Edit tour

Windows Analysis Report
https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=

Overview

General Information

Sample URL:	https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJld
Analysis ID:	1335391
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

Antivirus detection for URL or domain

Phishing site detected (based on logo match)

HTML page contains suspicious base64 encoded javascript

Queries the volume information (name, serial number etc) of a device

Tries to load missing DLLs

May sleep (evasive loops) to hinder dynamic analysis

Creates files inside the system directory

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

Queries disk information (often used to detect virtual machines)

HTML body contains low number of good links

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2708 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2492,i,13105963091664610280,11088904957303296271,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

svchost.exe (PID: 1868 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

chrome.exe (PID: 6468 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw= MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
2.4.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary
• Malware Analysis System Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://zoom-meeting.top/main/main.php

Avira URL Cloud: Label: phishing

Phishing

Phishing site detected (based on favicon image match)

Source: https://zoom-meeting.top	Matcher: Template: outlook matched with high similarity
Source: https://zoom-meeting.top/main/main.php#nJWNezGWtoPjzqYo8tSuUKag6QqYRKvfus3J2JGv8vOHWN55gYzbJJsPzTNrDjH8MKROtxjC38jZWp4dnEp7nRWXKKoo45xQQpEkWYW06gZ3F4g3IFa6x73iRsHVyeMpDqJAoGAvWAyBFPEovOu3WylN13JAhvZVWJwkp6QlHpXmfBLKqfNmO9aQcTqupqpl9WGz2xUKWR7ctSWU8KgWUrM7ldBKD16MXMl0kgKh8StCKpwSaNP4eBczONkrPqeNdANxRyOZqhBbH83RVSW9u8IjW2KLtZyGAmerV2qlk2x1aBT5uQfYZYhV12Hu1gbCCp3xsuTMwqOH2HNwy2ux1Ms2O9wQqHs27vAzZtlwUaeWS1sq4XX5Jq7xAEo0lQ2tmD2m7oT1y7Yq8rRcoPh7fpFP33PpUSShvUDCjwEREDiM4aZsZhAeGg4JkT8fM0wiVaVeHA6ldo7hz7KyolM4CQOWKWbxXHQSSL7zmdUzC2Rb9CJxYwCAmqw7nHFkpvdhgkQDyLcaN4lWG5uEB6eYxK6UsLfSgsaxN0alMmwzqSw7X0Lz70xEKDydoN6Fggc4gmq3JWCaO9hM92lh2TVNxu1Wi7BynNDEa3HTZk3OtlADoWUrQQeokgkCnWbLJOqUR7ORsRFVcgyBdt24jgsExNhVJtGth7n9eb1H3GCgXbRbFTfZaIDHvVDeokIGr5QGhRnky0BwcsHRlXQwFuebpRqOb8uCekjvcGQKHrgTTYLfWBLC60NwRek3mPFA9Z6mGW6nnnghm1wiDiUKiHgaVBdiqTTASZWyW3VjrcBNe85SqZDJHUTDv6WWZPwRPtqLwl5XyGKNPQFfQiYxcSbIY7EYXaQMDgyaCE8alSXaJDqzWp79hjRgqveoG4bklJvXoD7Jw5UfJkOFJWO0fGgGcv4TAfeVZJSnm07S617PlWv4Tk580mOdRT6s8kn84gvqgCjnDrdYoI3h28q3uehl8oNgJboNrUdIxx5aYi9m1cD4k38PipaqNYHwa6kB1yky5pI3ISpJ43Op6WepmpQ9oxGyE1aFzudEUWHDP7nUabjh7yHtYxDn5kWJm6pVBDzvzh8ppwjAHCRPbyja6WxbhtVDAkzbX9HxqQWQmfq4SiT4RceX9M8qg34QoD2mMKTdBQ3Y6u2YMV3D8iBh4KIlNMccpfycZspBitzoYCnKyroGJZXOKF9ysmKSBi4BKuc3YMrWpPHXg5E05BOPhYnJk8CWqGxbbKeaxG6WvNUMTyMZaBOszccUkOQLvoXG9bQGSXDnLxaE6WEhytJ8FV20JTMfiJWrUM7NKLavjlapiOHQiqYXm0Y6UKlcuhDp4LcOwmkQIvf0kXQCnOAJPyQJjbWNsAcxlomSLGItcYtxVk9j8K3YiTIC4EqxeC4A1qtM7bgkaKR640pdLsb3mTGry6YNJ3oKuRxC3OWdyNjDOJQzc2DyWkZvqYi92GUwys9Bg5PPT9sISjh4mVDifDNGB6QDMKalcjWtoLiiVK0N4iSqdwJt9waKD0oqLyLYSHrhtJzouzczS5Z6BIzKfKvSKTivs3ukLVBeFbDaLPJDUJJwsjgI3MANGTj8XNtJJ5XpgBz1rjEm2oSvH9dLVNzBHTKFHdoqimQzXpApJfLLEDgmNt7JhHkZA5Ehi3IBpyanYLMH1xtGbJ2ZdaIvR2vs89Kqcs2C1dZZZMH1jaHvUKu8UcDMf8fniZOvrR7s47s4Ta5dkNJfxensq1fGau4ttTYUK6nPeQU80ZmlM5AkjYMKZ2rawvDZpCU9JiZY9T69TsvGx60R4NB4Q2emySmXvg7ez7cI0jSULnAjtBbxpMCfPRBoKXmfetuNAHvB0ovML66fHhN74pmUgYi0VEga8KYJstktRQfDXlSFCFMH59Bl7Tm3yDdGobqQFLjxCzazV3fyJ1fOaQaiKwljay0yJqppbJWNi7ndbCLUE1IORS6CprVz0V8Klx9xh6kAeHNpkzjYA1NsUT4jl0SmV16hzgPQm9qBRe0bOjaplXSfRXzdXszTtGb2W0TjakU1zVdnfnNAlFQcCppzRYtlEEoBEhUOCPQbK4yZrlAM1rZDRocJnG41ksDYKyNmnDx8H689sIWtaV61kjKHZPJkhmi2U6piJWqr3yBvhxZrt5sNpcup1eJjA2mv8LNSIdkLMVh3sguWmWJL9eabsUu3WRy5CmXkzh6lcnpFDTB0QlL0AWb3RG7NxFS92QtB8zXlXn1BgDB7Ym7zjiDaYKYwqRFsI94QJ1cGodhFQSMPfUozc1KbLIHcAnEiwI9gKlW8yeOo6BemvCWIEGUqpCCZZgiwZrMJNJSlXGK4iYqOBmwg3rGs4js3ALAzdni06bm3R77a6yYIVvYYWFr0YU4zFF8T2rT8CgcunkEtSCbO7aN4Pf5N99mPOvIRWCZzSc3fwIJplUdt51xUgCIqM5gBAYsxAr7tDbIaTszenNHsOfm5S4wE9MfKKHil9pONAxXuZxJnkqP9GbfygLcqxrai9tDiSs5t02X0zGnU7c4OojmE4z4C1fUaIytB0y41B21bJo6RBaFZt2EyCIaDY5OGDhiEQnFrpGD95J1HTHGnJlWm37Z2cNJP51tVo8nOP0YVKZCEGj1qEYMI5MKhzt7FvAATJYIzYGuJG7nmqpN5nzOslyKV2RBysbrb9aK8RfRxmeTNEGS1gHuCfeyi69QyliKutvDkKvR7KKUorNpIuUkK8S3f2UNncxSF3v0N1RULCPa3DAL7u6SDZWS1QFp3dhJgNJ4PAZAcOKgsk2AP8ss8okafZzidR1tFKyukx5xlPNOaPoZYQs6fMhuMQMZIOtny1RTyWqUMeIX36X2Xp8cbpHXguXYiqmRrdKZabUXpCUtJSvGhETt3Ark5oinPFfgSZg3aa0ANV3wOzc6d6zhH1BMpUaezpvspLwAWxaKseghOtn1zWjhYU3nPeCpE8R3UoDQVOAo3RFRl2TUZccX7flWuYm86ec1CQRxE#c.bakker@medireva.nl	Matcher: Template: outlook matched with high similarity

