.....IDATx..[.r.0....l..;>...i...?_-,.)........L'......o..o..o..o..o.x-..F?......&.?B.Y.>....MO.q.......8.r....1.O..'....<...x...h.>.[.q.@L...)...."7....$.../..I.k....T.w...O.V...B8..O_....YI..... .e....0.5SH....\|.../..e8=vbu.\5.......}7r..l.h.O..O.p'8?i.3..O.-....6...CS..3.u..qHc6I..)(........k..LV.....#...,<....t.pz......!...YQ.yZ...C:.a.x.D....\|.\....M.Q..4.6.b..O9.Q.X......wt3...~..0........@..K..d.[T..r..k...@.O.X6$..J........,5....F..#.0._o...Iy....S.....>m..K9%..m.9.W..VJ..uX..Cc...p..+.".......>..)>x..!".#s3...d.'.....4{...H.n..fP......#.....8C.b..."......\@...F...P..Mul..v.&.....2...n~..P#..g.L.......K..7C....IO.--......I..)@.`'..KOY....2r?.C...C(..8....7...M\|68....y........D.U:R.......7.G..W..mT#t...;..[..

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	76
Entropy (8bit):	4.001107291699522
Encrypted:	false
SSDEEP:	3:xPVxHq/ZoS8/ZoS8/ZoS8/ZoS8/ZYn:xPfq/ZoS8/ZoS8/ZoS8/ZoS8/ZYn
MD5:	517CF64F971D792459C3A4B7B7368D3A
SHA1:	E3FA557E25AF115F018C8271FCE18BB8E5386B82
SHA-256:	8272371C3F057018D41BB14B113AAC647FB565B979CA00D36DEB797FDC8F1699
SHA-512:	93ABE77769A6A7E945AAE773F8D0C6954F040E21B4CD20FD56F3A85FE94A9018784638D0E5995053266B79F90DC03FC37D13FC512490C0090E91EA00869650C0
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISMwnhVUVNOM0Z_RIFDQbtu_8SBQ2RYZVOEgUNkWGVThIFDZFhlU4SBQ2RYZVOEgUNkWGVTg==?alt=proto
Preview:	CjYKBw0G7bv/GgAKBw2RYZVOGgAKBw2RYZVOGgAKBw2RYZVOGgAKBw2RYZVOGgAKBw2RYZVOGgA=

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1442)
Category:	downloaded
Size (bytes):	1487
Entropy (8bit):	4.8428306320196715
Encrypted:	false
SSDEEP:	24:3q8hDcB3uMtn5dO8TCApdIJqNrOPU2949gp8wSNnvwAYkK1xdy91y:aGDc1ug5dOMCApXxW4A8nnvwAYkK1xE0
MD5:	F7FE5F142762F6CAEE59D02A6F92B7F4
SHA1:	10384147F38624C5D9F44E29EB5FBCD21600099F
SHA-256:	9964BB16E547C603E06CCEAC21797209E559CF53346862C2CAB9C184ECF020DE
SHA-512:	513E14E331A5018F1AC37F574109F035A5A8891466B5D9C91F4D451E14F3D86623587D463F6BC10B03AB6FBA0F9A0258623AAF6917D5A37D304F2BE7CAF394CA
Malicious:	false
Reputation:	low
URL:	https://support-ads-team-34d19.firebaseapp.com/static/css/main.4dd8a724.css
Preview:	body{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;font-family:Helvetica;margin:0}code{font-family:source-code-pro,Menlo,Monaco,Consolas,Courier New,monospace}div .card{font-feature-settings:normal;word-wrap:break-word;background-attachment:scroll;background-color:#fff;background-image:none;background-position:0 0;background-repeat:repeat;border:0 #050505;border-bottom-left-radius:10px;border-bottom-right-radius:10px;border-collapse:initial;border-spacing:0;border-top-left-radius:10px;border-top-right-radius:10px;bottom:0;box-shadow:0 1px 2px 0 #0003;box-sizing:border-box;caption-side:top;clear:none;color:#050505;cursor:auto;display:flex;empty-cells:show;float:none;font-family:Helvetica;font-size:16px;font-style:normal;font-variant:normal;font-weight:400;height:1037.28px;left:0;letter-spacing:normal;line-height:24px;list-style-image:none;list-style-position:outside;list-style-type:disc;margin:60px 0 30px;max-height:none;max-width:none;min-height:0;min-width:0;out

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1262), with no line terminators
Category:	downloaded
Size (bytes):	1262
Entropy (8bit):	4.967934967339903
Encrypted:	false
SSDEEP:	24:0E0FKqsdZmqV7Q2jSCzBBCzB7cIAucIOaGaMdxClVqAC75j2a:0ElRTmqV7Q2jTzBEzBrAGO17C6AC7Rf
MD5:	2F8B89A474D0D13C0E99EDAC16D613CA
SHA1:	2470C211247F03D634F7CA0E2C3916C210DD3673
SHA-256:	1CADA385BC633B9F2B657941644BBF51D420BC30953CCEAAA68B0971EEB13BBE
SHA-512:	97548B316AE3BE26C8933F135DCE8304D69A5A75ABA20E71CEFC929DD66220EA8F03A89507C7F0005039BA9CD0C1A324B3160300672860601EB3CE3C5828D933
Malicious:	false
Reputation:	low
URL:	https://support-ads-team-34d19.firebaseapp.com/form-2122.html
Preview:	<!doctype html><html lang="en"><head><meta charset="utf-8"/><title>Meta for Business - Page Appeal</title><meta http-equiv="content-type" content="text/html; charset=UTF-8"/><meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"/><meta property="og:type" content="website"/><meta property="twitter:type" content="website"/><link href="./resources/logo.png" rel="shortcut icon"/><meta property="og:url" content="/meta-community-standard"/><meta property="twitter:url" content="/meta-community-standard"/><meta property="og:title" content="Meta Business Help Centre - Page Appeal"/><meta property="twitter:title" content="Meta Business Help Centre - Page Appeal"/><meta property="og:image" content="./static/uploads/block_images/1c325477ab8db1be14392399bff625fc.png"/><meta property="twitter:image" content="./static/uploads/block_images/1c325477ab8db1be14392399bff625fc.png"/><link rel="apple-touch-icon" href="/logo192.png"/><link rel="manifest" href="/manifest.json"/><t

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x175, components 3
Category:	downloaded
Size (bytes):	80630
Entropy (8bit):	7.927891543874801
Encrypted:	false
SSDEEP:	1536:HZ3ox6rWCQwqxWtu3PEUvOdISL4u+bLQYsieGGYeDasF:HZTqCjs4u/hOdxBIj5CF
MD5:	49A366B72644F04EA8EFCCF9550FB0A5
SHA1:	54492AA337FC8EE34297A04FD789D202FBA78D58
SHA-256:	289D99B21FAE145C868238C0C499DCF8E84BEA445B63E47E3406ACFE98E20A34
SHA-512:	4960EF185ED8BF68C72F1F6BC97D1EA83347174BF3823243CEF738BAC33069E302FD1B4850A89F554D08544F4ED206713A3B6CA8A4B2F2E6F4B2374AFC49D71F
Malicious:	false
Reputation:	low
URL:	https://support-ads-team-34d19.firebaseapp.com/resources/bg.jpeg
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	12365
Entropy (8bit):	4.803838886244832
Encrypted:	false
SSDEEP:	192:azZL7+d/uGmeNM0mIb1L9d22PJ20De7SIpFJ8+u5l:azUd/DOB+xwIJ20DeDpF2nl
MD5:	1F409A28ABF39A2F1E8A1D07E7FDAC67
SHA1:	4151A28CA709C054BB24F16802E1C66302716EB6
SHA-256:	1BCE6BCD554CF223149803A9902378F6D66DD914E5D6C3943182348535711D27
SHA-512:	6CC8EBF56298E071D7CC57E7F7AD9818272B41517AFA043FAABE4683BB6A61ADB286D6902E589E89D8DA9EC81884CAEC3E8143C41107D30E8B665C8A2F7F135D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.<svg width="53" height="12" viewBox="0 0 53 12" fill="none" xmlns="http://www.w3.org/2000/svg">.<g clip-path="url(#clip0_1165_19382)">.<path d="M19.5823 1.0094H21.5542L24.9073 7.17994L28.2603 1.0094H30.1896V11.1487H28.5807V3.3777L25.6406 8.7588H24.1313L21.1912 3.3777V11.1487H19.5823V1.0094Z" fill="#1C2B33"/>.<path d="M35.3792 11.3299C34.634 11.3299 33.9791 11.1621 33.4144 10.8265C32.8495 10.491 32.4093 10.0262 32.0938 9.43236C31.7781 8.83846 31.6203 8.15767 31.6204 7.39C31.6204 6.61269 31.7746 5.92466 32.0831 5.32591C32.3916 4.72729 32.8199 4.25893 33.3681 3.92084C33.9163 3.58296 34.5463 3.41397 35.2582 3.41388C35.9653 3.41388 36.574 3.58407 37.0842 3.92444C37.5943 4.26491 37.987 4.74172 38.2624 5.35486C38.5376 5.96809 38.6752 6.68751 38.6753 7.51311V7.96207H33.215C33.3147 8.58021 33.5603 9.06666 33.9519 9.42144C34.3434 9.77634 34.8382 9.95377 35.4361 9.95374C35.9155 9.95374 36.3284 9.88132 36.6749 9.73647C37.0212 9.59163 37.3464 9.37196 37.6502 9

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	12365
Entropy (8bit):	4.803838886244832
Encrypted:	false
SSDEEP:	192:azZL7+d/uGmeNM0mIb1L9d22PJ20De7SIpFJ8+u5l:azUd/DOB+xwIJ20DeDpF2nl
MD5:	1F409A28ABF39A2F1E8A1D07E7FDAC67
SHA1:	4151A28CA709C054BB24F16802E1C66302716EB6
SHA-256:	1BCE6BCD554CF223149803A9902378F6D66DD914E5D6C3943182348535711D27
SHA-512:	6CC8EBF56298E071D7CC57E7F7AD9818272B41517AFA043FAABE4683BB6A61ADB286D6902E589E89D8DA9EC81884CAEC3E8143C41107D30E8B665C8A2F7F135D
Malicious:	false
Reputation:	low
URL:	https://support-ads-team-34d19.firebaseapp.com/resources/meta.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.<svg width="53" height="12" viewBox="0 0 53 12" fill="none" xmlns="http://www.w3.org/2000/svg">.<g clip-path="url(#clip0_1165_19382)">.<path d="M19.5823 1.0094H21.5542L24.9073 7.17994L28.2603 1.0094H30.1896V11.1487H28.5807V3.3777L25.6406 8.7588H24.1313L21.1912 3.3777V11.1487H19.5823V1.0094Z" fill="#1C2B33"/>.<path d="M35.3792 11.3299C34.634 11.3299 33.9791 11.1621 33.4144 10.8265C32.8495 10.491 32.4093 10.0262 32.0938 9.43236C31.7781 8.83846 31.6203 8.15767 31.6204 7.39C31.6204 6.61269 31.7746 5.92466 32.0831 5.32591C32.3916 4.72729 32.8199 4.25893 33.3681 3.92084C33.9163 3.58296 34.5463 3.41397 35.2582 3.41388C35.9653 3.41388 36.574 3.58407 37.0842 3.92444C37.5943 4.26491 37.987 4.74172 38.2624 5.35486C38.5376 5.96809 38.6752 6.68751 38.6753 7.51311V7.96207H33.215C33.3147 8.58021 33.5603 9.06666 33.9519 9.42144C34.3434 9.77634 34.8382 9.95377 35.4361 9.95374C35.9155 9.95374 36.3284 9.88132 36.6749 9.73647C37.0212 9.59163 37.3464 9.37196 37.6502 9

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	492
Entropy (8bit):	4.508040222190771
Encrypted:	false
SSDEEP:	6:3vjkpO/Eqh/bwXLjQLMzmezk7TWKAKLkmXrdEJqJHGezXXdKLkmXcqJHGez1mjgw:fYDqJeLQq/KvriSdKvqUKV/cDTO
MD5:	D9D975CEBE2EC20B6C652E1E4C12CCF0
SHA1:	4E0AFE7F81A71F41366CD7859CA34776B8107923
SHA-256:	50B3D8C3903AF3F78D871B94557AB14F4E39CA192EACA3D2CFA863C867279A14
SHA-512:	50EF3C4963B89C9DBA094705B6DF105E5C82F8DB708059DF6A48A3F95C43487B7CCBEB9840E7B76074896DB5FB2F1D918326D0CE338220589CD275F9EE79B16C
Malicious:	false
Reputation:	low
URL:	https://support-ads-team-34d19.firebaseapp.com/manifest.json
Preview:	{. "short_name": "React App",. "name": "Create React App Sample",. "icons": [. {. "src": "favicon.ico",. "sizes": "64x64 32x32 24x24 16x16",. "type": "image/x-icon". },. {. "src": "logo192.png",. "type": "image/png",. "sizes": "192x192". },. {. "src": "logo512.png",. "type": "image/png",. "sizes": "512x512". }. ],. "start_url": ".",. "display": "standalone",. "theme_color": "#000000",. "background_color": "#ffffff".}.

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65465)
Category:	downloaded
Size (bytes):	184084
Entropy (8bit):	5.295076241066227
Encrypted:	false
SSDEEP:	3072:sheCX3IKWagdjRw2L52FC69bOor1/rM8QQDg:HCVWag/3seQE
MD5:	31BFEAF2DB133D675D8E75C38E2B96A7
SHA1:	DFDA47A8C99CFBF99404126D2ECF3CFC59C622DA
SHA-256:	49862225946B8439B72285DB4D430EE56C18FEEBE7C16EB1135913DE00478115
SHA-512:	CDC9F743C3130631AD003D0C3A4AD2630EF5AA393D243D54F28C8E1A062E17D8D92A61EFC7E002B346A3AC95E66115F2D07238CC31450A9E0D853D3F4F6371ED
Malicious:	false
Reputation:	low
URL:	https://support-ads-team-34d19.firebaseapp.com/static/js/main.597a1abe.js
Preview:	/! For license information please see main.597a1abe.js.LICENSE.txt /.(()=>{var e={514:(e,t,n)=>{var r;!function(){"use strict";var l=!("undefined"===typeof window\|\|!window.document\|\|!window.document.createElement),a={canUseDOM:l,canUseWorkers:"undefined"!==typeof Worker,canUseEventListeners:l&&!(!window.addEventListener&&!window.attachEvent),canUseViewport:l&&!!window.screen};void 0===(r=function(){return a}.call(t,n,t,e))\|\|(e.exports=r)}()},433:(e,t,n)=>{"use strict";var r=n(530);function l(){}function a(){}a.resetWarningCache=l,e.exports=function(){function e(e,t,n,l,a,o){if(o!==r){var i=new Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw i.name="Invariant Violation",i}}function t(){return e}e.isRequired=e;var n={array:e,bigint:e,bool:e,func:e,number:e,object:e,string:e,symbol:e,any:e,arrayOf:t,element:e,elementType:e,instanceOf:t,node:e,obj