Yara detected HtmlPhish10

Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML

Phishing site detected (based on logo match)

Matcher: Template: microsoft matched

HTML page contains suspicious base64 encoded javascript

Source: https://zoom-meeting.top/main/

HTTP Parser: Base64 decoded: <script>

Source: https://zoom-meeting.top/main/main.php#nJWNezGWtoPjzqYo8tSuUKag6QqYRKvfus3J2JGv8vOHWN55gYzbJJsPzTNrDjH8MKROtxjC38jZWp4dnEp7nRWXKKoo45xQQpEkWYW06gZ3F4g3IFa6x73iRsHVyeMpDqJAoGAvWAyBFPEovOu3WylN13JAhvZVWJwkp6QlHpXmfBLKqfNmO9aQcTqupqpl9WGz2xUKWR7ctSWU8KgWUrM7ldBKD16MXMl0kgKh8StCKpwSaNP4eBczONkrPqeNdANxRyOZqhBbH83RVSW9u8IjW2KLtZyGAmerV2qlk2x1aBT5uQfYZYhV12Hu1gbCCp3xsuTMwqOH2HNwy2ux1Ms2O9wQqHs27vAzZtlwUaeWS1sq4XX5Jq7xAEo0lQ2tmD2m7oT1y7Yq8rRcoPh7fpFP33PpUSShvUDCjwEREDiM4aZsZhAeGg4JkT8fM0wiVaVeHA6ldo7hz7KyolM4CQOWKWbxXHQSSL7zmdUzC2Rb9CJxYwCAmqw7nHFkpvdhgkQDyLcaN4lWG5uEB6eYxK6UsLfSgsaxN0alMmwzqSw7X0Lz70xEKDydoN6Fggc4gmq3JWCaO9hM92lh2TVNxu1Wi7BynNDEa3HTZk3OtlADoWUrQQeokgkCnWbLJOqUR7ORsRFVcgyBdt24jgsExNhVJtGth7n9eb1H3GCgXbRbFTfZaIDHvVDeokIGr5QGhRnky0BwcsHRlXQwFuebpRqOb8uCekjvcGQKHrgTTYLfWBLC60NwRek3mPFA9Z6mGW6nnnghm1wiDiUKiHgaVBdiqTTASZWyW3VjrcBNe85SqZDJHUTDv6WWZPwRPtqLwl5XyGKNPQFfQiYxcSbIY7EYXaQMDgyaCE8alSXaJDqzWp79hjRgqveoG4bklJvXoD7Jw5UfJkOFJWO0fGgGcv4TAfeVZJSnm07S617PlWv4Tk580mOdRT6s8kn84gvqgCjnDrdYoI3h28q3uehl8oNgJ...

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://zoom-meeting.top/main/

HTTP Parser: Base64 decoded: <script> // disable right click document.addEventListener('contextmenu', event => event.preventDefault()); document.onkeydown = function (e) { // disable F12 key if(e.keyCode == 123) { return false; } ...

HTTP Parser: Number of links: 0

HTTP Parser: Title: Login does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://zoom-meeting.top/main/	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/14tba/0x4AAAAAAAMdtIbwKKuijiyA/auto/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/14tba/0x4AAAAAAAMdtIbwKKuijiyA/auto/normal	HTTP Parser: No favicon