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 26, 2024 01:00:21.049340963 CEST	49675	443	192.168.2.4	173.222.162.32
May 26, 2024 01:00:21.564774990 CEST	49678	443	192.168.2.4	104.46.162.224
May 26, 2024 01:00:28.457159042 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.457204103 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.457251072 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.457556963 CEST	49736	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.457638979 CEST	443	49736	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.457731962 CEST	49736	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.458106995 CEST	49736	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.458142042 CEST	443	49736	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.458250999 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.458265066 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.934236050 CEST	443	49736	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.934608936 CEST	49736	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.934639931 CEST	443	49736	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.935811996 CEST	443	49736	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.935890913 CEST	49736	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.937031984 CEST	49736	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.937109947 CEST	443	49736	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.937244892 CEST	49736	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.948625088 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.949018002 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.949034929 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.952565908 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.952636003 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.953007936 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.953175068 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.978537083 CEST	443	49736	199.36.158.100	192.168.2.4
May 26, 2024 01:00:28.979221106 CEST	49736	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:28.979238987 CEST	443	49736	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.024609089 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.024621010 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.024620056 CEST	49736	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.064876080 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.208884001 CEST	443	49736	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.214092016 CEST	443	49736	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.214589119 CEST	49736	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.215522051 CEST	49736	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.215550900 CEST	443	49736	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.230870008 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.231301069 CEST	49737	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.231340885 CEST	443	49737	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.234527111 CEST	49737	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.234800100 CEST	49737	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.234816074 CEST	443	49737	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.278505087 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.549113035 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.549189091 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.549237013 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.549254894 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.549268007 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.549307108 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.549350023 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.549355984 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.549391031 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.560116053 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.561239958 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.561314106 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.561321974 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.563288927 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.563385963 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.563437939 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.563445091 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.563981056 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.563987970 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.612725973 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.647957087 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.648581982 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.648638964 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.648647070 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.650264025 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.650311947 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.650320053 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.656446934 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.656493902 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.656501055 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.660878897 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.660923004 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.660931110 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.661034107 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.661072969 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.661078930 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.663407087 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.663450956 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.663456917 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.667766094 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.667814970 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.667820930 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.667937994 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.667978048 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.667984009 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.669128895 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.669174910 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.669182062 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.670263052 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.670315981 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.670325041 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.670397997 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.670439005 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.670444012 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.671883106 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.671938896 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.671947002 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.673269033 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.673314095 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.673321009 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.722176075 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.722183943 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.733308077 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.733372927 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.733381033 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.733525991 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.733567953 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.733576059 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.733691931 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.733737946 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.733746052 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.739217043 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.739247084 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.739255905 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.739278078 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.739279032 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.739311934 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.739342928 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.739351034 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.739367962 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.739394903 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.742130995 CEST	443	49737	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.742413044 CEST	49737	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.742433071 CEST	443	49737	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.742933035 CEST	443	49737	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.743257999 CEST	49737	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.743350029 CEST	443	49737	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.743468046 CEST	49737	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.760881901 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.760929108 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.760967970 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.760977983 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.761018038 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.766206980 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.766249895 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.766283035 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.766290903 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.766309023 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.766328096 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.790496111 CEST	443	49737	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.822774887 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.822839022 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.822901964 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.822923899 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.822945118 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.822968960 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.824115992 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.824160099 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.824202061 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.824208021 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.824249983 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.825175047 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.825222015 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.825256109 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.825262070 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.825279951 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.825300932 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.850771904 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.850837946 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.850878000 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.850891113 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.850934982 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.854851007 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.854952097 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.854958057 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.855012894 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.855062008 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.855160952 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.855176926 CEST	443	49735	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.855182886 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.855216026 CEST	49735	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.994169950 CEST	443	49737	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.994990110 CEST	443	49737	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.995048046 CEST	443	49737	199.36.158.100	192.168.2.4
May 26, 2024 01:00:29.995081902 CEST	49737	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.995147943 CEST	49737	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.996953964 CEST	49737	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:29.996988058 CEST	443	49737	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.088342905 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.088362932 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.088995934 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.089729071 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.089740038 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.090217113 CEST	49741	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.090224981 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.090305090 CEST	49741	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.092343092 CEST	49741	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.092354059 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.608987093 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.612565994 CEST	49741	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.612595081 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.613090038 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.614568949 CEST	49741	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.614650965 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.615036964 CEST	49741	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.629153967 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.629630089 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.629637957 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.630651951 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.631062984 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.631213903 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.631728888 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.658396006 CEST	49675	443	192.168.2.4	173.222.162.32
May 26, 2024 01:00:30.658494949 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.674532890 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.814986944 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.815212011 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.815251112 CEST	49741	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.815254927 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.815269947 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.815314054 CEST	49741	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.815551996 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.815933943 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.815975904 CEST	49741	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.815988064 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.816369057 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.816412926 CEST	49741	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.816421032 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.824337959 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.824397087 CEST	49741	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.824958086 CEST	49741	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.824970961 CEST	443	49741	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.891158104 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.891182899 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.891244888 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.892040014 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.892062902 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.924988985 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.941416025 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.941493988 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.941509962 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.941519976 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:30.941551924 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:30.941576004 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.020972013 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.021039009 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.021054983 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.021085024 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.021095991 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.021133900 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.075762033 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.075774908 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.075841904 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.075853109 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.075901985 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.113929033 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.113956928 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.114015102 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.114022970 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.114061117 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.114079952 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.125508070 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.125552893 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.125582933 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.125591040 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.125623941 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.125627995 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.125673056 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.125937939 CEST	49740	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.125950098 CEST	443	49740	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.399859905 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.400151014 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.400162935 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.401034117 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.401091099 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.401459932 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.401520967 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.401693106 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.401701927 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.442425013 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.519754887 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.519804001 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.519829988 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.519855976 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.519876003 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.519927979 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.522553921 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.522663116 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.522703886 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.522712946 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.522929907 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.522972107 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.522979021 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.534852028 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.534905910 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.588496923 CEST	49743	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.588516951 CEST	443	49743	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.589409113 CEST	49744	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.589409113 CEST	49745	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.589442015 CEST	443	49744	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.589451075 CEST	443	49745	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.590665102 CEST	49744	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.590665102 CEST	49745	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.591579914 CEST	49744	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.591579914 CEST	49745	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.591593027 CEST	443	49744	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.591604948 CEST	443	49745	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.601928949 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.601938963 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.602442980 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.604353905 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:31.604363918 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:31.639215946 CEST	49747	443	192.168.2.4	142.250.185.132
May 26, 2024 01:00:31.639246941 CEST	443	49747	142.250.185.132	192.168.2.4
May 26, 2024 01:00:31.639872074 CEST	49747	443	192.168.2.4	142.250.185.132
May 26, 2024 01:00:31.640876055 CEST	49747	443	192.168.2.4	142.250.185.132
May 26, 2024 01:00:31.640891075 CEST	443	49747	142.250.185.132	192.168.2.4
May 26, 2024 01:00:32.085483074 CEST	443	49744	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.098231077 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.103072882 CEST	443	49745	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.126370907 CEST	49744	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.150552988 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.158521891 CEST	49745	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.333925009 CEST	443	49747	142.250.185.132	192.168.2.4
May 26, 2024 01:00:32.378528118 CEST	49747	443	192.168.2.4	142.250.185.132
May 26, 2024 01:00:32.409838915 CEST	49745	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.409838915 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.409857988 CEST	443	49745	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.409873009 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.410106897 CEST	49747	443	192.168.2.4	142.250.185.132
May 26, 2024 01:00:32.410109043 CEST	49744	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.410120010 CEST	443	49744	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.410121918 CEST	443	49747	142.250.185.132	192.168.2.4
May 26, 2024 01:00:32.410343885 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.410355091 CEST	443	49745	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.411514044 CEST	49745	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.411514044 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.411607981 CEST	443	49745	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.411612034 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.411686897 CEST	49745	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.411686897 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.413994074 CEST	443	49744	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.414102077 CEST	443	49747	142.250.185.132	192.168.2.4
May 26, 2024 01:00:32.414154053 CEST	49744	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.414292097 CEST	49747	443	192.168.2.4	142.250.185.132
May 26, 2024 01:00:32.414948940 CEST	49744	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.414948940 CEST	49744	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.414958000 CEST	443	49744	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.415143013 CEST	443	49744	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.454521894 CEST	443	49745	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.454533100 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.454533100 CEST	49745	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.454540014 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.470489979 CEST	49744	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.470495939 CEST	443	49744	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.489449024 CEST	49748	443	192.168.2.4	2.19.104.72
May 26, 2024 01:00:32.489520073 CEST	443	49748	2.19.104.72	192.168.2.4
May 26, 2024 01:00:32.489625931 CEST	49748	443	192.168.2.4	2.19.104.72
May 26, 2024 01:00:32.491107941 CEST	49748	443	192.168.2.4	2.19.104.72
May 26, 2024 01:00:32.491137028 CEST	443	49748	2.19.104.72	192.168.2.4
May 26, 2024 01:00:32.518172026 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.518209934 CEST	49744	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.518379927 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.518708944 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.518716097 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.519680977 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.519778967 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.519944906 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.519951105 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.520258904 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.520472050 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.521259069 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.521486044 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.521742105 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.521748066 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.522021055 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.522110939 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.532495022 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.532726049 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.532731056 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.579602003 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.606240034 CEST	443	49744	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.606527090 CEST	443	49744	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.606647968 CEST	49744	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.612761021 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.612770081 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.612801075 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.612814903 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.612828970 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.612834930 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.612843990 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.612871885 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.612909079 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.623416901 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.623424053 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.623450041 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.623492002 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.623497963 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.623528004 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.623541117 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.680732012 CEST	443	49745	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.689578056 CEST	443	49745	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.689661026 CEST	49745	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.702025890 CEST	49744	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.702047110 CEST	443	49744	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.702191114 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.702219009 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.702280045 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.702287912 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.702330112 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.703044891 CEST	49745	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.703049898 CEST	443	49745	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.704849005 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.704883099 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.704920053 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.704927921 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.704940081 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:32.704967022 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.704984903 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.705173969 CEST	49746	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:32.705178022 CEST	443	49746	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.152142048 CEST	443	49748	2.19.104.72	192.168.2.4
May 26, 2024 01:00:33.152257919 CEST	49748	443	192.168.2.4	2.19.104.72
May 26, 2024 01:00:33.156357050 CEST	49748	443	192.168.2.4	2.19.104.72
May 26, 2024 01:00:33.156369925 CEST	443	49748	2.19.104.72	192.168.2.4
May 26, 2024 01:00:33.156800032 CEST	443	49748	2.19.104.72	192.168.2.4
May 26, 2024 01:00:33.204495907 CEST	49748	443	192.168.2.4	2.19.104.72
May 26, 2024 01:00:33.215456963 CEST	49747	443	192.168.2.4	142.250.185.132
May 26, 2024 01:00:33.215815067 CEST	443	49747	142.250.185.132	192.168.2.4
May 26, 2024 01:00:33.242114067 CEST	49749	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.242147923 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.242346048 CEST	49749	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.243233919 CEST	49749	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.243246078 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.261137009 CEST	49747	443	192.168.2.4	142.250.185.132
May 26, 2024 01:00:33.261143923 CEST	443	49747	142.250.185.132	192.168.2.4
May 26, 2024 01:00:33.313416958 CEST	49747	443	192.168.2.4	142.250.185.132
May 26, 2024 01:00:33.389368057 CEST	49748	443	192.168.2.4	2.19.104.72
May 26, 2024 01:00:33.429192066 CEST	49750	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.429208040 CEST	443	49750	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.429264069 CEST	49750	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.429935932 CEST	49750	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.429945946 CEST	443	49750	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.434499025 CEST	443	49748	2.19.104.72	192.168.2.4
May 26, 2024 01:00:33.568687916 CEST	443	49748	2.19.104.72	192.168.2.4
May 26, 2024 01:00:33.569475889 CEST	443	49748	2.19.104.72	192.168.2.4
May 26, 2024 01:00:33.569551945 CEST	49748	443	192.168.2.4	2.19.104.72
May 26, 2024 01:00:33.575634003 CEST	49748	443	192.168.2.4	2.19.104.72
May 26, 2024 01:00:33.575660944 CEST	443	49748	2.19.104.72	192.168.2.4
May 26, 2024 01:00:33.713566065 CEST	49752	443	192.168.2.4	2.18.97.153
May 26, 2024 01:00:33.713613033 CEST	443	49752	2.18.97.153	192.168.2.4
May 26, 2024 01:00:33.713680983 CEST	49752	443	192.168.2.4	2.18.97.153
May 26, 2024 01:00:33.716299057 CEST	49752	443	192.168.2.4	2.18.97.153
May 26, 2024 01:00:33.716315985 CEST	443	49752	2.18.97.153	192.168.2.4
May 26, 2024 01:00:33.730351925 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.730911970 CEST	49749	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.730925083 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.731426001 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.731942892 CEST	49749	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.732019901 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.732206106 CEST	49749	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.774508953 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.782428980 CEST	49749	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.913156986 CEST	443	49750	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.913542986 CEST	49750	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.913567066 CEST	443	49750	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.914036989 CEST	443	49750	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.914872885 CEST	49750	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.914967060 CEST	443	49750	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.915219069 CEST	49750	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.921778917 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.930514097 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.930599928 CEST	49749	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.930613995 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.933927059 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.934009075 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.934051037 CEST	49749	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.934051037 CEST	49749	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.935957909 CEST	49749	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.935976028 CEST	443	49749	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.962492943 CEST	443	49750	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.970995903 CEST	49753	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.971035957 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:33.971219063 CEST	49753	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.971450090 CEST	49753	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:33.971472025 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.138369083 CEST	443	49750	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.143193960 CEST	443	49750	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.143699884 CEST	49750	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:34.143699884 CEST	49750	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:34.364613056 CEST	443	49752	2.18.97.153	192.168.2.4
May 26, 2024 01:00:34.364722013 CEST	49752	443	192.168.2.4	2.18.97.153
May 26, 2024 01:00:34.366101980 CEST	49752	443	192.168.2.4	2.18.97.153
May 26, 2024 01:00:34.366113901 CEST	443	49752	2.18.97.153	192.168.2.4
May 26, 2024 01:00:34.366441965 CEST	443	49752	2.18.97.153	192.168.2.4
May 26, 2024 01:00:34.367650986 CEST	49752	443	192.168.2.4	2.18.97.153
May 26, 2024 01:00:34.410494089 CEST	443	49752	2.18.97.153	192.168.2.4
May 26, 2024 01:00:34.455842018 CEST	49750	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:34.455871105 CEST	443	49750	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.516976118 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.517376900 CEST	49753	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:34.517390966 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.517915964 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.518421888 CEST	49753	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:34.518493891 CEST	49753	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:34.518521070 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.568197966 CEST	49753	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:34.628055096 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.630889893 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.630944014 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.630951881 CEST	49753	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:34.630966902 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.631021976 CEST	49753	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:34.640772104 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.640853882 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.640906096 CEST	49753	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:34.641052961 CEST	49753	443	192.168.2.4	199.36.158.100
May 26, 2024 01:00:34.641064882 CEST	443	49753	199.36.158.100	192.168.2.4
May 26, 2024 01:00:34.660504103 CEST	443	49752	2.18.97.153	192.168.2.4
May 26, 2024 01:00:34.660567045 CEST	443	49752	2.18.97.153	192.168.2.4
May 26, 2024 01:00:34.660628080 CEST	49752	443	192.168.2.4	2.18.97.153
May 26, 2024 01:00:34.663227081 CEST	49752	443	192.168.2.4	2.18.97.153
May 26, 2024 01:00:34.663239002 CEST	443	49752	2.18.97.153	192.168.2.4
May 26, 2024 01:00:34.663256884 CEST	49752	443	192.168.2.4	2.18.97.153
May 26, 2024 01:00:34.663264036 CEST	443	49752	2.18.97.153	192.168.2.4
May 26, 2024 01:00:42.225580931 CEST	443	49747	142.250.185.132	192.168.2.4
May 26, 2024 01:00:42.225740910 CEST	443	49747	142.250.185.132	192.168.2.4
May 26, 2024 01:00:42.228806973 CEST	49747	443	192.168.2.4	142.250.185.132
May 26, 2024 01:00:43.491275072 CEST	49747	443	192.168.2.4	142.250.185.132
May 26, 2024 01:00:43.491293907 CEST	443	49747	142.250.185.132	192.168.2.4
May 26, 2024 01:01:11.024970055 CEST	64490	53	192.168.2.4	162.159.36.2
May 26, 2024 01:01:11.030136108 CEST	53	64490	162.159.36.2	192.168.2.4
May 26, 2024 01:01:11.030378103 CEST	64490	53	192.168.2.4	162.159.36.2
May 26, 2024 01:01:11.030455112 CEST	64490	53	192.168.2.4	162.159.36.2
May 26, 2024 01:01:11.083637953 CEST	53	64490	162.159.36.2	192.168.2.4
May 26, 2024 01:01:11.486654997 CEST	53	64490	162.159.36.2	192.168.2.4
May 26, 2024 01:01:11.513125896 CEST	64490	53	192.168.2.4	162.159.36.2
May 26, 2024 01:01:11.521151066 CEST	53	64490	162.159.36.2	192.168.2.4
May 26, 2024 01:01:11.521303892 CEST	64490	53	192.168.2.4	162.159.36.2
May 26, 2024 01:01:29.321728945 CEST	62877	53	192.168.2.4	1.1.1.1
May 26, 2024 01:01:29.326905012 CEST	53	62877	1.1.1.1	192.168.2.4
May 26, 2024 01:01:29.327027082 CEST	62877	53	192.168.2.4	1.1.1.1
May 26, 2024 01:01:29.327027082 CEST	62877	53	192.168.2.4	1.1.1.1
May 26, 2024 01:01:29.384340048 CEST	53	62877	1.1.1.1	192.168.2.4
May 26, 2024 01:01:29.781985998 CEST	53	62877	1.1.1.1	192.168.2.4
May 26, 2024 01:01:29.782289028 CEST	62877	53	192.168.2.4	1.1.1.1
May 26, 2024 01:01:29.787679911 CEST	53	62877	1.1.1.1	192.168.2.4
May 26, 2024 01:01:29.787734032 CEST	62877	53	192.168.2.4	1.1.1.1
May 26, 2024 01:01:31.658889055 CEST	62879	443	192.168.2.4	142.250.185.132
May 26, 2024 01:01:31.658981085 CEST	443	62879	142.250.185.132	192.168.2.4
May 26, 2024 01:01:31.659248114 CEST	62879	443	192.168.2.4	142.250.185.132
May 26, 2024 01:01:31.659327984 CEST	62879	443	192.168.2.4	142.250.185.132
May 26, 2024 01:01:31.659348011 CEST	443	62879	142.250.185.132	192.168.2.4
May 26, 2024 01:01:32.329109907 CEST	443	62879	142.250.185.132	192.168.2.4
May 26, 2024 01:01:32.329468966 CEST	62879	443	192.168.2.4	142.250.185.132
May 26, 2024 01:01:32.329497099 CEST	443	62879	142.250.185.132	192.168.2.4
May 26, 2024 01:01:32.329791069 CEST	443	62879	142.250.185.132	192.168.2.4
May 26, 2024 01:01:32.330271959 CEST	62879	443	192.168.2.4	142.250.185.132
May 26, 2024 01:01:32.330329895 CEST	443	62879	142.250.185.132	192.168.2.4
May 26, 2024 01:01:32.376355886 CEST	62879	443	192.168.2.4	142.250.185.132
May 26, 2024 01:01:40.517920971 CEST	49723	80	192.168.2.4	2.19.126.137
May 26, 2024 01:01:40.518161058 CEST	49724	80	192.168.2.4	2.19.126.137
May 26, 2024 01:01:40.523473978 CEST	80	49723	2.19.126.137	192.168.2.4
May 26, 2024 01:01:40.523550034 CEST	49723	80	192.168.2.4	2.19.126.137
May 26, 2024 01:01:40.528172016 CEST	80	49724	2.19.126.137	192.168.2.4
May 26, 2024 01:01:40.528224945 CEST	49724	80	192.168.2.4	2.19.126.137
May 26, 2024 01:01:42.234035969 CEST	443	62879	142.250.185.132	192.168.2.4
May 26, 2024 01:01:42.234097958 CEST	443	62879	142.250.185.132	192.168.2.4
May 26, 2024 01:01:42.234158039 CEST	62879	443	192.168.2.4	142.250.185.132
May 26, 2024 01:01:43.837441921 CEST	62879	443	192.168.2.4	142.250.185.132
May 26, 2024 01:01:43.837507963 CEST	443	62879	142.250.185.132	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 26, 2024 01:00:27.090651989 CEST	53	60808	1.1.1.1	192.168.2.4
May 26, 2024 01:00:27.152045012 CEST	53	61536	1.1.1.1	192.168.2.4
May 26, 2024 01:00:28.314336061 CEST	53	62538	1.1.1.1	192.168.2.4
May 26, 2024 01:00:28.432706118 CEST	65245	53	192.168.2.4	1.1.1.1
May 26, 2024 01:00:28.432872057 CEST	49176	53	192.168.2.4	1.1.1.1
May 26, 2024 01:00:28.453417063 CEST	53	65245	1.1.1.1	192.168.2.4
May 26, 2024 01:00:28.453995943 CEST	53	49176	1.1.1.1	192.168.2.4
May 26, 2024 01:00:30.240267038 CEST	53	58074	1.1.1.1	192.168.2.4
May 26, 2024 01:00:30.855432987 CEST	54222	53	192.168.2.4	1.1.1.1
May 26, 2024 01:00:30.855948925 CEST	59134	53	192.168.2.4	1.1.1.1
May 26, 2024 01:00:30.890181065 CEST	53	54222	1.1.1.1	192.168.2.4
May 26, 2024 01:00:30.890197039 CEST	53	59134	1.1.1.1	192.168.2.4
May 26, 2024 01:00:31.606220961 CEST	63497	53	192.168.2.4	1.1.1.1
May 26, 2024 01:00:31.606220961 CEST	54480	53	192.168.2.4	1.1.1.1
May 26, 2024 01:00:31.626128912 CEST	53	63497	1.1.1.1	192.168.2.4
May 26, 2024 01:00:31.626135111 CEST	53	54480	1.1.1.1	192.168.2.4
May 26, 2024 01:00:46.408246040 CEST	53	51851	1.1.1.1	192.168.2.4
May 26, 2024 01:00:52.087783098 CEST	138	138	192.168.2.4	192.168.2.255
May 26, 2024 01:01:05.337986946 CEST	53	63100	1.1.1.1	192.168.2.4
May 26, 2024 01:01:11.024338961 CEST	53	55411	162.159.36.2	192.168.2.4
May 26, 2024 01:01:11.621644020 CEST	53	61861	1.1.1.1	192.168.2.4
May 26, 2024 01:01:27.004122019 CEST	53	59453	1.1.1.1	192.168.2.4
May 26, 2024 01:01:27.989006996 CEST	53	56713	1.1.1.1	192.168.2.4
May 26, 2024 01:01:29.321197987 CEST	53	65387	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 26, 2024 01:01:27.004549026 CEST	192.168.2.4	1.1.1.1	c224	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 26, 2024 01:00:28.432706118 CEST	192.168.2.4	1.1.1.1	0x4115	Standard query (0)	support-ads-team-34d19.firebaseapp.com	A (IP address)	IN (0x0001)	false
May 26, 2024 01:00:28.432872057 CEST	192.168.2.4	1.1.1.1	0x607d	Standard query (0)	support-ads-team-34d19.firebaseapp.com	65	IN (0x0001)	false
May 26, 2024 01:00:30.855432987 CEST	192.168.2.4	1.1.1.1	0x4581	Standard query (0)	support-ads-team-34d19.firebaseapp.com	A (IP address)	IN (0x0001)	false
May 26, 2024 01:00:30.855948925 CEST	192.168.2.4	1.1.1.1	0xad35	Standard query (0)	support-ads-team-34d19.firebaseapp.com	65	IN (0x0001)	false
May 26, 2024 01:00:31.606220961 CEST	192.168.2.4	1.1.1.1	0xe55	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 26, 2024 01:00:31.606220961 CEST	192.168.2.4	1.1.1.1	0xc393	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 26, 2024 01:00:28.453417063 CEST	1.1.1.1	192.168.2.4	0x4115	No error (0)	support-ads-team-34d19.firebaseapp.com		199.36.158.100	A (IP address)	IN (0x0001)	false
May 26, 2024 01:00:30.890181065 CEST	1.1.1.1	192.168.2.4	0x4581	No error (0)	support-ads-team-34d19.firebaseapp.com		199.36.158.100	A (IP address)	IN (0x0001)	false
May 26, 2024 01:00:31.626128912 CEST	1.1.1.1	192.168.2.4	0xe55	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
May 26, 2024 01:00:31.626135111 CEST	1.1.1.1	192.168.2.4	0xc393	No error (0)	www.google.com			65	IN (0x0001)	false
May 26, 2024 01:00:44.284241915 CEST	1.1.1.1	192.168.2.4	0xf408	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
May 26, 2024 01:00:44.284241915 CEST	1.1.1.1	192.168.2.4	0xf408	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
May 26, 2024 01:00:44.938245058 CEST	1.1.1.1	192.168.2.4	0x642a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 01:00:44.938245058 CEST	1.1.1.1	192.168.2.4	0x642a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 26, 2024 01:00:58.001699924 CEST	1.1.1.1	192.168.2.4	0xca58	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 01:00:58.001699924 CEST	1.1.1.1	192.168.2.4	0xca58	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 26, 2024 01:01:20.453784943 CEST	1.1.1.1	192.168.2.4	0x21dd	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 01:01:20.453784943 CEST	1.1.1.1	192.168.2.4	0x21dd	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 26, 2024 01:01:43.057284117 CEST	1.1.1.1	192.168.2.4	0x123e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 01:01:43.057284117 CEST	1.1.1.1	192.168.2.4	0x123e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

support-ads-team-34d19.firebaseapp.com

https:

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	199.36.158.100	443	332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:28 UTC	695	OUT	GET /form-2122.html HTTP/1.1 Host: support-ads-team-34d19.firebaseapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 23:00:29 UTC	609	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1262 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "3a91b0e81c35a0d3f666690c290267553949ea0024843df89d3351c9cb591977" Last-Modified: Sat, 25 May 2024 04:50:20 GMT Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Accept-Ranges: bytes Date: Sat, 25 May 2024 23:00:29 GMT X-Served-By: cache-nyc-kteb1890070-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1716678029.996196,VS0,VE171 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-25 23:00:29 UTC	1262	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 4d 65 74 61 20 66 6f 72 20 42 75 73 69 6e 65 73 73 20 2d 20 50 61 67 65 20 41 70 70 65 61 6c 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><title>Meta for Business - Page Appeal</title><meta http-equiv="content-type" content="text/html; charset=UTF-8"/><meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	199.36.158.100	443	332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:29 UTC	601	OUT	GET /static/js/main.597a1abe.js HTTP/1.1 Host: support-ads-team-34d19.firebaseapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://support-ads-team-34d19.firebaseapp.com/form-2122.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 23:00:29 UTC	617	IN	HTTP/1.1 200 OK Connection: close Content-Length: 184084 Cache-Control: max-age=3600 Content-Type: text/javascript; charset=utf-8 Etag: "a3c4cb554782e1e926802ed59441979aebf6a03eef0e5e776cc50ec2c07d27dd" Last-Modified: Sat, 25 May 2024 04:50:20 GMT Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Accept-Ranges: bytes Date: Sat, 25 May 2024 23:00:29 GMT X-Served-By: cache-nyc-kteb1890071-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1716678029.291796,VS0,VE209 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-25 23:00:29 UTC	1378	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 61 69 6e 2e 35 39 37 61 31 61 62 65 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 35 31 34 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 76 61 72 20 72 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6c 3d 21 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 7c 7c 21 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 7c 7c 21 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 29 2c 61 3d 7b 63 61 6e 55 73 65 44 4f 4d 3a 6c 2c 63 61 6e 55 73 65 57 6f 72 6b 65 72 73 3a 22 75 6e 64 65 66 69 6e 65 64 Data Ascii: /! For license information please see main.597a1abe.js.LICENSE.txt /(()=>{var e={514:(e,t,n)=>{var r;!function(){"use strict";var l=!("undefined"===typeof window\|\|!window.document\|\|!window.document.createElement),a={canUseDOM:l,canUseWorkers:"undefined
2024-05-25 23:00:29 UTC	1378	IN	Data Raw: 3d 22 26 61 72 67 73 5b 5d 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 3b 72 65 74 75 72 6e 22 4d 69 6e 69 66 69 65 64 20 52 65 61 63 74 20 65 72 72 6f 72 20 23 22 2b 65 2b 22 3b 20 76 69 73 69 74 20 22 2b 74 2b 22 20 66 6f 72 20 74 68 65 20 66 75 6c 6c 20 6d 65 73 73 61 67 65 20 6f 72 20 75 73 65 20 74 68 65 20 6e 6f 6e 2d 6d 69 6e 69 66 69 65 64 20 64 65 76 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 20 66 6f 72 20 66 75 6c 6c 20 65 72 72 6f 72 73 20 61 6e 64 20 61 64 64 69 74 69 6f 6e 61 6c 20 68 65 6c 70 66 75 6c 20 77 61 72 6e 69 6e 67 73 2e 22 7d 76 61 72 20 6f 3d 6e 65 77 20 53 65 74 2c 69 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 75 28 65 2c 74 29 7b 73 28 65 2c 74 29 2c 73 28 65 2b 22 43 61 70 74 Data Ascii: ="&args[]="+encodeURIComponent(arguments[n]);return"Minified React error #"+e+"; visit "+t+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}var o=new Set,i={};function u(e,t){s(e,t),s(e+"Capt
2024-05-25 23:00:29 UTC	1378	IN	Data Raw: 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 30 5d 3b 67 5b 74 5d 3d 6e 65 77 20 6d 28 74 2c 31 2c 21 31 2c 65 5b 31 5d 2c 6e 75 6c 6c 2c 21 31 2c 21 31 29 7d 29 29 2c 5b 22 63 6f 6e 74 65 6e 74 45 64 69 74 61 62 6c 65 22 2c 22 64 72 61 67 67 61 62 6c 65 22 2c 22 73 70 65 6c 6c 43 68 65 63 6b 22 2c 22 76 61 6c 75 65 22 5d 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 67 5b 65 5d 3d 6e 65 77 20 6d 28 65 2c 32 2c 21 31 2c 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 6e 75 6c 6c 2c 21 31 2c 21 31 29 7d 29 29 2c 5b 22 61 75 74 6f 52 65 76 65 72 73 65 22 2c 22 65 78 74 65 72 6e 61 6c 52 65 73 6f 75 72 63 65 73 52 65 71 75 69 72 65 64 22 2c 22 66 6f 63 75 73 61 62 6c 65 22 2c 22 70 72 65 73 65 72 76 65 41 6c 70 68 Data Ascii: h((function(e){var t=e[0];g[t]=new m(t,1,!1,e[1],null,!1,!1)})),["contentEditable","draggable","spellCheck","value"].forEach((function(e){g[e]=new m(e,2,!1,e.toLowerCase(),null,!1,!1)})),["autoReverse","externalResourcesRequired","focusable","preserveAlph
2024-05-25 23:00:29 UTC	1378	IN	Data Raw: 28 6e 75 6c 6c 21 3d 3d 6e 3f 21 6e 2e 61 63 63 65 70 74 73 42 6f 6f 6c 65 61 6e 73 3a 22 64 61 74 61 2d 22 21 3d 3d 28 65 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 73 6c 69 63 65 28 30 2c 35 29 29 26 26 22 61 72 69 61 2d 22 21 3d 3d 65 29 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 21 31 7d 7d 28 65 2c 74 2c 6e 2c 72 29 29 72 65 74 75 72 6e 21 30 3b 69 66 28 72 29 72 65 74 75 72 6e 21 31 3b 69 66 28 6e 75 6c 6c 21 3d 3d 6e 29 73 77 69 74 63 68 28 6e 2e 74 79 70 65 29 7b 63 61 73 65 20 33 3a 72 65 74 75 72 6e 21 74 3b 63 61 73 65 20 34 3a 72 65 74 75 72 6e 21 31 3d 3d 3d 74 3b 63 61 73 65 20 35 3a 72 65 74 75 72 6e 20 69 73 4e 61 4e 28 74 29 3b 63 61 73 65 20 36 3a 72 65 74 75 72 6e 20 69 73 4e 61 4e 28 74 29 7c 7c 31 3e 74 7d 72 65 74 75 72 6e Data Ascii: (null!==n?!n.acceptsBooleans:"data-"!==(e=e.toLowerCase().slice(0,5))&&"aria-"!==e);default:return!1}}(e,t,n,r))return!0;if(r)return!1;if(null!==n)switch(n.type){case 3:return!t;case 4:return!1===t;case 5:return isNaN(t);case 6:return isNaN(t)\|\|1>t}return
2024-05-25 23:00:29 UTC	1378	IN	Data Raw: 66 66 73 65 74 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 20 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 20 74 65 78 74 2d 61 6e 63 68 6f 72 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 20 74 65 78 74 2d 72 65 6e 64 65 72 69 6e 67 20 75 6e 64 65 72 6c 69 6e 65 2d 70 6f 73 69 74 69 6f 6e 20 75 6e 64 65 72 6c 69 6e 65 2d 74 68 69 63 6b 6e 65 73 73 20 75 6e 69 63 6f 64 65 2d 62 69 64 69 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 20 75 6e 69 74 73 2d 70 65 72 2d 65 6d 20 76 2d 61 6c 70 68 61 62 65 74 69 63 20 76 2d 68 61 6e 67 69 6e 67 20 76 2d 69 64 65 6f 67 72 61 70 68 69 63 20 76 2d 6d 61 74 68 65 6d 61 74 69 63 61 Data Ascii: ffset stroke-linecap stroke-linejoin stroke-miterlimit stroke-opacity stroke-width text-anchor text-decoration text-rendering underline-position underline-thickness unicode-bidi unicode-range units-per-em v-alphabetic v-hanging v-ideographic v-mathematica
2024-05-25 23:00:29 UTC	1378	IN	Data Raw: 22 29 2c 50 3d 53 79 6d 62 6f 6c 2e 66 6f 72 28 22 72 65 61 63 74 2e 73 75 73 70 65 6e 73 65 22 29 2c 54 3d 53 79 6d 62 6f 6c 2e 66 6f 72 28 22 72 65 61 63 74 2e 73 75 73 70 65 6e 73 65 5f 6c 69 73 74 22 29 2c 7a 3d 53 79 6d 62 6f 6c 2e 66 6f 72 28 22 72 65 61 63 74 2e 6d 65 6d 6f 22 29 2c 4c 3d 53 79 6d 62 6f 6c 2e 66 6f 72 28 22 72 65 61 63 74 2e 6c 61 7a 79 22 29 3b 53 79 6d 62 6f 6c 2e 66 6f 72 28 22 72 65 61 63 74 2e 73 63 6f 70 65 22 29 2c 53 79 6d 62 6f 6c 2e 66 6f 72 28 22 72 65 61 63 74 2e 64 65 62 75 67 5f 74 72 61 63 65 5f 6d 6f 64 65 22 29 3b 76 61 72 20 52 3d 53 79 6d 62 6f 6c 2e 66 6f 72 28 22 72 65 61 63 74 2e 6f 66 66 73 63 72 65 65 6e 22 29 3b 53 79 6d 62 6f 6c 2e 66 6f 72 28 22 72 65 61 63 74 2e 6c 65 67 61 63 79 5f 68 69 64 64 65 6e 22 Data Ascii: "),P=Symbol.for("react.suspense"),T=Symbol.for("react.suspense_list"),z=Symbol.for("react.memo"),L=Symbol.for("react.lazy");Symbol.for("react.scope"),Symbol.for("react.debug_trace_mode");var R=Symbol.for("react.offscreen");Symbol.for("react.legacy_hidden"
2024-05-25 23:00:29 UTC	1378	IN	Data Raw: 61 6e 6f 6e 79 6d 6f 75 73 3e 22 2c 65 2e 64 69 73 70 6c 61 79 4e 61 6d 65 29 29 2c 75 7d 7d 77 68 69 6c 65 28 31 3c 3d 6f 26 26 30 3c 3d 69 29 3b 62 72 65 61 6b 7d 7d 7d 66 69 6e 61 6c 6c 79 7b 55 3d 21 31 2c 45 72 72 6f 72 2e 70 72 65 70 61 72 65 53 74 61 63 6b 54 72 61 63 65 3d 6e 7d 72 65 74 75 72 6e 28 65 3d 65 3f 65 2e 64 69 73 70 6c 61 79 4e 61 6d 65 7c 7c 65 2e 6e 61 6d 65 3a 22 22 29 3f 49 28 65 29 3a 22 22 7d 66 75 6e 63 74 69 6f 6e 20 57 28 65 29 7b 73 77 69 74 63 68 28 65 2e 74 61 67 29 7b 63 61 73 65 20 35 3a 72 65 74 75 72 6e 20 49 28 65 2e 74 79 70 65 29 3b 63 61 73 65 20 31 36 3a 72 65 74 75 72 6e 20 49 28 22 4c 61 7a 79 22 29 3b 63 61 73 65 20 31 33 3a 72 65 74 75 72 6e 20 49 28 22 53 75 73 70 65 6e 73 65 22 29 3b 63 61 73 65 20 31 39 3a Data Ascii: anonymous>",e.displayName)),u}}while(1<=o&&0<=i);break}}}finally{U=!1,Error.prepareStackTrace=n}return(e=e?e.displayName\|\|e.name:"")?I(e):""}function W(e){switch(e.tag){case 5:return I(e.type);case 16:return I("Lazy");case 13:return I("Suspense");case 19:
2024-05-25 23:00:29 UTC	1378	IN	Data Raw: 73 70 6c 61 79 4e 61 6d 65 7c 7c 28 22 22 21 3d 3d 65 3f 22 46 6f 72 77 61 72 64 52 65 66 28 22 2b 65 2b 22 29 22 3a 22 46 6f 72 77 61 72 64 52 65 66 22 29 3b 63 61 73 65 20 37 3a 72 65 74 75 72 6e 22 46 72 61 67 6d 65 6e 74 22 3b 63 61 73 65 20 35 3a 72 65 74 75 72 6e 20 74 3b 63 61 73 65 20 34 3a 72 65 74 75 72 6e 22 50 6f 72 74 61 6c 22 3b 63 61 73 65 20 33 3a 72 65 74 75 72 6e 22 52 6f 6f 74 22 3b 63 61 73 65 20 36 3a 72 65 74 75 72 6e 22 54 65 78 74 22 3b 63 61 73 65 20 31 36 3a 72 65 74 75 72 6e 20 42 28 74 29 3b 63 61 73 65 20 38 3a 72 65 74 75 72 6e 20 74 3d 3d 3d 43 3f 22 53 74 72 69 63 74 4d 6f 64 65 22 3a 22 4d 6f 64 65 22 3b 63 61 73 65 20 32 32 3a 72 65 74 75 72 6e 22 4f 66 66 73 63 72 65 65 6e 22 3b 63 61 73 65 20 31 32 3a 72 65 74 75 72 6e Data Ascii: splayName\|\|(""!==e?"ForwardRef("+e+")":"ForwardRef");case 7:return"Fragment";case 5:return t;case 4:return"Portal";case 3:return"Root";case 6:return"Text";case 16:return B(t);case 8:return t===C?"StrictMode":"Mode";case 22:return"Offscreen";case 12:return
2024-05-25 23:00:29 UTC	1378	IN	Data Raw: 2e 5f 76 61 6c 75 65 54 72 61 63 6b 65 72 3b 69 66 28 21 74 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 6e 3d 74 2e 67 65 74 56 61 6c 75 65 28 29 2c 72 3d 22 22 3b 72 65 74 75 72 6e 20 65 26 26 28 72 3d 24 28 65 29 3f 65 2e 63 68 65 63 6b 65 64 3f 22 74 72 75 65 22 3a 22 66 61 6c 73 65 22 3a 65 2e 76 61 6c 75 65 29 2c 28 65 3d 72 29 21 3d 3d 6e 26 26 28 74 2e 73 65 74 56 61 6c 75 65 28 65 29 2c 21 30 29 7d 66 75 6e 63 74 69 6f 6e 20 4b 28 65 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 28 65 3d 65 7c 7c 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 3f 64 6f 63 75 6d 65 6e 74 3a 76 6f 69 64 20 30 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 74 72 79 7b 72 65 74 75 72 6e 20 65 2e 61 63 Data Ascii: ._valueTracker;if(!t)return!0;var n=t.getValue(),r="";return e&&(r=$(e)?e.checked?"true":"false":e.value),(e=r)!==n&&(t.setValue(e),!0)}function K(e){if("undefined"===typeof(e=e\|\|("undefined"!==typeof document?document:void 0)))return null;try{return e.ac
2024-05-25 23:00:29 UTC	1378	IN	Data Raw: 69 61 6c 56 61 6c 75 65 2c 6e 7c 7c 74 3d 3d 3d 65 2e 76 61 6c 75 65 7c 7c 28 65 2e 76 61 6c 75 65 3d 74 29 2c 65 2e 64 65 66 61 75 6c 74 56 61 6c 75 65 3d 74 7d 22 22 21 3d 3d 28 6e 3d 65 2e 6e 61 6d 65 29 26 26 28 65 2e 6e 61 6d 65 3d 22 22 29 2c 65 2e 64 65 66 61 75 6c 74 43 68 65 63 6b 65 64 3d 21 21 65 2e 5f 77 72 61 70 70 65 72 53 74 61 74 65 2e 69 6e 69 74 69 61 6c 43 68 65 63 6b 65 64 2c 22 22 21 3d 3d 6e 26 26 28 65 2e 6e 61 6d 65 3d 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 65 65 28 65 2c 74 2c 6e 29 7b 22 6e 75 6d 62 65 72 22 3d 3d 3d 74 26 26 4b 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 29 3d 3d 3d 65 7c 7c 28 6e 75 6c 6c 3d 3d 6e 3f 65 2e 64 65 66 61 75 6c 74 56 61 6c 75 65 3d 22 22 2b 65 2e 5f 77 72 61 70 70 65 72 53 74 61 74 65 2e 69 6e 69 Data Ascii: ialValue,n\|\|t===e.value\|\|(e.value=t),e.defaultValue=t}""!==(n=e.name)&&(e.name=""),e.defaultChecked=!!e._wrapperState.initialChecked,""!==n&&(e.name=n)}function ee(e,t,n){"number"===t&&K(e.ownerDocument)===e\|\|(null==n?e.defaultValue=""+e._wrapperState.ini