Source: https://zoom-meeting.top/main/main.php#nJWNezGWtoPjzqYo8tSuUKag6QqYRKvfus3J2JGv8vOHWN55gYzbJJsPzTNrDjH8MKROtxjC38jZWp4dnEp7nRWXKKoo45xQQpEkWYW06gZ3F4g3IFa6x73iRsHVyeMpDqJAoGAvWAyBFPEovOu3WylN13JAhvZVWJwkp6QlHpXmfBLKqfNmO9aQcTqupqpl9WGz2xUKWR7ctSWU8KgWUrM7ldBKD16MXMl0kgKh8StCKpwSaNP4eBczONkrPqeNdANxRyOZqhBbH83RVSW9u8IjW2KLtZyGAmerV2qlk2x1aBT5uQfYZYhV12Hu1gbCCp3xsuTMwqOH2HNwy2ux1Ms2O9wQqHs27vAzZtlwUaeWS1sq4XX5Jq7xAEo0lQ2tmD2m7oT1y7Yq8rRcoPh7fpFP33PpUSShvUDCjwEREDiM4aZsZhAeGg4JkT8fM0wiVaVeHA6ldo7hz7KyolM4CQOWKWbxXHQSSL7zmdUzC2Rb9CJxYwCAmqw7nHFkpvdhgkQDyLcaN4lWG5uEB6eYxK6UsLfSgsaxN0alMmwzqSw7X0Lz70xEKDydoN6Fggc4gmq3JWCaO9hM92lh2TVNxu1Wi7BynNDEa3HTZk3OtlADoWUrQQeokgkCnWbLJOqUR7ORsRFVcgyBdt24jgsExNhVJtGth7n9eb1H3GCgXbRbFTfZaIDHvVDeokIGr5QGhRnky0BwcsHRlXQwFuebpRqOb8uCekjvcGQKHrgTTYLfWBLC60NwRek3mPFA9Z6mGW6nnnghm1wiDiUKiHgaVBdiqTTASZWyW3VjrcBNe85SqZDJHUTDv6WWZPwRPtqLwl5XyGKNPQFfQiYxcSbIY7EYXaQMDgyaCE8alSXaJDqzWp79hjRgqveoG4bklJvXoD7Jw5UfJkOFJWO0fGgGcv4TAfeVZJSnm07S617PlWv4Tk580mOdRT6s8kn84gvqgCjnDrdYoI3h28q3uehl8oNgJ...	HTTP Parser: No <meta name="copyright".. found
Source: https://zoom-meeting.top/main/main.php#nJWNezGWtoPjzqYo8tSuUKag6QqYRKvfus3J2JGv8vOHWN55gYzbJJsPzTNrDjH8MKROtxjC38jZWp4dnEp7nRWXKKoo45xQQpEkWYW06gZ3F4g3IFa6x73iRsHVyeMpDqJAoGAvWAyBFPEovOu3WylN13JAhvZVWJwkp6QlHpXmfBLKqfNmO9aQcTqupqpl9WGz2xUKWR7ctSWU8KgWUrM7ldBKD16MXMl0kgKh8StCKpwSaNP4eBczONkrPqeNdANxRyOZqhBbH83RVSW9u8IjW2KLtZyGAmerV2qlk2x1aBT5uQfYZYhV12Hu1gbCCp3xsuTMwqOH2HNwy2ux1Ms2O9wQqHs27vAzZtlwUaeWS1sq4XX5Jq7xAEo0lQ2tmD2m7oT1y7Yq8rRcoPh7fpFP33PpUSShvUDCjwEREDiM4aZsZhAeGg4JkT8fM0wiVaVeHA6ldo7hz7KyolM4CQOWKWbxXHQSSL7zmdUzC2Rb9CJxYwCAmqw7nHFkpvdhgkQDyLcaN4lWG5uEB6eYxK6UsLfSgsaxN0alMmwzqSw7X0Lz70xEKDydoN6Fggc4gmq3JWCaO9hM92lh2TVNxu1Wi7BynNDEa3HTZk3OtlADoWUrQQeokgkCnWbLJOqUR7ORsRFVcgyBdt24jgsExNhVJtGth7n9eb1H3GCgXbRbFTfZaIDHvVDeokIGr5QGhRnky0BwcsHRlXQwFuebpRqOb8uCekjvcGQKHrgTTYLfWBLC60NwRek3mPFA9Z6mGW6nnnghm1wiDiUKiHgaVBdiqTTASZWyW3VjrcBNe85SqZDJHUTDv6WWZPwRPtqLwl5XyGKNPQFfQiYxcSbIY7EYXaQMDgyaCE8alSXaJDqzWp79hjRgqveoG4bklJvXoD7Jw5UfJkOFJWO0fGgGcv4TAfeVZJSnm07S617PlWv4Tk580mOdRT6s8kn84gvqgCjnDrdYoI3h28q3uehl8oNgJ...	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49813 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: svchost.exe, 00000001.00000002.2503297780.000001EBA78B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000001.00000002.2503247786.000001EBA7895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 00000001.00000002.2503247786.000001EBA7895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/D96
Source: svchost.exe, 00000001.00000002.2503247786.000001EBA7895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/FD96
Source: svchost.exe, 00000001.00000003.1685708613.000001EBA7A58000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000001.00000003.1685708613.000001EBA7A58000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000001.00000003.1685708613.000001EBA7A58000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000001.00000002.2503247786.000001EBA7861000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2312208621.000001EBA7A41000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/axx2pfbv7uq6qptuqj7vcp4aku_2023.10.12.0/g
Source: svchost.exe, 00000001.00000002.2502786179.000001EBA2D02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1685708613.000001EBA7A8D000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000001.00000002.2503247786.000001EBA7861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: qmgr.db.1.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: chromecache_78.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: svchost.exe, 00000001.00000003.1685708613.000001EBA7B02000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000001.00000003.1685708613.000001EBA7B02000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: chromecache_95.2.dr, chromecache_72.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_95.2.dr, chromecache_72.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_72.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: svchost.exe, 00000001.00000003.1685708613.000001EBA7B02000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.1.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw= HTTP/1.1Host: zoom-meeting.topConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index.php?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw= HTTP/1.1Host: zoom-meeting.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /main/ HTTP/1.1Host: zoom-meeting.topConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=muhgooi7klmprcut1jd5a6vml5
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/61b90d1d/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/14tba/0x4AAAAAAAMdtIbwKKuijiyA/auto/normal HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=81f3652c0bb8576a HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/14tba/0x4AAAAAAAMdtIbwKKuijiyA/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/14tba/0x4AAAAAAAMdtIbwKKuijiyA/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: zoom-meeting.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/main/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=muhgooi7klmprcut1jd5a6vml5
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: zoom-meeting.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=muhgooi7klmprcut1jd5a6vml5
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1055797790:1698833333:Xv25X_gApLBM-ZAelZ-de14cATei4i97vw4UcgafKo0/81f3652c0bb8576a/6f65b3be807cf62 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/81f3652c0bb8576a/1698833924116/vb1zBgJU43adZ6n HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/14tba/0x4AAAAAAAMdtIbwKKuijiyA/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/81f3652c0bb8576a/1698833924116/vb1zBgJU43adZ6n HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/81f3652c0bb8576a/1698833924116/759c2a2292431c8c7b9fbdfc5dc738e8590815389ca7f36af3ca0b338c590a53/Gwt3EWj6efSvl_W HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/14tba/0x4AAAAAAAMdtIbwKKuijiyA/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1055797790:1698833333:Xv25X_gApLBM-ZAelZ-de14cATei4i97vw4UcgafKo0/81f3652c0bb8576a/6f65b3be807cf62 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RgWrxEyzmVEYMW3&MD=2HSL48sL HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1055797790:1698833333:Xv25X_gApLBM-ZAelZ-de14cATei4i97vw4UcgafKo0/81f3652c0bb8576a/6f65b3be807cf62 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_authenticator_f07afb27ad510dc785a94e802e3d7f73.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.3.1/css/bootstrap.min.css HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://zoom-meeting.topsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/3.1.1/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://zoom-meeting.topsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.3.1/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://zoom-meeting.topsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.14.7/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://zoom-meeting.topsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3u0LD6s HTTP/1.1Host: bit.lyConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_authenticator_f07afb27ad510dc785a94e802e3d7f73.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_code_f7ab697e65b83ce9870a4736085deeec.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_authenticator_f07afb27ad510dc785a94e802e3d7f73.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/logo.png HTTP/1.1Host: simgbb.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_authenticator_f07afb27ad510dc785a94e802e3d7f73.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_code_f7ab697e65b83ce9870a4736085deeec.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fNMyldZ.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/logo.png HTTP/1.1Host: simgbb.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fNMyldZ.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mail/favicon.ico HTTP/1.1Host: outlook.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mail/favicon.ico HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/validate HTTP/1.1Host: pnp-api.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/image HTTP/1.1Host: pnp-api.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-ii40sur12au0ckt0-acp1sdwgam6aamluo-cwvy2iwc/logintenantbranding/0/bannerlogo?ts=637394865589068407 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zoom-meeting.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-ii40sur12au0ckt0-acp1sdwgam6aamluo-cwvy2iwc/logintenantbranding/0/bannerlogo?ts=637394865589068407 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /main/main.php HTTP/1.1Host: zoom-meeting.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=muhgooi7klmprcut1jd5a6vml5
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RgWrxEyzmVEYMW3&MD=2HSL48sL HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49813 version: TLS 1.2

Source: C:\Windows\System32\svchost.exe

Section loaded: pcwum.dll

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_2708_2007262443

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2492,i,13105963091664610280,11088904957303296271,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2492,i,13105963091664610280,11088904957303296271,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: classification engine