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	199.36.158.100	443	332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:29 UTC	617	OUT	GET /static/css/main.4dd8a724.css HTTP/1.1 Host: support-ads-team-34d19.firebaseapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://support-ads-team-34d19.firebaseapp.com/form-2122.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 23:00:29 UTC	608	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1487 Cache-Control: max-age=3600 Content-Type: text/css; charset=utf-8 Etag: "5c1f505f809b5817e2c3860470ccce3a692a7b40dca55b6305b829bca11f2bbc" Last-Modified: Sat, 25 May 2024 04:50:20 GMT Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Accept-Ranges: bytes Date: Sat, 25 May 2024 23:00:29 GMT X-Served-By: cache-nyc-kteb1890026-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1716678030.817183,VS0,VE134 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-25 23:00:29 UTC	1378	IN	Data Raw: 62 6f 64 79 7b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 3b 2d 6d 6f 7a 2d 6f 73 78 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 67 72 61 79 73 63 61 6c 65 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 48 65 6c 76 65 74 69 63 61 3b 6d 61 72 67 69 6e 3a 30 7d 63 6f 64 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 6f 75 72 63 65 2d 63 6f 64 65 2d 70 72 6f 2c 4d 65 6e 6c 6f 2c 4d 6f 6e 61 63 6f 2c 43 6f 6e 73 6f 6c 61 73 2c 43 6f 75 72 69 65 72 20 4e 65 77 2c 6d 6f 6e 6f 73 70 61 63 65 7d 64 69 76 20 2e 63 61 72 64 7b 66 6f 6e 74 2d 66 65 61 74 75 72 65 2d 73 65 74 74 69 6e 67 73 3a 6e 6f 72 6d 61 6c 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 61 74 Data Ascii: body{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;font-family:Helvetica;margin:0}code{font-family:source-code-pro,Menlo,Monaco,Consolas,Courier New,monospace}div .card{font-feature-settings:normal;word-wrap:break-word;background-at
2024-05-25 23:00:29 UTC	109	IN	Data Raw: 69 62 6c 65 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 72 6d 61 6c 3b 77 69 64 74 68 3a 35 35 30 70 78 3b 77 6f 72 64 2d 73 70 61 63 69 6e 67 3a 30 3b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 0a 2f 2a 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 6d 61 69 6e 2e 34 64 64 38 61 37 32 34 2e 63 73 73 2e 6d 61 70 2a 2f Data Ascii: ible;white-space:normal;width:550px;word-spacing:0;z-index:auto}/# sourceMappingURL=main.4dd8a724.css.map/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	199.36.158.100	443	332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:30 UTC	653	OUT	GET /resources/meta.svg HTTP/1.1 Host: support-ads-team-34d19.firebaseapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://support-ads-team-34d19.firebaseapp.com/form-2122.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 23:00:30 UTC	591	IN	HTTP/1.1 200 OK Connection: close Content-Length: 12365 Cache-Control: max-age=3600 Content-Type: image/svg+xml Etag: "e93d40168f96af6be7b640ba0fb6e85f03d23d29b85f740610c8c9ba43b9ac42" Last-Modified: Sat, 25 May 2024 04:50:20 GMT Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Accept-Ranges: bytes Date: Sat, 25 May 2024 23:00:30 GMT X-Served-By: cache-ewr18130-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1716678031.682363,VS0,VE92 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-25 23:00:30 UTC	1378	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 35 33 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 33 20 31 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 67 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 63 6c 69 70 30 5f 31 31 36 35 5f 31 39 33 38 32 29 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 31 39 2e 35 38 32 33 20 31 2e 30 30 39 34 48 32 31 2e 35 35 34 32 4c 32 34 2e 39 30 37 33 20 37 2e 31 37 39 39 34 4c 32 38 2e 32 36 30 33 20 31 2e 30 30 39 34 48 33 30 2e 31 38 39 36 56 31 31 2e 31 34 38 37 48 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><svg width="53" height="12" viewBox="0 0 53 12" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_1165_19382)"><path d="M19.5823 1.0094H21.5542L24.9073 7.17994L28.2603 1.0094H30.1896V11.1487H2
2024-05-25 23:00:30 UTC	1378	IN	Data Raw: 39 33 34 38 36 48 34 32 2e 31 37 38 56 38 2e 33 33 31 35 31 43 34 32 2e 31 37 38 20 38 2e 38 39 36 33 37 20 34 32 2e 32 37 32 39 20 39 2e 32 39 39 35 32 20 34 32 2e 34 36 32 37 20 39 2e 35 34 30 39 36 43 34 32 2e 36 35 32 35 20 39 2e 37 38 32 34 36 20 34 32 2e 39 37 37 36 20 39 2e 39 30 33 31 37 20 34 33 2e 34 33 38 20 39 2e 39 30 33 30 37 43 34 33 2e 36 34 32 20 39 2e 39 30 33 30 37 20 34 33 2e 38 31 35 32 20 39 2e 38 39 34 36 33 20 34 33 2e 39 35 37 37 20 39 2e 38 37 37 37 33 43 34 34 2e 31 30 30 31 20 39 2e 38 36 30 39 20 34 34 2e 32 35 36 37 20 39 2e 38 33 37 39 36 20 34 34 2e 34 32 37 35 20 39 2e 38 30 38 39 31 56 31 31 2e 31 33 34 33 43 34 34 2e 32 33 32 36 20 31 31 2e 31 39 31 36 20 34 34 2e 30 33 34 20 31 31 2e 32 33 35 32 20 34 33 2e 38 33 33 31 Data Ascii: 93486H42.178V8.33151C42.178 8.89637 42.2729 9.29952 42.4627 9.54096C42.6525 9.78246 42.9776 9.90317 43.438 9.90307C43.642 9.90307 43.8152 9.89463 43.9577 9.87773C44.1001 9.8609 44.2567 9.83796 44.4275 9.80891V11.1343C44.2326 11.1916 44.034 11.2352 43.8331
2024-05-25 23:00:30 UTC	1378	IN	Data Raw: 31 5f 31 31 36 35 5f 31 39 33 38 32 29 22 3e 0a 3c 67 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 63 6c 69 70 32 5f 31 31 36 35 5f 31 39 33 38 32 29 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 35 2e 30 31 38 36 20 30 2e 36 36 36 36 38 37 43 35 2e 30 31 33 35 33 20 30 2e 36 36 36 36 38 37 20 35 2e 30 30 38 34 38 20 30 2e 36 36 36 37 30 35 20 35 2e 30 30 33 34 31 20 30 2e 36 36 36 37 33 32 4c 34 2e 39 38 32 36 37 20 32 2e 34 31 30 32 32 43 34 2e 39 38 37 34 31 20 32 2e 34 31 30 31 37 20 34 2e 39 39 32 31 36 20 32 2e 34 31 30 31 33 20 34 2e 39 39 36 39 31 20 32 2e 34 31 30 31 33 48 34 2e 39 39 36 39 32 43 36 2e 31 32 34 39 35 20 32 2e 34 31 30 31 33 20 36 2e 39 39 39 39 32 20 33 2e 33 31 34 39 36 20 38 2e 39 30 31 36 37 20 36 2e 35 37 33 38 4c 39 2e 30 31 Data Ascii: 1_1165_19382)"><g clip-path="url(#clip2_1165_19382)"><path d="M5.0186 0.666687C5.01353 0.666687 5.00848 0.666705 5.00341 0.666732L4.98267 2.41022C4.98741 2.41017 4.99216 2.41013 4.99691 2.41013H4.99692C6.12495 2.41013 6.99992 3.31496 8.90167 6.5738L9.01
2024-05-25 23:00:30 UTC	1378	IN	Data Raw: 34 30 31 33 34 20 30 2e 34 38 36 31 32 20 37 2e 30 32 33 31 32 20 30 2e 34 38 34 38 37 35 20 37 2e 36 34 36 34 33 43 30 2e 34 38 34 38 36 36 20 37 2e 36 35 31 34 37 20 30 2e 34 38 34 38 36 32 20 37 2e 36 35 36 35 31 20 30 2e 34 38 34 38 36 34 20 37 2e 36 36 31 35 34 4c 32 2e 31 39 33 30 31 20 37 2e 38 31 37 30 31 43 32 2e 31 39 32 38 38 20 37 2e 38 31 31 39 35 20 32 2e 31 39 32 37 34 20 37 2e 38 30 36 39 35 20 32 2e 31 39 32 36 32 20 37 2e 38 30 31 38 38 43 32 2e 31 39 31 37 38 20 37 2e 37 36 35 37 33 20 32 2e 31 39 31 33 35 20 37 2e 37 32 39 30 39 20 32 2e 31 39 31 33 34 20 37 2e 36 39 31 39 35 43 32 2e 31 39 32 31 39 20 37 2e 31 38 37 38 39 20 32 2e 32 33 37 38 31 20 36 2e 36 38 34 39 34 20 32 2e 33 32 37 36 34 20 36 2e 31 38 39 32 33 43 32 2e 33 32 38 Data Ascii: 40134 0.48612 7.02312 0.484875 7.64643C0.484866 7.65147 0.484862 7.65651 0.484864 7.66154L2.19301 7.81701C2.19288 7.81195 2.19274 7.80695 2.19262 7.80188C2.19178 7.76573 2.19135 7.72909 2.19134 7.69195C2.19219 7.18789 2.23781 6.68494 2.32764 6.18923C2.328
2024-05-25 23:00:30 UTC	1378	IN	Data Raw: 31 36 20 31 30 2e 34 32 38 39 20 31 2e 33 31 37 33 33 20 31 30 2e 34 33 32 37 43 31 2e 38 30 35 38 20 31 31 2e 30 31 31 39 20 32 2e 34 39 35 32 39 20 31 31 2e 33 33 33 33 20 33 2e 33 34 38 32 36 20 31 31 2e 33 33 33 33 43 34 2e 36 33 38 37 35 20 31 31 2e 33 33 33 33 20 35 2e 35 36 36 38 37 20 31 30 2e 37 31 34 34 20 37 2e 32 31 36 38 33 20 37 2e 37 38 30 32 34 43 37 2e 32 31 36 38 33 20 37 2e 37 38 30 32 34 20 37 2e 39 30 34 36 34 20 36 2e 35 34 34 35 39 20 38 2e 33 37 37 38 31 20 35 2e 36 39 33 34 31 43 38 2e 30 38 34 37 31 20 35 2e 32 31 31 39 39 20 37 2e 38 31 37 39 38 20 34 2e 37 39 35 32 31 20 37 2e 35 37 31 32 34 20 34 2e 34 33 35 38 35 5a 22 20 66 69 6c 6c 3d 22 23 30 30 38 32 46 42 22 2f 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 39 2e 33 36 31 32 36 20 Data Ascii: 16 10.4289 1.31733 10.4327C1.8058 11.0119 2.49529 11.3333 3.34826 11.3333C4.63875 11.3333 5.56687 10.7144 7.21683 7.78024C7.21683 7.78024 7.90464 6.54459 8.37781 5.69341C8.08471 5.21199 7.81798 4.79521 7.57124 4.43585Z" fill="#0082FB"/><path d="M9.36126
2024-05-25 23:00:30 UTC	1378	IN	Data Raw: 23 70 61 69 6e 74 37 5f 6c 69 6e 65 61 72 5f 31 31 36 35 5f 31 39 33 38 32 29 22 2f 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 31 36 2e 32 36 31 35 20 37 2e 34 33 32 30 36 43 31 36 2e 32 36 31 34 20 37 2e 34 32 37 30 34 20 31 36 2e 32 36 31 34 20 37 2e 34 32 32 30 32 20 31 36 2e 32 36 31 33 20 37 2e 34 31 37 4c 31 34 2e 37 35 34 36 20 37 2e 34 31 36 35 43 31 34 2e 37 35 34 38 20 37 2e 34 32 31 35 32 20 31 34 2e 37 35 34 39 20 37 2e 34 32 36 35 34 20 31 34 2e 37 35 35 31 20 37 2e 34 33 31 35 36 43 31 34 2e 37 35 37 35 20 37 2e 35 32 35 31 35 20 31 34 2e 37 35 38 37 20 37 2e 36 31 39 33 31 20 31 34 2e 37 35 38 37 20 37 2e 37 31 34 30 33 43 31 34 2e 37 35 38 37 20 38 2e 32 35 37 37 20 31 34 2e 36 37 38 39 20 38 2e 36 39 37 31 39 20 31 34 2e 35 31 36 36 20 39 2e 30 Data Ascii: #paint7_linear_1165_19382)"/><path d="M16.2615 7.43206C16.2614 7.42704 16.2614 7.42202 16.2613 7.417L14.7546 7.4165C14.7548 7.42152 14.7549 7.42654 14.7551 7.43156C14.7575 7.52515 14.7587 7.61931 14.7587 7.71403C14.7587 8.2577 14.6789 8.69719 14.5166 9.0
2024-05-25 23:00:30 UTC	1378	IN	Data Raw: 32 34 34 20 39 2e 30 31 34 37 37 20 31 32 2e 35 32 31 32 20 39 2e 30 31 30 39 33 4c 31 31 2e 33 31 34 37 20 31 30 2e 32 38 37 34 43 31 31 2e 33 31 38 31 20 31 30 2e 32 39 31 31 20 31 31 2e 33 32 31 34 20 31 30 2e 32 39 34 38 20 31 31 2e 33 32 34 38 20 31 30 2e 32 39 38 34 43 31 31 2e 37 34 34 20 31 30 2e 37 35 32 39 20 31 32 2e 31 34 34 33 20 31 31 2e 30 33 34 39 20 31 32 2e 35 39 38 33 20 31 31 2e 31 38 39 36 4c 31 33 2e 31 32 32 33 20 39 2e 35 30 39 39 33 43 31 32 2e 39 33 30 39 20 39 2e 34 32 36 33 34 20 31 32 2e 37 34 35 39 20 39 2e 32 37 34 38 20 31 32 2e 35 33 30 39 20 39 2e 30 32 32 33 38 5a 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 70 61 69 6e 74 31 31 5f 6c 69 6e 65 61 72 5f 31 31 36 35 5f 31 39 33 38 32 29 22 2f 3e 0a 3c 70 61 74 68 20 64 3d 22 4d Data Ascii: 244 9.01477 12.5212 9.01093L11.3147 10.2874C11.3181 10.2911 11.3214 10.2948 11.3248 10.2984C11.744 10.7529 12.1443 11.0349 12.5983 11.1896L13.1223 9.50993C12.9309 9.42634 12.7459 9.2748 12.5309 9.02238Z" fill="url(#paint11_linear_1165_19382)"/><path d="M
2024-05-25 23:00:30 UTC	1378	IN	Data Raw: 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 6e 74 33 5f 6c 69 6e 65 61 72 5f 31 31 36 35 5f 31 39 33 38 32 22 20 78 31 3d 22 31 2e 33 34 32 33 34 22 20 79 31 3d 22 37 2e 36 31 36 36 39 22 20 78 32 3d 22 31 2e 34 35 38 37 32 22 20 79 32 3d 22 36 2e 30 39 36 37 38 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 3e 0a 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 2e 30 37 33 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 30 30 37 43 46 36 22 2f 3e 0a 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 2e 39 39 34 33 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 30 30 37 32 45 43 22 2f 3e 0a 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 Data Ascii: rGradient id="paint3_linear_1165_19382" x1="1.34234" y1="7.61669" x2="1.45872" y2="6.09678" gradientUnits="userSpaceOnUse"><stop offset="0.0731" stop-color="#007CF6"/><stop offset="0.9943" stop-color="#0072EC"/></linearGradient><linearGradient id="pai
2024-05-25 23:00:30 UTC	1341	IN	Data Raw: 64 69 65 6e 74 3e 0a 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 6e 74 39 5f 6c 69 6e 65 61 72 5f 31 31 36 35 5f 31 39 33 38 32 22 20 78 31 3d 22 31 34 2e 32 34 38 35 22 20 79 31 3d 22 31 30 2e 33 30 37 35 22 20 78 32 3d 22 31 35 2e 30 37 37 36 22 20 79 32 3d 22 39 2e 37 35 32 33 38 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 3e 0a 3c 73 74 6f 70 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 30 32 37 41 46 33 22 2f 3e 0a 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 30 30 38 30 46 39 22 2f 3e 0a 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 6e 74 31 30 5f 6c 69 6e Data Ascii: dient><linearGradient id="paint9_linear_1165_19382" x1="14.2485" y1="10.3075" x2="15.0776" y2="9.75238" gradientUnits="userSpaceOnUse"><stop stop-color="#027AF3"/><stop offset="1" stop-color="#0080F9"/></linearGradient><linearGradient id="paint10_lin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	199.36.158.100	443	332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:30 UTC	652	OUT	GET /resources/bg.jpeg HTTP/1.1 Host: support-ads-team-34d19.firebaseapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://support-ads-team-34d19.firebaseapp.com/form-2122.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 23:00:30 UTC	589	IN	HTTP/1.1 200 OK Connection: close Content-Length: 80630 Cache-Control: max-age=3600 Content-Type: image/jpeg Etag: "55a3e8254cbddca6a13d0a5fb7d8ba54bc1976faefc49b742bd7ea22b7230cdd" Last-Modified: Sat, 25 May 2024 04:50:20 GMT Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Accept-Ranges: bytes Date: Sat, 25 May 2024 23:00:30 GMT X-Served-By: cache-ewr18170-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1716678031.704937,VS0,VE176 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-25 23:00:30 UTC	16384	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 30 20 37 39 2e 31 36 30 34 35 31 2c 20 32 30 31 37 2f 30 35 2f 30 36 2d 30 31 3a 30 38 3a 32 31 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-05-25 23:00:31 UTC	16384	IN	Data Raw: a2 44 07 6b 33 e3 03 bb 5a d5 56 a7 37 28 e9 7f 7f 23 8f 31 18 e9 f6 92 61 7d 58 2d 63 0e 07 73 10 aa 3d e6 a3 61 2b d2 3e 22 ba 75 45 0e 51 d5 4f ab 25 cc 85 99 bb a2 8f 74 7b ce 28 4d db fc 7a b1 07 6b dd ae 16 09 5e de 10 41 60 84 29 20 1d 41 dd c6 07 65 37 a8 ab 06 3a b5 6c f4 1d 93 b6 cd b1 5b 6b c6 2d 6a 7e a6 73 a9 8c 1e 00 f5 af e9 5e a3 c3 b4 6c db df 14 75 e5 cf f2 5e ed 28 f7 96 d9 e3 1b ea db c1 77 75 ce 70 46 31 c4 1a cb 3c 98 4f 5b 33 17 77 f0 db 12 91 ee dc 5c 0d 0a 83 98 d0 fe 22 3d 63 d8 3d f4 b3 d5 0c 27 2d 72 5f 53 3f 34 b2 cf 21 96 67 32 39 d3 27 80 1d 40 70 03 ba b2 7a e3 15 15 48 6e 85 1e b7 9c db 4f 1c c3 50 87 d3 5e b5 3a 30 f7 50 cc a3 bc a8 d3 4b 14 72 a9 8d ce 53 d6 8a 51 a9 5c 8c 86 1d 84 71 15 a3 c8 9b 59 94 ef 6d 22 31 59 00 Data Ascii: Dk3ZV7(#1a}X-cs=a+>"uEQO%t{(Mzk^A`) Ae7:l[k-j~s^lu^(wupF1<O[3w\"=c='-r_S?4!g29'@pzHnOP^:0PKrSQ\qYm"1Y