Classification label: mal80.phis.win@21/41@46/23

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\svchost.exe TID: 2872

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: svchost.exe, 00000001.00000002.2502434058.000001EBA242B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2502452408.000001EBA2443000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2503216885.000001EBA7855000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	21 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=	0%	Avira URL Cloud	safe
https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label	Link
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_authenticator_f07afb27ad510dc785a94e802e3d7f73.svg	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	0%	Avira URL Cloud	safe
https://pnp-api.com/api/image	0%	Avira URL Cloud	safe
https://zoom-meeting.top/index.php?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://zoom-meeting.top/favicon.ico	0%	Avira URL Cloud	safe
https://pnp-api.com/api/validate	0%	Avira URL Cloud	safe
https://zoom-meeting.top/main/main.php	100%	Avira URL Cloud	phishing
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg	0%	Avira URL Cloud	safe
https://simgbb.com/images/logo.png	0%	Avira URL Cloud	safe
https://zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	0%	Virustotal		Browse
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg	0%	Avira URL Cloud	safe
https://aadcdn.msauthimages.net/c1c6b6c8-ii40sur12au0ckt0-acp1sdwgam6aamluo-cwvy2iwc/logintenantbranding/0/bannerlogo?ts=637394865589068407	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg	0%	Virustotal		Browse
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg	0%	Virustotal		Browse
https://simgbb.com/images/logo.png	0%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
stackpath.bootstrapcdn.com	104.18.10.207	true	false	high
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
accounts.google.com	142.251.167.84	true	false	high
simgbb.com	104.21.4.104	true	false	unknown
pnp-api.com	160.20.145.170	true	false	unknown
MNZ-efz.ms-acdc.office.com	52.96.230.162	true	false	high
cs1025.wpc.upsiloncdn.net	152.199.4.73	true	false	unknown
zoom-meeting.top	198.98.49.107	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	high
bit.ly	67.199.248.11	true	false	high
challenges.cloudflare.com	104.17.2.184	true	false	high
www.google.com	142.251.167.147	true	false	high
part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	unknown
clients.l.google.com	172.253.115.100	true	false	high
ipv4.imgur.map.fastly.net	146.75.28.193	true	false	unknown
outlook.office.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
aadcdn.msauthimages.net	unknown	unknown	false	unknown
clients2.google.com	unknown	unknown	false	high
i.imgur.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js	false		high
https://pnp-api.com/api/image	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js	false		high
https://i.imgur.com/fNMyldZ.png	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_authenticator_f07afb27ad510dc785a94e802e3d7f73.svg	false	Avira URL Cloud: safe	unknown
https://zoom-meeting.top/main/	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/81f3652c0bb8576a/1698833924116/vb1zBgJU43adZ6n	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js	false		high
https://zoom-meeting.top/index.php?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=81f3652c0bb8576a	false		high
https://zoom-meeting.top/favicon.ico	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://challenges.cloudflare.com/turnstile/v0/b/61b90d1d/api.js?onload=onloadTurnstileCallback	false		high
https://outlook.office.com/mail/favicon.ico	false		high
https://bit.ly/3u0LD6s	false		high
https://pnp-api.com/api/validate	false	Avira URL Cloud: safe	unknown
https://zoom-meeting.top/main/main.php	false	Avira URL Cloud: phishing	unknown
https://zoom-meeting.top/main/	true		unknown
https://zoom-meeting.top/main/main.php##	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://simgbb.com/images/logo.png	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1055797790:1698833333:Xv25X_gApLBM-ZAelZ-de14cATei4i97vw4UcgafKo0/81f3652c0bb8576a/6f65b3be807cf62	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/14tba/0x4AAAAAAAMdtIbwKKuijiyA/auto/normal	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/14tba/0x4AAAAAAAMdtIbwKKuijiyA/auto/normal	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false		high
https://aadcdn.msauthimages.net/c1c6b6c8-ii40sur12au0ckt0-acp1sdwgam6aamluo-cwvy2iwc/logintenantbranding/0/bannerlogo?ts=637394865589068407	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/81f3652c0bb8576a/1698833924116/759c2a2292431c8c7b9fbdfc5dc738e8590815389ca7f36af3ca0b338c590a53/Gwt3EWj6efSvl_W	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000001.00000002.2503297780.000001EBA78B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.1.dr, qmgr.db.1.dr	false		high
https://getbootstrap.com/)	chromecache_95.2.dr, chromecache_72.2.dr	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.1.dr, qmgr.db.1.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.1.dr, qmgr.db.1.dr	false		high
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_72.2.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000001.00000003.1685708613.000001EBA7B02000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_95.2.dr, chromecache_72.2.dr	false		high
http://opensource.org/licenses/MIT).	chromecache_78.2.dr	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000001.00000003.1685708613.000001EBA7B02000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.10.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
13.107.246.40	part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.167.147	www.google.com	United States	15169	GOOGLEUS	false
172.67.131.251	unknown	United States	13335	CLOUDFLARENETUS	false
152.199.4.73	cs1025.wpc.upsiloncdn.net	United States	15133	EDGECASTUS	false
198.98.49.107	zoom-meeting.top	United States	53667	PONYNETUS	false
52.96.230.162	MNZ-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.17.3.184	unknown	United States	13335	CLOUDFLARENETUS	false
172.253.115.100	clients.l.google.com	United States	15169	GOOGLEUS	false
67.199.248.11	bit.ly	United States	396982	GOOGLE-PRIVATE-CLOUDUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
160.20.145.170	pnp-api.com	Germany	30823	COMBAHTONcombahtonGmbHDE	false
142.251.167.84	accounts.google.com	United States	15169	GOOGLEUS	false
104.21.4.104	simgbb.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.96.69.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.17.2.184	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
146.75.28.193	ipv4.imgur.map.fastly.net	Sweden	30051	SCCGOVUS	false

Private

IP
192.168.2.7
192.168.2.4
192.168.2.6
127.0.0.1

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1335391
Start date and time:	2023-11-01 11:17:42 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.phis.win@21/41@46/23
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://zoom-meeting.top/main/main.php##

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 142.251.167.94, 34.104.35.123, 34.249.100.50, 23.220.136.112, 142.251.111.95, 142.251.163.95, 172.253.63.95, 172.253.115.95, 172.253.122.95, 142.251.167.95, 142.251.16.95, 172.253.62.95, 192.229.211.108, 142.251.111.94
Excluded domains from analysis (whitelisted): fs.microsoft.com, content-autofill.googleapis.com, slscr.update.microsoft.com, aadcdnoriginwus2.azureedge.net, clientservices.googleapis.com, aadcdn.msauth.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, aadcdn.azureedge.net, aadcdn.ec.azureedge.net, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, tap-rt-prod1-t.campaign.adobe.com, prod.fs.microsoft.com.akadns.net, tap-rt-prod1-lb.campaign.adobe.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
11:18:35	API Interceptor	2x Sleep call for process: svchost.exe modified

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3267241910925955
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrx:KooCEYhgYEL0In
MD5:	0A3A00ECE3EDF80659634CD4BF25B690
SHA1:	F62F0A02DE0171935C42E88E8CEDE48D9BCA9315
SHA-256:	250AB597A4BF8AD48E41D1366EB8BBD67365234B67F58B569E4030533F4634C5
SHA-512:	47EC16CAAAB85DCA8C43E3C60FB271C88819317EC4992C3D6C8A0C80866C5DB34160216E207CEB591117B24204BC1E99AF9D88C18D401377010DE069094D01F9
Malicious:	false
Reputation:	low
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	downloaded
Size (bytes):	7886
Entropy (8bit):	4.14434000076088
Encrypted:	false
SSDEEP:	48:gFLLLLLLBWj2P+W3DS4E4U4R7454y4aR+BddHOlFgWSsjfQeiFzm22lhCa1I/CPP:tjQDdNKevXOl/amZP
MD5:	AC16FA7FC862073B02ACD1187FC6DEF4
SHA1:	F2B9A6255F6293000F30EEE272ABDD372A14E9D3
SHA-256:	E35D94B76894D6ECA96FF5B1A12D94DFE73485EF3C52CB5B4395BE8FFAC1CB45
SHA-512:	FF0884F9F3DED38191C7D1F214545509E80DE614BC824395F3C9412AED8D81DB95BA7E761939AC1F1798C1D39A7969A3DBF373D03A88404345714EDD8165F19D
Malicious:	false
Reputation:	low
URL:	https://outlook.office.com/mail/favicon.ico
Preview:	...... .... .....6......... ............... .h...f...(... ...@..... ..........................................................................................................................................................................................................................................................................................................................(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..'.....................................(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(.....~......................................(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(..(.."................................................ ... ... ... ... ... ... ... .."..(..(..(..(..(..(..(..(..$.....}...............................................y...y...y...y...y...y...y...y...y...%..(..(..(..(..(..'.....\|..............................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2023 11:18:36.304703951 CET	53	59695	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:36.378453970 CET	57149	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:36.378793001 CET	57200	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:36.382411003 CET	59196	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:36.382847071 CET	61010	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:36.472251892 CET	53	57149	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:36.473165989 CET	53	57200	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:36.475033998 CET	53	59196	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:36.475233078 CET	53	61010	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:37.073570013 CET	53	65341	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:38.562532902 CET	57430	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:38.562851906 CET	59186	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:38.944422007 CET	53	57430	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:39.154310942 CET	58088	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:39.154951096 CET	52274	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:39.154985905 CET	53	59186	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:39.248013973 CET	53	58088	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:39.248389006 CET	53	52274	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:40.069161892 CET	53492	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:40.069670916 CET	51088	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:40.071522951 CET	51827	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:40.075217962 CET	53652	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:40.161649942 CET	53	53492	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:40.162331104 CET	53	51088	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:40.163827896 CET	53	51827	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:40.168642998 CET	53	53652	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:41.027350903 CET	64398	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:41.028264999 CET	58475	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:41.121519089 CET	53	64398	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:41.121542931 CET	53	58475	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:41.474106073 CET	49376	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:41.474688053 CET	60573	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:41.566911936 CET	53	49376	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:41.568003893 CET	53	60573	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:43.345850945 CET	55295	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:43.346302032 CET	50965	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:43.440376043 CET	53	50965	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:43.449321032 CET	53	55295	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:43.799669027 CET	51287	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:43.800035000 CET	64855	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:43.915250063 CET	53	64855	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:43.916799068 CET	53	51287	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:54.747085094 CET	53	59531	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:56.519043922 CET	138	138	192.168.2.4	192.168.2.255
Nov 1, 2023 11:18:57.550086975 CET	57692	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:57.550436974 CET	57967	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:57.561774969 CET	61581	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:57.562232018 CET	56702	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:57.626312017 CET	51781	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:57.626558065 CET	60152	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:57.643167973 CET	53	57692	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:57.644649029 CET	53	57967	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:57.654172897 CET	53	61581	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:57.655334949 CET	53	56702	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:57.718575954 CET	53	51781	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:57.719440937 CET	53	60152	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:58.162621021 CET	50688	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:58.162844896 CET	62419	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:58.257318020 CET	53	62419	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:58.257428885 CET	53	50688	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:58.318856001 CET	61667	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:58.319251060 CET	58058	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:58.365782022 CET	51346	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:58.366168976 CET	64634	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:58.411906004 CET	53	61667	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:58.412600040 CET	53	58058	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:58.462069035 CET	53	59142	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:58.665221930 CET	53	51346	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:58.666670084 CET	53	64634	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:58.692713022 CET	59284	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:58.692979097 CET	51010	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:58.787158012 CET	53	59284	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:58.787671089 CET	53	51010	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:59.112884045 CET	53171	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:59.113039970 CET	50061	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:59.115856886 CET	63762	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:59.116235971 CET	60145	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:59.205563068 CET	53	53171	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:59.205591917 CET	53	50061	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:59.208750010 CET	53	63762	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:59.210288048 CET	53	60145	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:59.714782953 CET	60320	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:59.715131044 CET	57617	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:18:59.810467005 CET	53	57617	1.1.1.1	192.168.2.4
Nov 1, 2023 11:18:59.810638905 CET	53	60320	1.1.1.1	192.168.2.4
Nov 1, 2023 11:19:00.487656116 CET	64596	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:19:00.488051891 CET	51532	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:19:00.581676960 CET	53	64596	1.1.1.1	192.168.2.4
Nov 1, 2023 11:19:00.585500002 CET	53	51532	1.1.1.1	192.168.2.4
Nov 1, 2023 11:19:02.353358030 CET	49301	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:19:02.353991032 CET	50503	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:19:02.980986118 CET	60370	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:19:02.981137991 CET	57970	53	192.168.2.4	1.1.1.1
Nov 1, 2023 11:19:13.617337942 CET	53	50562	1.1.1.1	192.168.2.4
Nov 1, 2023 11:19:35.931467056 CET	53	64809	1.1.1.1	192.168.2.4
Nov 1, 2023 11:19:36.915723085 CET	53	62066	1.1.1.1	192.168.2.4

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:36 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09
2023-11-01 10:18:36 UTC	0	OUT	Data Raw: 20 Data Ascii:

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:19:00 UTC	1555	IN	HTTP/1.1 200 OK Date: Wed, 01 Nov 2023 10:19:00 GMT Server: Apache/2.4.57 (Ubuntu) Cache-Control: no-cache, private X-RateLimit-Limit: 60 X-RateLimit-Remaining: 59 Access-Control-Allow-Origin: * Connection: close Transfer-Encoding: chunked Content-Type: application/json
2023-11-01 10:19:00 UTC	1555	IN	Data Raw: 36 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 54 68 65 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 20 69 73 20 76 61 6c 69 64 2e 22 2c 22 64 61 74 61 22 3a 7b 22 65 6d 61 69 6c 22 3a 22 63 2e 62 61 6b 6b 65 72 40 6d 65 64 69 72 65 76 61 2e 6e 6c 22 7d 7d 0d 0a Data Ascii: 64{"status":"success","message":"The email address is valid.","data":{"email":"c.bakker@medireva.nl"}}
2023-11-01 10:19:00 UTC	1555	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:19:01 UTC	1557	IN	HTTP/1.1 405 Method Not Allowed Date: Wed, 01 Nov 2023 10:19:01 GMT Server: Apache/2.4.57 (Ubuntu) allow: POST Cache-Control: no-cache, private Access-Control-Allow-Origin: * Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-11-01 10:19:01 UTC	1557	IN	Data Raw: 33 66 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 2c 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 6e 20 45 72 72 6f 72 20 4f 63 63 75 72 72 65 64 3a 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 2c 3c 73 76 67 20 78 6d 6c 6e 73 3d 25 32 32 Data Ascii: 3f1<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8" /> <meta name="robots" content="noindex,nofollow,noarchive" /> <title>An Error Occurred: Method Not Allowed</title> <link rel="icon" href="data:image/svg+xml,<svg xmlns=%22
2023-11-01 10:19:01 UTC	1558	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:19:01 UTC	1558	OUT	POST /api/image HTTP/1.1 Host: pnp-api.com Connection: keep-alive Content-Length: 77 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://zoom-meeting.top Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://zoom-meeting.top/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-01 10:19:01 UTC	1558	OUT	Data Raw: 7b 22 65 6d 61 69 6c 22 3a 22 63 2e 62 61 6b 6b 65 72 40 6d 65 64 69 72 65 76 61 2e 6e 6c 22 2c 22 6b 65 79 22 3a 22 30 35 62 38 63 30 35 30 2d 61 30 39 37 2d 34 62 65 65 2d 61 65 34 38 2d 38 34 39 62 39 35 65 63 39 63 30 62 22 7d Data Ascii: {"email":"c.bakker@medireva.nl","key":"05b8c050-a097-4bee-ae48-849b95ec9c0b"}