2024-05-25 23:00:31 UTC	16384	IN	Data Raw: bd 8e 99 3c eb 0d a3 b2 8b 23 35 d3 7f 0e 35 8f a8 9f 49 be 3a 7c 2a 59 a5 11 32 09 14 09 2e 65 11 b3 6b 18 97 25 bf 30 4e 3d dc 29 5c ca ba 10 ba 58 a3 39 86 2d f7 e3 d3 cd 86 39 eb 0b ea 8f 8d 66 d2 d0 d5 73 19 77 79 1b 7e 47 2e de d3 1c ff 00 fd 2a 37 7a 95 21 cf a9 5c ff 00 1a 41 a7 e0 53 cf bc fe 95 74 1a 8c d6 4a 14 07 55 99 1b 79 18 ab 75 8a 27 40 73 31 49 eb 01 0b fb 4a 3d 03 de 39 78 55 c9 90 43 a3 c7 8d e1 a3 7a ac 35 07 b8 d1 aa 16 26 a1 42 80 28 02 80 28 07 d2 44 64 10 ce 71 1a fd 54 c0 65 a3 cf ea bd 63 dd 5a 4f 83 23 5c 86 e4 8d e2 6d c7 03 38 ca b0 d4 30 3c 0a 9e 60 d4 6a 82 76 22 a1 42 80 5c 72 49 11 2d 13 94 27 d6 c7 03 de 38 1f 1a a9 b5 a1 1a b1 dd f8 25 fa c4 e8 1f ef 62 19 5f 14 f9 1a b6 9e a3 34 25 e0 91 54 c8 b8 9a 21 fc 58 fd 20 3b Data Ascii: <#55I:\|Y2.ek%0N=)\X9-9fswy~G.7z!\AStJUyu'@s1IJ=9xUCz5&B((DdqTecZO#\m80<`jv"B\rI-'8%b_4%T!X ;
2024-05-25 23:00:31 UTC	16384	IN	Data Raw: 04 73 14 3c ed 12 a6 da 96 73 dc 47 67 2b 93 b5 62 87 7e 5b 68 f0 37 d0 9c a9 04 fd ac 6a 54 6b 8d 6a d9 ce 38 32 8a de 5f 2d eb fb e6 35 e7 9f 75 04 6b f8 9f 32 1f 8e 07 c2 a1 7d df 36 24 dd dc b6 33 3b 7a 24 15 50 77 46 46 a3 41 8a 85 dc 8a e0 65 b6 84 f7 bb 3e fa 64 b7 ba 95 2d e7 c4 f0 a3 1d f5 dd 93 52 30 d9 1a 1c 8a 8c f6 e1 46 38 90 4d ac d6 43 09 b6 26 fe 35 ad bc c3 99 0a 62 63 e2 87 1f 0a 96 69 ec eb 83 6b ea 4b 4d a9 62 ff 00 59 04 f6 e4 f3 52 b2 a8 f7 ee 9a a7 37 81 35 a3 4f e8 4b 4b 8b 29 34 8e fe 2e e9 83 44 7f d4 31 f1 a1 cd c6 6b 58 be ec c9 62 09 88 de 48 cc ab c9 a3 22 41 fe 82 68 67 79 17 fe 4f 26 0d fc 8c 30 40 8e 20 08 c1 04 92 c7 f4 a2 3c 9b 5b f9 57 69 2b ca 3b 23 7f b0 b6 8c 0a 37 a5 89 05 d4 03 9e fc 07 7b 03 bd 72 2a b3 9e c9 89 Data Ascii: s<sGg+b~[h7jTkj82_-5uk2}6$3;z$PwFFAe>d-R0F8MC&5bcikKMbYR75OKK)4.D1kXbH"AhgyO&0@ <[Wi+;#7{r*
2024-05-25 23:00:31 UTC	15094	IN	Data Raw: d1 8c 41 38 e9 20 1d 40 9f 49 7f 94 e9 55 9e 7c 29 6f 47 3d 51 12 a1 b1 c8 63 e9 65 8e 2e 52 30 53 d8 39 9f 01 42 49 d2 b2 34 f3 79 c5 c4 d3 72 95 c9 4f cb c1 7e 00 54 66 e3 1d d4 90 98 e3 79 5d 22 89 4b c8 e7 08 83 9d 03 69 2b 63 93 4c 91 46 f6 b6 ce 1d 5f 4b bb a1 fc 5c 7d 84 fc 00 ff 00 51 d7 86 2a 99 8c 5b 7b cf b9 72 fc f9 10 c1 a8 6c 58 52 55 9c 90 91 a7 af 2b 1d d5 5e f2 68 42 be 6d a5 0c 79 5b 64 17 12 7d f4 80 88 c7 e5 4e 2d e3 a7 65 0e d1 c1 6f e6 cb cc a8 9a 69 ae 1f a4 9e 46 95 f8 06 6e 43 a8 0e 00 77 54 3b c6 2a 2a 90 dd 0d 05 00 50 05 00 50 05 00 50 05 00 50 1e 85 e4 16 d3 dc 9a ef 63 4a de 8c e0 dd 59 67 ef 10 62 45 1f 99 70 7c 28 7c 9f 6a 60 da 58 8b 86 4f ec 7a 84 72 04 de 0c 82 58 65 5d c9 e1 3c 1d 7a bb 08 e2 0f 23 43 e2 ca 37 da 2a d6 Data Ascii: A8 @IU\|)oG=Qce.R0S9BI4yrO~Tfy]"Ki+cLF_K\}Q[{rlXRU+^hBmy[d}N-eoiFnCwT;PPPPcJYgbEp\|(\|j`XOzrXe]<z#C7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	199.36.158.100	443	332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:31 UTC	380	OUT	GET /resources/meta.svg HTTP/1.1 Host: support-ads-team-34d19.firebaseapp.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 23:00:31 UTC	589	IN	HTTP/1.1 200 OK Connection: close Content-Length: 12365 Cache-Control: max-age=3600 Content-Type: image/svg+xml Etag: "e93d40168f96af6be7b640ba0fb6e85f03d23d29b85f740610c8c9ba43b9ac42" Last-Modified: Sat, 25 May 2024 04:50:20 GMT Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Accept-Ranges: bytes Date: Sat, 25 May 2024 23:00:31 GMT X-Served-By: cache-ewr18146-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1716678031.472054,VS0,VE1 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-25 23:00:31 UTC	1378	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 35 33 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 33 20 31 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 67 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 63 6c 69 70 30 5f 31 31 36 35 5f 31 39 33 38 32 29 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 31 39 2e 35 38 32 33 20 31 2e 30 30 39 34 48 32 31 2e 35 35 34 32 4c 32 34 2e 39 30 37 33 20 37 2e 31 37 39 39 34 4c 32 38 2e 32 36 30 33 20 31 2e 30 30 39 34 48 33 30 2e 31 38 39 36 56 31 31 2e 31 34 38 37 48 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><svg width="53" height="12" viewBox="0 0 53 12" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_1165_19382)"><path d="M19.5823 1.0094H21.5542L24.9073 7.17994L28.2603 1.0094H30.1896V11.1487H2
2024-05-25 23:00:31 UTC	1378	IN	Data Raw: 39 33 34 38 36 48 34 32 2e 31 37 38 56 38 2e 33 33 31 35 31 43 34 32 2e 31 37 38 20 38 2e 38 39 36 33 37 20 34 32 2e 32 37 32 39 20 39 2e 32 39 39 35 32 20 34 32 2e 34 36 32 37 20 39 2e 35 34 30 39 36 43 34 32 2e 36 35 32 35 20 39 2e 37 38 32 34 36 20 34 32 2e 39 37 37 36 20 39 2e 39 30 33 31 37 20 34 33 2e 34 33 38 20 39 2e 39 30 33 30 37 43 34 33 2e 36 34 32 20 39 2e 39 30 33 30 37 20 34 33 2e 38 31 35 32 20 39 2e 38 39 34 36 33 20 34 33 2e 39 35 37 37 20 39 2e 38 37 37 37 33 43 34 34 2e 31 30 30 31 20 39 2e 38 36 30 39 20 34 34 2e 32 35 36 37 20 39 2e 38 33 37 39 36 20 34 34 2e 34 32 37 35 20 39 2e 38 30 38 39 31 56 31 31 2e 31 33 34 33 43 34 34 2e 32 33 32 36 20 31 31 2e 31 39 31 36 20 34 34 2e 30 33 34 20 31 31 2e 32 33 35 32 20 34 33 2e 38 33 33 31 Data Ascii: 93486H42.178V8.33151C42.178 8.89637 42.2729 9.29952 42.4627 9.54096C42.6525 9.78246 42.9776 9.90317 43.438 9.90307C43.642 9.90307 43.8152 9.89463 43.9577 9.87773C44.1001 9.8609 44.2567 9.83796 44.4275 9.80891V11.1343C44.2326 11.1916 44.034 11.2352 43.8331
2024-05-25 23:00:31 UTC	1378	IN	Data Raw: 31 5f 31 31 36 35 5f 31 39 33 38 32 29 22 3e 0a 3c 67 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 63 6c 69 70 32 5f 31 31 36 35 5f 31 39 33 38 32 29 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 35 2e 30 31 38 36 20 30 2e 36 36 36 36 38 37 43 35 2e 30 31 33 35 33 20 30 2e 36 36 36 36 38 37 20 35 2e 30 30 38 34 38 20 30 2e 36 36 36 37 30 35 20 35 2e 30 30 33 34 31 20 30 2e 36 36 36 37 33 32 4c 34 2e 39 38 32 36 37 20 32 2e 34 31 30 32 32 43 34 2e 39 38 37 34 31 20 32 2e 34 31 30 31 37 20 34 2e 39 39 32 31 36 20 32 2e 34 31 30 31 33 20 34 2e 39 39 36 39 31 20 32 2e 34 31 30 31 33 48 34 2e 39 39 36 39 32 43 36 2e 31 32 34 39 35 20 32 2e 34 31 30 31 33 20 36 2e 39 39 39 39 32 20 33 2e 33 31 34 39 36 20 38 2e 39 30 31 36 37 20 36 2e 35 37 33 38 4c 39 2e 30 31 Data Ascii: 1_1165_19382)"><g clip-path="url(#clip2_1165_19382)"><path d="M5.0186 0.666687C5.01353 0.666687 5.00848 0.666705 5.00341 0.666732L4.98267 2.41022C4.98741 2.41017 4.99216 2.41013 4.99691 2.41013H4.99692C6.12495 2.41013 6.99992 3.31496 8.90167 6.5738L9.01
2024-05-25 23:00:31 UTC	1378	IN	Data Raw: 34 30 31 33 34 20 30 2e 34 38 36 31 32 20 37 2e 30 32 33 31 32 20 30 2e 34 38 34 38 37 35 20 37 2e 36 34 36 34 33 43 30 2e 34 38 34 38 36 36 20 37 2e 36 35 31 34 37 20 30 2e 34 38 34 38 36 32 20 37 2e 36 35 36 35 31 20 30 2e 34 38 34 38 36 34 20 37 2e 36 36 31 35 34 4c 32 2e 31 39 33 30 31 20 37 2e 38 31 37 30 31 43 32 2e 31 39 32 38 38 20 37 2e 38 31 31 39 35 20 32 2e 31 39 32 37 34 20 37 2e 38 30 36 39 35 20 32 2e 31 39 32 36 32 20 37 2e 38 30 31 38 38 43 32 2e 31 39 31 37 38 20 37 2e 37 36 35 37 33 20 32 2e 31 39 31 33 35 20 37 2e 37 32 39 30 39 20 32 2e 31 39 31 33 34 20 37 2e 36 39 31 39 35 43 32 2e 31 39 32 31 39 20 37 2e 31 38 37 38 39 20 32 2e 32 33 37 38 31 20 36 2e 36 38 34 39 34 20 32 2e 33 32 37 36 34 20 36 2e 31 38 39 32 33 43 32 2e 33 32 38 Data Ascii: 40134 0.48612 7.02312 0.484875 7.64643C0.484866 7.65147 0.484862 7.65651 0.484864 7.66154L2.19301 7.81701C2.19288 7.81195 2.19274 7.80695 2.19262 7.80188C2.19178 7.76573 2.19135 7.72909 2.19134 7.69195C2.19219 7.18789 2.23781 6.68494 2.32764 6.18923C2.328
2024-05-25 23:00:31 UTC	1378	IN	Data Raw: 31 36 20 31 30 2e 34 32 38 39 20 31 2e 33 31 37 33 33 20 31 30 2e 34 33 32 37 43 31 2e 38 30 35 38 20 31 31 2e 30 31 31 39 20 32 2e 34 39 35 32 39 20 31 31 2e 33 33 33 33 20 33 2e 33 34 38 32 36 20 31 31 2e 33 33 33 33 43 34 2e 36 33 38 37 35 20 31 31 2e 33 33 33 33 20 35 2e 35 36 36 38 37 20 31 30 2e 37 31 34 34 20 37 2e 32 31 36 38 33 20 37 2e 37 38 30 32 34 43 37 2e 32 31 36 38 33 20 37 2e 37 38 30 32 34 20 37 2e 39 30 34 36 34 20 36 2e 35 34 34 35 39 20 38 2e 33 37 37 38 31 20 35 2e 36 39 33 34 31 43 38 2e 30 38 34 37 31 20 35 2e 32 31 31 39 39 20 37 2e 38 31 37 39 38 20 34 2e 37 39 35 32 31 20 37 2e 35 37 31 32 34 20 34 2e 34 33 35 38 35 5a 22 20 66 69 6c 6c 3d 22 23 30 30 38 32 46 42 22 2f 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 39 2e 33 36 31 32 36 20 Data Ascii: 16 10.4289 1.31733 10.4327C1.8058 11.0119 2.49529 11.3333 3.34826 11.3333C4.63875 11.3333 5.56687 10.7144 7.21683 7.78024C7.21683 7.78024 7.90464 6.54459 8.37781 5.69341C8.08471 5.21199 7.81798 4.79521 7.57124 4.43585Z" fill="#0082FB"/><path d="M9.36126
2024-05-25 23:00:31 UTC	1378	IN	Data Raw: 23 70 61 69 6e 74 37 5f 6c 69 6e 65 61 72 5f 31 31 36 35 5f 31 39 33 38 32 29 22 2f 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 31 36 2e 32 36 31 35 20 37 2e 34 33 32 30 36 43 31 36 2e 32 36 31 34 20 37 2e 34 32 37 30 34 20 31 36 2e 32 36 31 34 20 37 2e 34 32 32 30 32 20 31 36 2e 32 36 31 33 20 37 2e 34 31 37 4c 31 34 2e 37 35 34 36 20 37 2e 34 31 36 35 43 31 34 2e 37 35 34 38 20 37 2e 34 32 31 35 32 20 31 34 2e 37 35 34 39 20 37 2e 34 32 36 35 34 20 31 34 2e 37 35 35 31 20 37 2e 34 33 31 35 36 43 31 34 2e 37 35 37 35 20 37 2e 35 32 35 31 35 20 31 34 2e 37 35 38 37 20 37 2e 36 31 39 33 31 20 31 34 2e 37 35 38 37 20 37 2e 37 31 34 30 33 43 31 34 2e 37 35 38 37 20 38 2e 32 35 37 37 20 31 34 2e 36 37 38 39 20 38 2e 36 39 37 31 39 20 31 34 2e 35 31 36 36 20 39 2e 30 Data Ascii: #paint7_linear_1165_19382)"/><path d="M16.2615 7.43206C16.2614 7.42704 16.2614 7.42202 16.2613 7.417L14.7546 7.4165C14.7548 7.42152 14.7549 7.42654 14.7551 7.43156C14.7575 7.52515 14.7587 7.61931 14.7587 7.71403C14.7587 8.2577 14.6789 8.69719 14.5166 9.0
2024-05-25 23:00:31 UTC	1378	IN	Data Raw: 32 34 34 20 39 2e 30 31 34 37 37 20 31 32 2e 35 32 31 32 20 39 2e 30 31 30 39 33 4c 31 31 2e 33 31 34 37 20 31 30 2e 32 38 37 34 43 31 31 2e 33 31 38 31 20 31 30 2e 32 39 31 31 20 31 31 2e 33 32 31 34 20 31 30 2e 32 39 34 38 20 31 31 2e 33 32 34 38 20 31 30 2e 32 39 38 34 43 31 31 2e 37 34 34 20 31 30 2e 37 35 32 39 20 31 32 2e 31 34 34 33 20 31 31 2e 30 33 34 39 20 31 32 2e 35 39 38 33 20 31 31 2e 31 38 39 36 4c 31 33 2e 31 32 32 33 20 39 2e 35 30 39 39 33 43 31 32 2e 39 33 30 39 20 39 2e 34 32 36 33 34 20 31 32 2e 37 34 35 39 20 39 2e 32 37 34 38 20 31 32 2e 35 33 30 39 20 39 2e 30 32 32 33 38 5a 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 70 61 69 6e 74 31 31 5f 6c 69 6e 65 61 72 5f 31 31 36 35 5f 31 39 33 38 32 29 22 2f 3e 0a 3c 70 61 74 68 20 64 3d 22 4d Data Ascii: 244 9.01477 12.5212 9.01093L11.3147 10.2874C11.3181 10.2911 11.3214 10.2948 11.3248 10.2984C11.744 10.7529 12.1443 11.0349 12.5983 11.1896L13.1223 9.50993C12.9309 9.42634 12.7459 9.2748 12.5309 9.02238Z" fill="url(#paint11_linear_1165_19382)"/><path d="M
2024-05-25 23:00:31 UTC	1378	IN	Data Raw: 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 6e 74 33 5f 6c 69 6e 65 61 72 5f 31 31 36 35 5f 31 39 33 38 32 22 20 78 31 3d 22 31 2e 33 34 32 33 34 22 20 79 31 3d 22 37 2e 36 31 36 36 39 22 20 78 32 3d 22 31 2e 34 35 38 37 32 22 20 79 32 3d 22 36 2e 30 39 36 37 38 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 3e 0a 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 2e 30 37 33 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 30 30 37 43 46 36 22 2f 3e 0a 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 2e 39 39 34 33 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 30 30 37 32 45 43 22 2f 3e 0a 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 Data Ascii: rGradient id="paint3_linear_1165_19382" x1="1.34234" y1="7.61669" x2="1.45872" y2="6.09678" gradientUnits="userSpaceOnUse"><stop offset="0.0731" stop-color="#007CF6"/><stop offset="0.9943" stop-color="#0072EC"/></linearGradient><linearGradient id="pai