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:19:02 UTC	1559	IN	HTTP/1.1 200 OK Date: Wed, 01 Nov 2023 10:19:01 GMT Server: Apache/2.4.57 (Ubuntu) Cache-Control: no-cache, private X-RateLimit-Limit: 60 X-RateLimit-Remaining: 58 Access-Control-Allow-Origin: * Connection: close Transfer-Encoding: chunked Content-Type: application/json
2023-11-01 10:19:02 UTC	1559	IN	Data Raw: 32 35 61 0d 0a 7b 22 55 73 65 72 54 65 6e 61 6e 74 42 72 61 6e 64 69 6e 67 22 3a 5b 7b 22 4c 6f 63 61 6c 65 22 3a 30 2c 22 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 69 6d 61 67 65 73 2e 6e 65 74 5c 2f 63 31 63 36 62 36 63 38 2d 69 69 34 30 73 75 72 31 32 61 75 30 63 6b 74 30 2d 61 63 70 31 73 64 77 67 61 6d 36 61 61 6d 6c 75 6f 2d 63 77 76 79 32 69 77 63 5c 2f 6c 6f 67 69 6e 74 65 6e 61 6e 74 62 72 61 6e 64 69 6e 67 5c 2f 30 5c 2f 62 61 6e 6e 65 72 6c 6f 67 6f 3f 74 73 3d 36 33 37 33 39 34 38 36 35 35 38 39 30 36 38 34 30 37 22 2c 22 49 6c 6c 75 73 74 72 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 69 6d 61 67 65 73 2e 6e 65 74 5c 2f 63 31 63 Data Ascii: 25a{"UserTenantBranding":[{"Locale":0,"BannerLogo":"https:\/\/aadcdn.msauthimages.net\/c1c6b6c8-ii40sur12au0ckt0-acp1sdwgam6aamluo-cwvy2iwc\/logintenantbranding\/0\/bannerlogo?ts=637394865589068407","Illustration":"https:\/\/aadcdn.msauthimages.net\/c1c
2023-11-01 10:19:02 UTC	1559	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:19:02 UTC	1560	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 69918 Cache-Control: public, max-age=86400 Content-MD5: ary5Pz2KnfvWh1HHAa0EyQ== Content-Type: image/* Date: Wed, 01 Nov 2023 10:19:02 GMT Etag: 0x8D87B40D124BCFB Last-Modified: Wed, 28 Oct 2020 12:55:58 GMT Server: ECAcc (dcb/7F69) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: a45986f0-b01e-003f-5b0a-0c9bee000000 x-ms-version: 2009-09-19 Content-Length: 7343 Connection: close
2023-11-01 10:19:02 UTC	1561	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 0a 00 00 00 c3 08 03 00 00 00 3c d2 03 71 00 00 00 63 50 4c 54 45 47 70 4c 00 a7 b5 00 a7 b5 00 a7 b7 00 a8 b5 00 9f af 00 a7 b5 00 a7 b5 00 a7 b3 00 a7 b6 00 a5 b5 00 a8 b5 00 a6 b6 00 a8 b5 00 a8 b6 00 a6 b4 24 30 82 24 30 82 24 30 81 24 30 83 23 30 82 28 30 80 25 30 80 20 30 80 23 30 83 24 30 82 24 30 82 23 30 82 24 30 83 24 30 82 25 30 82 00 a7 b5 24 30 82 b9 24 58 db 00 00 00 1f 74 52 4e 53 00 9f df 20 ef 10 60 80 40 bf 30 cf 50 af 8f 70 ef bf 80 40 9f 20 30 10 50 70 af df cf 8f 60 bd 9c 9a 03 00 00 1b dc 49 44 41 54 78 da ec 9d eb 62 dc 28 0f 86 8d 0f 80 cf 69 d2 34 3d ec 2e b9 ff ab fc da 6e fb b5 dd 64 84 4e 78 06 47 fa 3f 63 8c e0 e1 95 10 b8 69 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: PNGIHDR<qcPLTEGpL$0$0$0$0#0(0%0 0#0$0$0#0$0$0%0$0$XtRNS `@0Pp@ 0Pp`IDATxb(i4=.ndNxG?ci

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:40 UTC	13	IN	HTTP/1.1 302 Found Date: Wed, 01 Nov 2023 10:18:40 GMT Transfer-Encoding: chunked Connection: close vary: accept-encoding access-control-allow-origin: * location: /turnstile/v0/b/61b90d1d/api.js?onload=onloadTurnstileCallback cache-control: max-age=300, public Server: cloudflare CF-RAY: 81f365233817700f-IAD alt-svc: h3=":443"; ma=86400
2023-11-01 10:18:40 UTC	14	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:19:03 UTC	1568	IN	HTTP/1.1 405 Method Not Allowed Date: Wed, 01 Nov 2023 10:19:02 GMT Server: Apache/2.4.57 (Ubuntu) allow: POST Cache-Control: no-cache, private Access-Control-Allow-Origin: * Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-11-01 10:19:03 UTC	1568	IN	Data Raw: 33 66 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 2c 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 6e 20 45 72 72 6f 72 20 4f 63 63 75 72 72 65 64 3a 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 2c 3c 73 76 67 20 78 6d 6c 6e 73 3d 25 32 32 Data Ascii: 3f1<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8" /> <meta name="robots" content="noindex,nofollow,noarchive" /> <title>An Error Occurred: Method Not Allowed</title> <link rel="icon" href="data:image/svg+xml,<svg xmlns=%22
2023-11-01 10:19:03 UTC	1569	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:19:03 UTC	1570	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 69919 Cache-Control: public, max-age=86400 Content-MD5: ary5Pz2KnfvWh1HHAa0EyQ== Content-Type: image/* Date: Wed, 01 Nov 2023 10:19:03 GMT Etag: 0x8D87B40D124BCFB Last-Modified: Wed, 28 Oct 2020 12:55:58 GMT Server: ECAcc (dcb/7F69) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: a45986f0-b01e-003f-5b0a-0c9bee000000 x-ms-version: 2009-09-19 Content-Length: 7343 Connection: close
2023-11-01 10:19:03 UTC	1571	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 0a 00 00 00 c3 08 03 00 00 00 3c d2 03 71 00 00 00 63 50 4c 54 45 47 70 4c 00 a7 b5 00 a7 b5 00 a7 b7 00 a8 b5 00 9f af 00 a7 b5 00 a7 b5 00 a7 b3 00 a7 b6 00 a5 b5 00 a8 b5 00 a6 b6 00 a8 b5 00 a8 b6 00 a6 b4 24 30 82 24 30 82 24 30 81 24 30 83 23 30 82 28 30 80 25 30 80 20 30 80 23 30 83 24 30 82 24 30 82 23 30 82 24 30 83 24 30 82 25 30 82 00 a7 b5 24 30 82 b9 24 58 db 00 00 00 1f 74 52 4e 53 00 9f df 20 ef 10 60 80 40 bf 30 cf 50 af 8f 70 ef bf 80 40 9f 20 30 10 50 70 af df cf 8f 60 bd 9c 9a 03 00 00 1b dc 49 44 41 54 78 da ec 9d eb 62 dc 28 0f 86 8d 0f 80 cf 69 d2 34 3d ec 2e b9 ff ab fc da 6e fb b5 dd 64 84 4e 78 06 47 fa 3f 63 8c e0 e1 95 10 b8 69 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: PNGIHDR<qcPLTEGpL$0$0$0$0#0(0%0 0#0$0$0#0$0$0%0$0$XtRNS `@0Pp@ 0Pp`IDATxb(i4=.ndNxG?ci

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:19:29 UTC	1579	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RgWrxEyzmVEYMW3&MD=2HSL48sL HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-11-01 10:19:30 UTC	1579	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 8936bc73-f545-4818-b582-9ee850b04cc1 MS-RequestId: 1f25d75c-ee82-42de-a5bf-bf419b327448 MS-CV: aQTbd8lVJkWk5v00.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 01 Nov 2023 10:19:29 GMT Connection: close Content-Length: 25457
2023-11-01 10:19:30 UTC	1580	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-11-01 10:19:30 UTC	1595	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:40 UTC	14	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 84477 Cache-Control: public, max-age=604800 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Wed, 01 Nov 2023 10:18:40 GMT Etag: 0x8D64101507E84BD Last-Modified: Fri, 02 Nov 2018 20:25:22 GMT Server: ECAcc (dcb/7EBC) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 7542e861-001e-00df-4ce8-0be75f000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2023-11-01 10:18:40 UTC	15	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:41 UTC	53	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 84478 Cache-Control: public, max-age=604800 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Wed, 01 Nov 2023 10:18:41 GMT Etag: 0x8D64101507E84BD Last-Modified: Fri, 02 Nov 2018 20:25:22 GMT Server: ECAcc (dcb/7EBC) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 7542e861-001e-00df-4ce8-0be75f000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2023-11-01 10:18:41 UTC	54	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:36 UTC	1	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 01 Nov 2023 10:18:36 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--m61RYac7bqhq7dcxboXCA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-11-01 10:18:36 UTC	3	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-11-01 10:18:36 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:42 UTC	132	IN	HTTP/1.1 200 OK Date: Wed, 01 Nov 2023 10:18:42 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 81f36531b9f382c3-IAD alt-svc: h3=":443"; ma=86400
2023-11-01 10:18:42 UTC	132	IN	Data Raw: 33 64 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 3dPNGIHDRsIDAT$IENDB`
2023-11-01 10:18:42 UTC	132	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:43 UTC	308	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 Nov 2023 10:12:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 139 Connection: close Last-Modified: Sun, 16 Apr 2023 16:50:42 GMT ETag: "8b-5f976dfef1c80" Accept-Ranges: bytes
2023-11-01 10:18:43 UTC	308	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 3f 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 73 70 6c 69 74 28 22 3f 22 29 5b 31 5d 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html> <body> <script>window.location.href="/index.php?" + window.location.href.split("?")[1];</script> </body></html>

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:43 UTC	309	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1055797790:1698833333:Xv25X_gApLBM-ZAelZ-de14cATei4i97vw4UcgafKo0/81f3652c0bb8576a/6f65b3be807cf62 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 2372 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: 6f65b3be807cf62 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/14tba/0x4AAAAAAAMdtIbwKKuijiyA/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-01 10:18:43 UTC	310	OUT	Data Raw: 76 5f 38 31 66 33 36 35 32 63 30 62 62 38 35 37 36 61 3d 55 75 41 46 50 46 2d 46 34 46 58 46 76 37 68 57 37 68 67 46 37 36 35 51 76 7a 37 4a 68 76 68 5a 77 36 56 24 6d 68 63 2d 37 68 4a 5a 4f 6f 6d 76 51 68 71 68 6e 46 68 4d 76 77 6d 70 55 68 6f 6d 68 34 7a 68 55 66 4f 46 4b 56 4e 68 70 47 68 4a 46 70 2d 6b 5a 2d 44 6d 37 65 33 68 37 51 53 6b 65 52 68 35 52 68 62 46 56 34 42 25 32 62 35 68 4a 51 52 66 37 46 35 33 68 46 54 45 78 53 45 68 2d 65 5a 46 68 64 46 56 47 52 41 76 68 68 52 68 5a 54 36 4f 68 37 41 68 49 4f 42 34 59 55 4f 44 57 68 35 54 68 70 75 68 66 46 70 63 33 51 75 68 73 52 69 5a 38 4b 50 47 59 76 4a 37 54 59 56 31 67 68 70 4a 68 4b 41 68 51 46 37 2b 5a 6d 35 4e 59 44 68 69 59 4e 77 37 45 57 58 45 2d 35 76 63 63 64 65 48 68 42 36 6d 4b 42 34 42 Data Ascii: v_81f3652c0bb8576a=UuAFPF-F4FXFv7hW7hgF765Qvz7JhvhZw6V$mhc-7hJZOomvQhqhnFhMvwmpUhomh4zhUfOFKVNhpGhJFp-kZ-Dm7e3h7QSkeRh5RhbFV4B%2b5hJQRf7F53hFTExSEh-eZFhdFVGRAvhhRhZT6Oh7AhIOB4YUODWh5ThpuhfFpc3QuhsRiZ8KPGYvJ7TYV1ghpJhKAhQF7+Zm5NYDhiYNw7EWXE-5vccdeHhB6mKB4B

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:36 UTC	3	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-Y0EG6h-MTQhTg2DuQ6xocQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 01 Nov 2023 10:18:36 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6148 X-Daystart: 11916 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-11-01 10:18:36 UTC	3	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 34 38 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 31 39 31 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6148" elapsed_seconds="11916"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-11-01 10:18:36 UTC	4	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-11-01 10:18:36 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:44 UTC	416	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 Nov 2023 10:12:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 139 Connection: close Last-Modified: Sun, 16 Apr 2023 16:50:42 GMT ETag: "8b-5f976dfef1c80" Accept-Ranges: bytes
2023-11-01 10:18:44 UTC	416	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 3f 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 73 70 6c 69 74 28 22 3f 22 29 5b 31 5d 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html> <body> <script>window.location.href="/index.php?" + window.location.href.split("?")[1];</script> </body></html>