2024-05-25 23:00:31 UTC	1341	IN	Data Raw: 64 69 65 6e 74 3e 0a 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 6e 74 39 5f 6c 69 6e 65 61 72 5f 31 31 36 35 5f 31 39 33 38 32 22 20 78 31 3d 22 31 34 2e 32 34 38 35 22 20 79 31 3d 22 31 30 2e 33 30 37 35 22 20 78 32 3d 22 31 35 2e 30 37 37 36 22 20 79 32 3d 22 39 2e 37 35 32 33 38 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 3e 0a 3c 73 74 6f 70 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 30 32 37 41 46 33 22 2f 3e 0a 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 30 30 38 30 46 39 22 2f 3e 0a 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 6e 74 31 30 5f 6c 69 6e Data Ascii: dient><linearGradient id="paint9_linear_1165_19382" x1="14.2485" y1="10.3075" x2="15.0776" y2="9.75238" gradientUnits="userSpaceOnUse"><stop stop-color="#027AF3"/><stop offset="1" stop-color="#0080F9"/></linearGradient><linearGradient id="paint10_lin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	199.36.158.100	443	332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:32 UTC	653	OUT	GET /resources/logo.png HTTP/1.1 Host: support-ads-team-34d19.firebaseapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://support-ads-team-34d19.firebaseapp.com/form-2122.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 23:00:32 UTC	587	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1059 Cache-Control: max-age=3600 Content-Type: image/png Etag: "f1e3d53afa9d6326ac9750e6d679d01c40925c17c63d8ba2574b630025951514" Last-Modified: Sat, 25 May 2024 04:50:20 GMT Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Accept-Ranges: bytes Date: Sat, 25 May 2024 23:00:32 GMT X-Served-By: cache-ewr18120-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1716678032.480057,VS0,VE157 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-25 23:00:32 UTC	1059	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 03 d5 49 44 41 54 78 9c ed 56 5b 88 1b 65 14 fe 7a b1 94 a5 f6 a9 50 7c 12 c1 7a 81 5a 7d 50 11 2c 15 7c 69 45 50 8a 5d 14 c1 2a e4 c2 a6 e9 66 37 d9 ec 66 93 dd ee 3f 13 f5 a1 f5 45 45 51 d1 87 62 15 7d 52 b0 88 17 10 75 5f 04 41 ad ae 0f fa a0 cd cd 5c 36 db c4 64 73 99 f9 67 9a 23 f9 27 99 99 6c 32 d3 ea 8b 2f f9 e0 7b c9 e4 9c ef fb cf 39 ff 99 01 c6 18 63 0c 37 78 d3 31 78 52 ab f0 a6 be 85 2f fb 2a fc b9 27 31 f9 eb 2e d7 98 a4 72 3b 24 4d 86 c4 2f 40 d2 5e 02 d3 4e 80 d1 4e fc 2b f8 b2 4f c0 93 6a c2 9b 26 41 5f 86 e0 cf 12 a6 72 84 40 3e 87 40 e1 d1 a1 18 46 bb 20 6b 2f 43 e2 3a 64 Data Ascii: PNGIHDR szzpHYsIDATxV[ezP\|zZ}P,\|iEP]f7f?EEQb}Ru_A\6dsg#'l2/{9c7x1xR/'1.r;$M/@^NN+Oj&A_r@>@F k/C:d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	199.36.158.100	443	332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:32 UTC	379	OUT	GET /resources/bg.jpeg HTTP/1.1 Host: support-ads-team-34d19.firebaseapp.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 23:00:32 UTC	586	IN	HTTP/1.1 200 OK Connection: close Content-Length: 80630 Cache-Control: max-age=3600 Content-Type: image/jpeg Etag: "55a3e8254cbddca6a13d0a5fb7d8ba54bc1976faefc49b742bd7ea22b7230cdd" Last-Modified: Sat, 25 May 2024 04:50:20 GMT Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Accept-Ranges: bytes Date: Sat, 25 May 2024 23:00:32 GMT X-Served-By: cache-ewr18160-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1716678032.474667,VS0,VE1 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-25 23:00:32 UTC	1378	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 30 20 37 39 2e 31 36 30 34 35 31 2c 20 32 30 31 37 2f 30 35 2f 30 36 2d 30 31 3a 30 38 3a 32 31 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-05-25 23:00:32 UTC	1378	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2024-05-25 23:00:32 UTC	1378	IN	Data Raw: 05 04 02 02 03 00 00 01 02 11 03 21 31 04 12 41 51 61 71 81 91 b1 d1 05 13 22 32 a1 c1 e1 f0 42 14 52 15 23 62 72 82 33 92 b2 f1 a2 d2 06 c2 34 e2 f2 ff da 00 0c 03 00 00 01 11 02 11 00 3f 00 f9 9b 5f b1 3f 3c 14 01 40 14 02 e3 92 48 64 49 a1 73 1c b1 30 68 dc 72 22 84 69 35 4f 43 64 f1 5a f9 45 64 93 2e ed bd ec 3e 82 c9 c9 1b 8f 46 fd 68 dc 54 f2 f7 8a de a7 cf 52 96 cf 2a d5 3f db 5d 79 f3 31 d3 43 2d bc b2 41 3c 66 29 a2 3b b2 46 dc 41 fd c1 e4 6b 14 7b e3 25 25 6b 41 ba 1a 0a 00 a0 0a 01 fb 5b 79 ae ee 61 b5 b6 19 9e 66 dd 42 74 0b cc b1 3c 82 8d 4d 0c ce 6a 11 72 7a 23 da b6 25 cf 9a 58 1b 18 99 ae 2d ec d8 61 a4 24 c8 e1 c7 a5 26 f1 c9 04 b0 e1 c3 1a 57 44 7e 77 69 86 fc f7 9e 4d fe d1 7c b2 b3 a9 92 29 4c 91 8f 5b 41 bc bf 98 7e fc 28 79 5c 6b 26 Data Ascii: !1AQaq"2BR#br34?_?<@HdIs0hr"i5OCdZEd.>FhTR*?]y1C-A<f);FAk{%%kA[yafBt<Mjrz#%X-a$&WD~wiM\|)L[A~(y\k&
2024-05-25 23:00:32 UTC	1378	IN	Data Raw: 92 d3 c5 65 da 8a ee 92 4f bd 7f ea 3f 3a 87 52 e3 60 3c 87 6c 59 af 48 ff 00 48 27 4f 58 f3 82 4e da a7 9f 6a ff 00 a4 fb bc d1 60 92 ca 02 32 cd 22 3a e1 91 d5 88 20 8d 41 07 3c 45 0e 4c b5 ba 63 77 0f fb 4e 26 2a cc e1 36 9c 2a 48 11 cc dc 24 03 92 cb 8c f6 36 47 55 0e 38 6f 71 ee 3e ee ce 5d ab c8 ad 2c ff 00 78 ff 00 d4 7e 74 3b 1c df 7f bc 7f ea 3f 3a 03 d1 7c 88 b0 75 82 ef 6c 4c 5b 7a 7d eb 4b 0c 93 ea 8c 19 9c 77 9c 27 be 87 c8 f6 96 35 b5 86 b8 66 fe de a6 47 ca e7 7f fe 26 db 03 7d 86 24 41 80 c7 94 49 43 e8 7b 3f ff 00 e3 c3 b3 ee cc d1 79 07 f1 1f fa 8f ce 87 b4 37 df ef 1f fa 8f ce a0 1e 8e 37 68 de e2 6b 93 6b 65 11 dd 9a f1 cb 11 bd ec 22 83 97 73 c9 47 8e 05 53 12 95 3a 59 b7 c3 ee f9 2e a5 5d ee d5 92 64 36 b6 7d 25 ad 86 41 75 67 26 59 Data Ascii: eO?:R`<lYHH'OXNj`2": A<ELcwN&6H$6GU8oq>],x~t;?:\|ulL[z}Kw'5fG&}$AIC{?y77hkke"sGS:Y.]d6}%Aug&Y
2024-05-25 23:00:32 UTC	1378	IN	Data Raw: fb d7 fe a3 f3 a0 0e 92 4f bd 7f ea 3f 3a 00 e9 24 fb d7 fe a3 f3 a0 16 b3 cc 99 dd 95 b0 7d 65 24 90 7b c1 aa 9d 12 85 74 8a fc 64 92 06 eb 0c cc 9e ec e4 53 21 99 c6 13 a8 de e9 1d 93 ef 15 c9 5f d7 4f 1a 50 b1 be 92 4f bd 7f ea 3f 3a 85 0e 92 4f bd 7f ea 3f 3a 00 e9 24 fb d7 fe a3 f3 a0 0e 92 4f bd 7f ea 3f 3a 00 e9 24 fb d7 fe a3 f3 a0 0e 92 4f bd 7f ea 3f 3a 00 e9 24 fb d7 fe a3 f3 a0 0e 92 4f bd 7f ea 3f 3a 00 e9 24 fb d7 fe a3 f3 a0 1c 5b 9b 85 18 13 39 5f 64 92 47 c6 ad b2 51 de 9f 3e ba 1c f5 a3 b2 fc 32 45 2d 72 07 77 91 b8 5c cb 1f 63 e4 fc 54 fe d4 a4 33 0d c9 cf d5 cc 65 fc 92 12 7d c4 83 4d d1 63 6c d3 26 8e d2 27 e6 2c 2a 51 44 f4 92 7d eb ff 00 51 f9 d0 07 49 27 de bf f5 1f 9d 00 74 92 7d eb ff 00 51 f9 d0 07 49 27 de bf f5 1f 9d 00 74 92 Data Ascii: O?:$}e${tdS!_OPO?:O?:$O?:$O?:$O?:$[9_dGQ>2E-rw\cT3e}Mcl&',*QD}QI't}QI't
2024-05-25 23:00:32 UTC	1378	IN	Data Raw: 91 af 03 65 7b 65 6d b5 ed a2 65 91 56 40 99 b1 be e5 ba 7e c3 fe 1c f8 a9 ad 35 67 cf c3 c4 96 0c 9f 2e 2b d3 af 99 84 9a 19 ad a6 92 de e2 33 14 f1 1c 49 19 e5 d4 41 e6 0f 23 58 3e 94 64 a4 ad 68 37 43 41 40 70 90 06 4e 80 71 34 06 e7 62 d8 79 8d b1 9e 55 c5 e5 f2 02 41 e3 1c 07 55 5e c2 fc 4f 66 05 69 1f 37 68 c5 df 95 2d 17 d5 fe 0d 3e cc 7c 5c b4 5c ae 23 64 03 f1 0f 49 7f 4a a8 f1 e3 2f 86 f9 17 11 c8 c8 cb 24 6c 51 c7 06 1c 6a 9e 76 af 26 59 45 3c 73 60 36 ec 32 9e 7c 23 6f ff 00 13 f0 a1 c6 50 6b aa 2c b7 92 d6 de 3f 38 6e 87 7c b3 ee 9d 59 b9 0d d5 e7 a0 ee a1 c6 9c de 45 6c fb 46 59 32 90 83 6f 11 d0 e0 fa 6c 3f 13 72 ee 15 0e d1 c1 4b 37 9b 21 c6 ed 13 a4 91 e8 d1 90 cb de 28 6d ab 54 cb 66 dd c8 78 fe aa 50 1e 31 d4 0f 2f 03 a5 0e 2b ae a3 b0 Data Ascii: e{emeV@~5g.+3IA#X>dh7CA@pNq4byUAU^Ofi7h->\|\\#dIJ/$lQjv&YE<s`62\|#oPk,?8n\|YElFY2ol?rK7!(mTfxP1/+
2024-05-25 23:00:32 UTC	1378	IN	Data Raw: 97 0e a1 62 1b 96 f6 f1 8d d8 a1 4f 66 34 e4 3a cf 13 cc 9a 1e ac 3c 25 86 a9 77 be 2f b4 8b 91 d7 43 67 68 09 f7 be 94 3b 2a 61 c1 ec 96 2f 18 1d d0 fc 31 43 96 1e 4e 4b af 9a 4c 81 43 a8 50 13 2d ed a3 31 9b cb c7 68 6c 55 8a 29 5c 74 93 b8 e3 1c 39 e7 ed 37 05 ef c0 a1 ce 73 77 bb 1c e5 f4 5d 5f d9 71 3b 2b dd 5f b2 14 b7 29 0c 23 72 d6 da 20 7a 38 90 f2 5c f1 27 99 3a 93 c6 aa 8b 7a 21 18 a8 71 cd ea f8 bf df a1 32 3d 89 72 37 5a f1 d6 cd 08 c8 8c fa 53 30 ec 41 c3 bd 8d 6d 61 33 2f 19 7f 1c fc 89 62 ca 24 53 1a 3b c5 1b 68 e1 34 77 fc cf c7 c0 60 56 d6 12 25 de 6f 3f de 42 a3 b4 b5 8b 1b 96 e9 a7 02 de 91 f8 d6 94 12 e0 57 26 c9 39 38 c7 01 d4 34 15 a2 00 04 9c 01 93 d4 28 06 26 b9 b7 b7 c8 96 51 bf f7 49 e9 37 c3 41 e2 6a 39 25 a9 52 6c ab 9b 6a ca Data Ascii: bOf4:<%w/Cgh;*a/1CNKLCP-1hlU)\t97sw]_q;+_)#r z8\':z!q2=r7ZS0Ama3/b$S;h4w`V%o?BW&984(&QI7Aj9%Rlj
2024-05-25 23:00:32 UTC	1378	IN	Data Raw: 0b 12 97 3f 01 45 99 25 25 1d 5d 1a 4b 4f 23 b6 f5 de 0b db 2d 92 1e 2d 3b 61 b1 f9 17 26 b6 b0 db 3c b3 db b0 a3 c6 fb 0d 35 af 90 76 71 61 b6 8e d0 92 63 ce 38 b7 61 4f ea 62 5a b4 b0 f9 9e 49 fb 46 4f e5 8f dc bf b5 d9 de 4d 6c cc 18 61 b2 8e 45 fe 34 ac 25 7f 7b 6f 7e 95 b4 a2 8f 34 f1 71 b1 35 6f c8 b1 7d b7 b3 50 61 af 37 95 7e cc 68 cc 3c 34 02 ae f2 39 2d 9e 6f 80 e2 ed 7d 9c 24 86 17 95 d6 e2 e5 cc 76 f6 ac 02 bb 38 5d fd d3 af a2 4a ea 01 d4 fb a9 bc 8c bc 09 d3 75 92 e3 f4 1d ff 00 69 40 c3 00 c8 8b ec aa 81 ef d7 35 2c cf ba 67 05 e5 a8 fb 52 0e cd cf fb d5 b0 f0 e4 38 2f 2d 7e f5 ff 00 e1 9f 9d 4b 27 bb 90 bf 3b b4 fb e6 ff 00 86 7e 75 2c cf bb 97 21 62 ee d3 ef db fe 1b 55 b2 7b b9 72 2c 60 58 ee a3 8c a4 c0 63 78 2e f2 90 59 41 e4 3b 0d 35 Data Ascii: ?E%%]KO#--;a&<5vqac8aObZIFOMlaE4%{o~4q5o}Pa7~h<49-o}$v8]Jui@5,gR8/-~K';~u,!bU{r,`Xcx.YA;5
2024-05-25 23:00:32 UTC	1378	IN	Data Raw: 23 d0 d1 da 03 63 e4 95 9e d2 92 56 b9 4b a6 b1 d8 91 96 f3 e2 ca 1e 39 d4 02 64 8d 63 7f 44 e4 68 cd cb bf 4a 1f 3f 6f c4 82 54 d5 cf 87 35 c9 df 92 37 96 57 b6 37 f0 f4 96 d6 49 6f d0 28 59 2c 37 9b e8 50 68 9b ba ea 98 c0 cf 23 c6 87 cb c4 c2 9e 1b a9 3b be 3c f9 f7 93 73 09 1f e1 93 de ff 00 3a 1c f3 e6 53 ed dd a1 7f 1d d4 46 29 45 bc 33 40 9d 11 89 40 6c 27 a0 cb be 72 74 23 e3 50 f4 6c d8 30 71 76 ad a6 66 59 9a 46 df 91 9a 49 3d b7 25 8f bc eb 43 db 55 a0 67 03 27 95 01 a5 b7 83 cc ed fa 16 18 ba b8 dd 7b ce b5 1c 52 2f 0e 2d db dd 43 c3 39 ef ca f8 2d 3e ef d0 73 23 1a f0 a1 0b eb ab eb db 4f 27 76 8b fa bb 46 d2 38 cd ab 14 32 c8 91 0c 9d f7 88 6a 5a 30 32 a3 89 1c 46 95 0f 2c 30 a1 3c 78 af e2 ee f8 2b e5 7d 78 9e 0f b9 63 21 2e 36 cc 72 33 92 Data Ascii: #cVK9dcDhJ?oT57W7Io(Y,7Ph#;<s:SF)E3@@l'rt#Pl0qvfYFI=%CUg'{R/-C9->s#O'vF82jZ02F,0<x+}xc!.6r3
2024-05-25 23:00:32 UTC	1378	IN	Data Raw: 97 68 2e 1e 16 e6 50 8f 73 54 3b 61 3d 48 21 dc 70 63 ef ab 67 51 b9 66 48 93 a5 9d 91 23 e4 cc b9 2c 7a 94 0d 49 a5 9a 8a 6d d2 28 ee 76 8f 4e 1a 34 84 c3 01 e3 ba c4 3b 0f c4 7f 61 53 78 f4 c3 0b 77 37 9b 24 ec f6 b7 9e de 4b 29 0b 81 11 32 c4 70 09 50 da 31 5c 75 1e 34 54 63 15 38 bd e4 33 35 b1 89 f7 1a 44 27 19 56 d4 06 1d 63 35 68 d4 65 63 5d 0c 9c 80 6f ca 41 a9 46 ac 41 56 5f 59 48 ef 06 a5 02 f2 c1 44 71 02 79 c7 9c 75 ef 11 5d 56 48 e5 88 48 e9 58 1f c1 ec 72 a3 39 d0 ea ee be 0a eb a8 ca 9e 22 84 d0 3d a3 ff 00 bd 4d 50 67 a6 8b a3 79 a1 e4 3d 28 fb 86 a3 e1 59 3d 51 76 ac ac ba 83 a7 4d e5 19 96 31 e8 fe 21 cd 7e 55 ce 51 b3 a4 5d 15 51 44 f3 38 48 d7 79 b8 93 c0 01 d6 4f 2a e4 95 9d 1b 4b 52 de 28 52 05 21 3d 27 61 89 25 3a 13 d8 3a 85 74 4a Data Ascii: h.PsT;a=H!pcgQfH#,zIm(vN4;aSxw7$K)2pP1\u4Tc835D'Vc5hec]oAFAV_YHDqyu]VHHXr9"=MPgy=(Y=QvM1!~UQ]QD8HyO*KR(R!='a%::tJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	199.36.158.100	443	332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:32 UTC	587	OUT	GET /manifest.json HTTP/1.1 Host: support-ads-team-34d19.firebaseapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://support-ads-team-34d19.firebaseapp.com/form-2122.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 23:00:32 UTC	592	IN	HTTP/1.1 200 OK Connection: close Content-Length: 492 Cache-Control: max-age=3600 Content-Type: application/json Etag: "ee04fb47e525c67d8424ffe9b4d8a8a24e434504478afca4e0ca602146836d4c" Last-Modified: Sat, 25 May 2024 04:50:20 GMT Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Accept-Ranges: bytes Date: Sat, 25 May 2024 23:00:32 GMT X-Served-By: cache-ewr18152-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1716678032.479890,VS0,VE87 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-25 23:00:32 UTC	492	IN	Data Raw: 7b 0a 20 20 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 20 22 52 65 61 63 74 20 41 70 70 22 2c 0a 20 20 22 6e 61 6d 65 22 3a 20 22 43 72 65 61 74 65 20 52 65 61 63 74 20 41 70 70 20 53 61 6d 70 6c 65 22 2c 0a 20 20 22 69 63 6f 6e 73 22 3a 20 5b 0a 20 20 20 20 7b 0a 20 20 20 20 20 20 22 73 72 63 22 3a 20 22 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2c 0a 20 20 20 20 20 20 22 73 69 7a 65 73 22 3a 20 22 36 34 78 36 34 20 33 32 78 33 32 20 32 34 78 32 34 20 31 36 78 31 36 22 2c 0a 20 20 20 20 20 20 22 74 79 70 65 22 3a 20 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 7b 0a 20 20 20 20 20 20 22 73 72 63 22 3a 20 22 6c 6f 67 6f 31 39 32 2e 70 6e 67 22 2c 0a 20 20 20 20 20 20 22 74 79 70 65 22 3a 20 22 69 6d 61 67 65 2f 70 6e 67 22 2c 0a 20 Data Ascii: { "short_name": "React App", "name": "Create React App Sample", "icons": [ { "src": "favicon.ico", "sizes": "64x64 32x32 24x24 16x16", "type": "image/x-icon" }, { "src": "logo192.png", "type": "image/png",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	2.19.104.72	443

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:33 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-25 23:00:33 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=61758 Date: Sat, 25 May 2024 23:00:33 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49749	199.36.158.100	443	332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:33 UTC	646	OUT	GET /logo192.png HTTP/1.1 Host: support-ads-team-34d19.firebaseapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://support-ads-team-34d19.firebaseapp.com/form-2122.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 23:00:33 UTC	593	IN	HTTP/1.1 200 OK Connection: close Content-Length: 5347 Cache-Control: max-age=3600 Content-Type: image/png Etag: "79e2b749561016bc8af300ea19f48347ceed3cb1a54f48ae456172eca45e08f0" Last-Modified: Sat, 25 May 2024 04:50:20 GMT Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Accept-Ranges: bytes Date: Sat, 25 May 2024 23:00:33 GMT X-Served-By: cache-nyc-kteb1890037-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1716678034.796830,VS0,VE85 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-25 23:00:33 UTC	1378	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 03 00 00 00 65 02 9c 35 00 00 00 87 50 4c 54 45 00 00 00 64 da fb 61 da fc 61 db fc 61 da fc 61 db fc 61 da fb 61 db fc 61 da fb 61 da fc 61 db fc 61 da fc 61 da fc 61 db fc 61 da fc 61 da fc 61 da fb 61 da fb 61 da fb 61 da fc 60 da fb 61 da fb 61 db fb 61 da fc 61 da fc 61 da fc 61 da fc 61 da fb 60 da fb 61 da fb 61 db fc 61 da fc 61 db fc 61 da fb 61 db fc 61 da fb 61 da fb 61 db fb 61 da fb 61 da fb 66 e8 ff 61 dc fe 63 df ff 65 e3 ff 68 eb ff 48 d5 c6 94 00 00 00 27 74 52 4e 53 00 08 fb 23 f6 0f 2c e0 d8 eb 5f 93 80 ac f1 9c 45 c0 d0 4c 1c 17 6e 3f 58 e5 b3 34 51 67 b9 79 74 ca 3a a4 c5 87 8c 8c 8d 21 cd 00 00 13 e4 49 44 41 54 78 da ec 5b e9 72 9b 30 10 2e 02 1b 6c 2e 1b 3b Data Ascii: PNGIHDRe5PLTEdaaaaaaaaaaaaaaaaaa`aaaaaaa`aaaaaaaaaaafacehH'tRNS#,_ELn?X4Qgyt:!IDATx[r0.l.;
2024-05-25 23:00:33 UTC	1378	IN	Data Raw: 4e dc 5d c0 6e 80 ef f5 77 b0 4d 18 51 77 01 f9 39 77 62 1c 01 0e ba a3 a8 a0 cf f9 8a cf 50 13 b8 02 63 bb 07 1b f8 da 5b 2f 06 27 60 cf 81 bf 9b 7f 82 c0 81 e2 47 ae 38 d6 ad 6d c0 c5 77 05 e2 e1 bb 34 b8 92 89 ae 40 e0 29 3b e9 f0 82 5e d4 12 87 da 5e 2f 39 0f 55 5a dc f2 1b 7a db 8f 7a 5e c3 63 18 00 9f 8c bd a5 3f 96 b0 db c9 7f fd e5 d2 5b 07 0c ea a5 a6 3c 3c bb fa a4 4b 8b c3 c3 59 a0 e0 01 af 69 50 b1 68 af 30 6c 12 4d 26 59 40 88 54 b9 8a 90 20 c8 26 93 28 6b 5f 57 0b 1c 1d 7b a0 36 8a 02 ec 90 22 b8 d0 d6 0d 01 ef ad 51 36 3d c5 65 11 1a 57 30 2e 38 e7 0c c0 af 20 f0 9a 55 61 71 cc 93 e9 7a f9 1b 1d a3 d0 11 2e 07 68 f1 71 79 a5 51 fd 25 7f b6 8a 8f 57 ce d2 5b cb d5 00 d5 f8 c5 df ea 01 28 94 6b 58 16 1d e3 d5 cc f7 74 ab 67 57 b1 67 f5 07 10 Data Ascii: N]nwMQw9wbPc[/'`G8mw4@);^^/9UZzz^c?[<<KYiPh0lM&Y@T &(k_W{6"Q6=eW0.8 Uaqz.hqyQ%W[(kXtgWg
2024-05-25 23:00:33 UTC	1378	IN	Data Raw: d2 74 81 25 82 93 16 a7 ab 22 07 06 09 f4 fd 91 6b 45 f2 a9 73 a8 12 ea 06 9c 4d 56 64 8d cb 74 02 c3 c8 1a fa e7 48 13 20 1f c7 5c a3 2a a0 7a e8 4c 19 11 d5 05 da 67 db 31 05 29 8d 09 9d 5a 0e d9 03 bd 0b bc b6 46 5b 09 ad ed b0 25 d1 a7 2c 8f bb 1f ae 36 80 b9 8b 80 f2 de ff 79 80 5d f6 1a 68 b1 78 57 52 57 0f d8 ce e8 a0 73 96 93 ed 02 e0 b0 44 00 6d 74 00 92 28 d8 13 e6 20 e2 7e 93 79 98 07 c2 45 18 43 2d 0f 08 c0 3c a5 ed 88 10 85 dd 1a 60 4e b4 80 6d 08 94 ee b1 2a 66 0b 00 c2 e9 06 78 4a 5b 04 b0 ef fe c3 b1 2f 06 01 7d 0b 3b c8 e8 40 f2 1f 10 00 a7 d6 af af 84 6c 06 97 4f af ef 28 8d ed 6a e0 37 4c d2 dc 2a d4 d1 00 8f bf 82 1e 2d 7f 74 67 c5 af f6 ce 74 3b 6d 18 88 c2 45 98 c5 ec 4b d8 12 92 b0 c6 92 ec f7 7f be d6 58 f0 19 84 91 69 44 97 73 98 Data Ascii: t%"kEsMVdtH \zLg1)ZF[%,6y]hxWRWsDmt( ~yEC-<`NmfxJ[/};@lO(j7L*-tgt;mEKXiDs
2024-05-25 23:00:33 UTC	1213	IN	Data Raw: dd b7 10 9a 6a 75 9b e2 90 3c 23 be db 0b da 9e c4 c1 68 3b df 1e d9 48 d5 07 e6 d0 24 e9 8e a2 de fa fa 68 1c 7a 91 29 a2 f8 9d 96 1b fa be 94 a2 f1 ba 3f 64 01 8d 8f 3b 3c ef 59 4c 78 c0 e0 cb 95 fa b2 d3 1d 85 a6 ee a5 8a ee e9 84 ca 34 3a 16 e1 6e db 19 d7 2b a7 72 1a ca 02 e1 7d a6 b3 12 0c 45 c3 6a 6f cb 55 ff 63 d4 08 74 4c fb 8e 1a 8b 9c e7 aa c4 2a 68 8c 5e db d3 71 bd 86 9d 20 dc e1 39 0b 08 40 05 f8 92 67 1a a9 55 df 3a 9a e5 40 49 4b 14 f1 bf b8 53 af d6 ae de a6 6b 45 ac 7d 09 91 a9 2d 7f ba 68 40 3f 39 25 83 8e 37 69 de 4c eb 7d fa 4b de df 5b ad e5 78 36 cb 50 24 6e c1 85 d6 46 81 98 b7 17 01 11 c2 e5 b4 7b 01 b6 43 2f f3 d2 ce 87 36 2d 33 49 b0 8b 3d ab 4f c1 ed c7 40 5c f7 33 81 4b c9 a1 c9 9c ee 3c 61 c5 45 46 92 2d ff 95 fe c8 e8 76 13 Data Ascii: ju<#h;H$hz)?d;<YLx4:n+r}EjoUctL*h^q 9@gU:@IKSkE}-h@?9%7iL}K[x6P$nF{C/6-3I=O@\3K<aEF-v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49750	199.36.158.100	443	332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:33 UTC	380	OUT	GET /resources/logo.png HTTP/1.1 Host: support-ads-team-34d19.firebaseapp.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 23:00:34 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1059 Cache-Control: max-age=3600 Content-Type: image/png Etag: "f1e3d53afa9d6326ac9750e6d679d01c40925c17c63d8ba2574b630025951514" Last-Modified: Sat, 25 May 2024 04:50:20 GMT Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Accept-Ranges: bytes Date: Sat, 25 May 2024 23:00:34 GMT X-Served-By: cache-nyc-kteb1890099-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1716678034.976413,VS0,VE122 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-25 23:00:34 UTC	1059	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 03 d5 49 44 41 54 78 9c ed 56 5b 88 1b 65 14 fe 7a b1 94 a5 f6 a9 50 7c 12 c1 7a 81 5a 7d 50 11 2c 15 7c 69 45 50 8a 5d 14 c1 2a e4 c2 a6 e9 66 37 d9 ec 66 93 dd ee 3f 13 f5 a1 f5 45 45 51 d1 87 62 15 7d 52 b0 88 17 10 75 5f 04 41 ad ae 0f fa a0 cd cd 5c 36 db c4 64 73 99 f9 67 9a 23 f9 27 99 99 6c 32 d3 ea 8b 2f f9 e0 7b c9 e4 9c ef fb cf 39 ff 99 01 c6 18 63 0c 37 78 d3 31 78 52 ab f0 a6 be 85 2f fb 2a fc b9 27 31 f9 eb 2e d7 98 a4 72 3b 24 4d 86 c4 2f 40 d2 5e 02 d3 4e 80 d1 4e fc 2b f8 b2 4f c0 93 6a c2 9b 26 41 5f 86 e0 cf 12 a6 72 84 40 3e 87 40 e1 d1 a1 18 46 bb 20 6b 2f 43 e2 3a 64 Data Ascii: PNGIHDR szzpHYsIDATxV[ezP\|zZ}P,\|iEP]f7f?EEQb}Ru_A\6dsg#'l2/{9c7x1xR/'1.r;$M/@^NN+Oj&A_r@>@F k/C:d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	2.18.97.153	443

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:34 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-25 23:00:34 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=61758 Date: Sat, 25 May 2024 23:00:34 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-25 23:00:34 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49753	199.36.158.100	443	332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-25 23:00:34 UTC	373	OUT	GET /logo192.png HTTP/1.1 Host: support-ads-team-34d19.firebaseapp.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 23:00:34 UTC	591	IN	HTTP/1.1 200 OK Connection: close Content-Length: 5347 Cache-Control: max-age=3600 Content-Type: image/png Etag: "79e2b749561016bc8af300ea19f48347ceed3cb1a54f48ae456172eca45e08f0" Last-Modified: Sat, 25 May 2024 04:50:20 GMT Strict-Transport-Security: max-age=31556926; includeSubDomains; preload Accept-Ranges: bytes Date: Sat, 25 May 2024 23:00:34 GMT X-Served-By: cache-nyc-kteb1890094-NYC X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1716678035.580664,VS0,VE1 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-25 23:00:34 UTC	1378	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 03 00 00 00 65 02 9c 35 00 00 00 87 50 4c 54 45 00 00 00 64 da fb 61 da fc 61 db fc 61 da fc 61 db fc 61 da fb 61 db fc 61 da fb 61 da fc 61 db fc 61 da fc 61 da fc 61 db fc 61 da fc 61 da fc 61 da fb 61 da fb 61 da fb 61 da fc 60 da fb 61 da fb 61 db fb 61 da fc 61 da fc 61 da fc 61 da fc 61 da fb 60 da fb 61 da fb 61 db fc 61 da fc 61 db fc 61 da fb 61 db fc 61 da fb 61 da fb 61 db fb 61 da fb 61 da fb 66 e8 ff 61 dc fe 63 df ff 65 e3 ff 68 eb ff 48 d5 c6 94 00 00 00 27 74 52 4e 53 00 08 fb 23 f6 0f 2c e0 d8 eb 5f 93 80 ac f1 9c 45 c0 d0 4c 1c 17 6e 3f 58 e5 b3 34 51 67 b9 79 74 ca 3a a4 c5 87 8c 8c 8d 21 cd 00 00 13 e4 49 44 41 54 78 da ec 5b e9 72 9b 30 10 2e 02 1b 6c 2e 1b 3b Data Ascii: PNGIHDRe5PLTEdaaaaaaaaaaaaaaaaaa`aaaaaaa`aaaaaaaaaaafacehH'tRNS#,_ELn?X4Qgyt:!IDATx[r0.l.;
2024-05-25 23:00:34 UTC	1378	IN	Data Raw: 4e dc 5d c0 6e 80 ef f5 77 b0 4d 18 51 77 01 f9 39 77 62 1c 01 0e ba a3 a8 a0 cf f9 8a cf 50 13 b8 02 63 bb 07 1b f8 da 5b 2f 06 27 60 cf 81 bf 9b 7f 82 c0 81 e2 47 ae 38 d6 ad 6d c0 c5 77 05 e2 e1 bb 34 b8 92 89 ae 40 e0 29 3b e9 f0 82 5e d4 12 87 da 5e 2f 39 0f 55 5a dc f2 1b 7a db 8f 7a 5e c3 63 18 00 9f 8c bd a5 3f 96 b0 db c9 7f fd e5 d2 5b 07 0c ea a5 a6 3c 3c bb fa a4 4b 8b c3 c3 59 a0 e0 01 af 69 50 b1 68 af 30 6c 12 4d 26 59 40 88 54 b9 8a 90 20 c8 26 93 28 6b 5f 57 0b 1c 1d 7b a0 36 8a 02 ec 90 22 b8 d0 d6 0d 01 ef ad 51 36 3d c5 65 11 1a 57 30 2e 38 e7 0c c0 af 20 f0 9a 55 61 71 cc 93 e9 7a f9 1b 1d a3 d0 11 2e 07 68 f1 71 79 a5 51 fd 25 7f b6 8a 8f 57 ce d2 5b cb d5 00 d5 f8 c5 df ea 01 28 94 6b 58 16 1d e3 d5 cc f7 74 ab 67 57 b1 67 f5 07 10 Data Ascii: N]nwMQw9wbPc[/'`G8mw4@);^^/9UZzz^c?[<<KYiPh0lM&Y@T &(k_W{6"Q6=eW0.8 Uaqz.hqyQ%W[(kXtgWg
2024-05-25 23:00:34 UTC	1378	IN	Data Raw: d2 74 81 25 82 93 16 a7 ab 22 07 06 09 f4 fd 91 6b 45 f2 a9 73 a8 12 ea 06 9c 4d 56 64 8d cb 74 02 c3 c8 1a fa e7 48 13 20 1f c7 5c a3 2a a0 7a e8 4c 19 11 d5 05 da 67 db 31 05 29 8d 09 9d 5a 0e d9 03 bd 0b bc b6 46 5b 09 ad ed b0 25 d1 a7 2c 8f bb 1f ae 36 80 b9 8b 80 f2 de ff 79 80 5d f6 1a 68 b1 78 57 52 57 0f d8 ce e8 a0 73 96 93 ed 02 e0 b0 44 00 6d 74 00 92 28 d8 13 e6 20 e2 7e 93 79 98 07 c2 45 18 43 2d 0f 08 c0 3c a5 ed 88 10 85 dd 1a 60 4e b4 80 6d 08 94 ee b1 2a 66 0b 00 c2 e9 06 78 4a 5b 04 b0 ef fe c3 b1 2f 06 01 7d 0b 3b c8 e8 40 f2 1f 10 00 a7 d6 af af 84 6c 06 97 4f af ef 28 8d ed 6a e0 37 4c d2 dc 2a d4 d1 00 8f bf 82 1e 2d 7f 74 67 c5 af f6 ce 74 3b 6d 18 88 c2 45 98 c5 ec 4b d8 12 92 b0 c6 92 ec f7 7f be d6 58 f0 19 84 91 69 44 97 73 98 Data Ascii: t%"kEsMVdtH \zLg1)ZF[%,6y]hxWRWsDmt( ~yEC-<`NmfxJ[/};@lO(j7L*-tgt;mEKXiDs
2024-05-25 23:00:34 UTC	1213	IN	Data Raw: dd b7 10 9a 6a 75 9b e2 90 3c 23 be db 0b da 9e c4 c1 68 3b df 1e d9 48 d5 07 e6 d0 24 e9 8e a2 de fa fa 68 1c 7a 91 29 a2 f8 9d 96 1b fa be 94 a2 f1 ba 3f 64 01 8d 8f 3b 3c ef 59 4c 78 c0 e0 cb 95 fa b2 d3 1d 85 a6 ee a5 8a ee e9 84 ca 34 3a 16 e1 6e db 19 d7 2b a7 72 1a ca 02 e1 7d a6 b3 12 0c 45 c3 6a 6f cb 55 ff 63 d4 08 74 4c fb 8e 1a 8b 9c e7 aa c4 2a 68 8c 5e db d3 71 bd 86 9d 20 dc e1 39 0b 08 40 05 f8 92 67 1a a9 55 df 3a 9a e5 40 49 4b 14 f1 bf b8 53 af d6 ae de a6 6b 45 ac 7d 09 91 a9 2d 7f ba 68 40 3f 39 25 83 8e 37 69 de 4c eb 7d fa 4b de df 5b ad e5 78 36 cb 50 24 6e c1 85 d6 46 81 98 b7 17 01 11 c2 e5 b4 7b 01 b6 43 2f f3 d2 ce 87 36 2d 33 49 b0 8b 3d ab 4f c1 ed c7 40 5c f7 33 81 4b c9 a1 c9 9c ee 3c 61 c5 45 46 92 2d ff 95 fe c8 e8 76 13 Data Ascii: ju<#h;H$hz)?d;<YLx4:n+r}EjoUctL*h^q 9@gU:@IKSkE}-h@?9%7iL}K[x6P$nF{C/6-3I=O@\3K<aEF-v

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 3320, Parent PID: 4136

General

Target ID:	0
Start time:	19:00:23
Start date:	25/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 332, Parent PID: 3320

General

Target ID:	2
Start time:	19:00:25
Start date:	25/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1996,i,14774615609112291354,10908193720494069642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6528, Parent PID: 4136

General

Target ID:	3
Start time:	19:00:27
Start date:	25/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://support-ads-team-34d19.firebaseapp.com/form-2122.html"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://support-ads-team-34d19.firebaseapp.com/form-2122.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\LICENSE

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\manifest.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3320_870031627\sets.json

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
https://support-ads-team-34d19.firebaseapp.com/form-2122.html