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Windows Analysis Report
https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:45 UTC	417	IN	HTTP/1.1 400 Bad Request Date: Wed, 01 Nov 2023 10:18:45 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: uWSaf8qoB/9oNjJUPJi3ZQ==$5vDkCL+mUCCy3t92Q7n8NA== Server: cloudflare CF-RAY: 81f36541adf85a70-IAD alt-svc: h3=":443"; ma=86400
2023-11-01 10:18:45 UTC	418	IN	Data Raw: 37 0d 0a 69 6e 76 61 6c 69 64 0d 0a Data Ascii: 7invalid
2023-11-01 10:18:45 UTC	418	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:46 UTC	419	IN	HTTP/1.1 200 OK Date: Wed, 01 Nov 2023 10:18:46 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Server: cloudflare CF-RAY: 81f36545a8fe0848-IAD alt-svc: h3=":443"; ma=86400
2023-11-01 10:18:46 UTC	419	IN	Data Raw: 33 64 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3d 00 00 00 64 08 02 00 00 00 ba 81 af 81 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 3dPNGIHDR=dIDAT$IENDB`
2023-11-01 10:18:46 UTC	420	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:46 UTC	420	IN	HTTP/1.1 401 Unauthorized Date: Wed, 01 Nov 2023 10:18:46 GMT Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2023-11-01 10:18:46 UTC	420	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 64 5a 77 71 49 70 4a 44 48 49 78 37 6e 37 33 38 58 63 63 34 36 46 6b 49 46 54 69 63 70 5f 4e 71 38 38 6f 4c 4d 34 78 5a 43 6c 4d 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d 45 41 67 Data Ascii: www-authenticate: PrivateToken challenge=AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gdZwqIpJDHIx7n738Xcc46FkIFTicp_Nq88oLM4xZClMAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=, token-key=MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAg
2023-11-01 10:18:46 UTC	421	IN	Data Raw: 31 0d 0a 4a 0d 0a Data Ascii: 1J
2023-11-01 10:18:46 UTC	421	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:47 UTC	421	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1055797790:1698833333:Xv25X_gApLBM-ZAelZ-de14cATei4i97vw4UcgafKo0/81f3652c0bb8576a/6f65b3be807cf62 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 28957 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: 6f65b3be807cf62 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/14tba/0x4AAAAAAAMdtIbwKKuijiyA/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-01 10:18:47 UTC	422	OUT	Data Raw: 76 5f 38 31 66 33 36 35 32 63 30 62 62 38 35 37 36 61 3d 55 75 41 46 59 37 70 47 4f 42 41 41 75 70 52 70 63 47 68 24 34 6d 68 47 37 25 32 62 70 6b 57 68 7a 46 55 6d 68 54 68 39 52 6d 46 70 36 37 79 41 68 55 37 55 46 42 51 36 68 65 68 48 46 4a 36 32 51 37 71 68 4d 36 51 46 68 6e 46 56 53 6c 68 4b 36 70 37 42 68 53 36 4d 44 68 42 6d 35 6c 68 33 36 37 37 68 64 65 65 4f 68 43 56 24 4d 41 52 68 56 36 68 6f 38 5a 68 68 4d 4a 68 4e 36 68 5a 71 38 46 4a 53 56 7a 53 56 63 46 70 39 53 68 70 24 31 52 46 35 71 50 24 61 33 52 62 42 79 68 53 75 68 6b 24 36 68 42 65 4a 33 51 6e 4a 6e 49 74 66 33 46 6f 51 71 36 46 41 68 67 62 53 54 30 43 75 68 4a 24 4e 51 68 41 63 70 4c 33 34 68 79 71 62 54 68 74 66 4d 59 76 52 56 6e 6d 37 63 4d 4d 2d 79 58 57 34 55 64 64 74 50 4c 68 4a Data Ascii: v_81f3652c0bb8576a=UuAFY7pGOBAAupRpcGh$4mhG7%2bpkWhzFUmhTh9RmFp67yAhU7UFBQ6hehHFJ62Q7qhM6QFhnFVSlhK6p7BhS6MDhBm5lh3677hdeeOhCV$MARhV6ho8ZhhMJhN6hZq8FJSVzSVcFp9Shp$1RF5qP$a3RbByhSuhk$6hBeJ3QnJnItf3FoQq6FAhgbST0CuhJ$NQhAcpL34hyqbThtfMYvRVnm7cMM-yXW4UddtPLhJ
2023-11-01 10:18:47 UTC	438	OUT	Data Raw: 31 44 59 47 43 37 6d 53 52 70 45 70 6d 68 4d 68 56 4b 35 24 37 66 35 6b 62 4a 46 64 6a 65 6a 58 6f 46 34 68 61 68 37 41 68 4e 68 56 71 35 42 6d 39 75 53 75 68 65 68 4b 36 42 41 37 75 68 55 6d 70 4f 70 7a 68 59 68 37 36 35 24 68 78 68 61 36 68 4a 41 75 46 56 41 37 77 68 32 46 37 68 35 4e 68 6b 46 55 4f 70 6d 68 47 46 76 4f 70 34 68 6e 46 4e 51 68 6f 68 34 68 35 51 70 4f 24 58 6d 33 4b 68 53 68 69 46 70 46 67 44 6d 32 68 56 5a 35 33 68 51 47 35 6a 41 63 68 2d 46 42 53 37 6e 46 52 51 4e 46 37 31 68 33 68 61 51 35 39 68 39 6d 55 41 68 63 68 58 6d 53 4f 68 47 68 46 6d 55 53 68 43 36 64 5a 68 47 35 49 6c 4d 6e 62 64 70 77 46 7a 6d 4a 76 70 77 46 69 36 56 24 68 47 68 47 4f 53 6d 35 69 68 52 51 55 41 35 4f 71 39 46 4a 41 35 39 68 65 64 35 68 68 47 68 79 43 42 4c Data Ascii: 1DYGC7mSRpEpmhMhVK5$7f5kbJFdjejXoF4hah7AhNhVq5Bm9uSuhehK6BA7uhUmpOpzhYh765$hxha6hJAuFVA7wh2F7h5NhkFUOpmhGFvOp4hnFNQhoh4h5QpO$Xm3KhShiFpFgDm2hVZ53hQG5jAch-FBS7nFRQNF71h3haQ59h9mUAhchXmSOhGhFmUShC6dZhG5IlMnbdpwFzmJvpwFi6V$hGhGOSm5ihRQUA5Oq9FJA59hed5hhGhyCBL

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:48 UTC	467	IN	HTTP/1.1 400 Bad Request Date: Wed, 01 Nov 2023 10:18:48 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: 3gouE7CG2tkYbl737jwnOg==$kQNSe6mE9g04A87fTKJfOA== Server: cloudflare CF-RAY: 81f365524a9b5b0a-IAD alt-svc: h3=":443"; ma=86400
2023-11-01 10:18:48 UTC	467	IN	Data Raw: 37 0d 0a 69 6e 76 61 6c 69 64 0d 0a Data Ascii: 7invalid
2023-11-01 10:18:48 UTC	467	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:52 UTC	467	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RgWrxEyzmVEYMW3&MD=2HSL48sL HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-11-01 10:18:52 UTC	468	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 7b16ef11-d61b-47ec-bf5e-aee2fb59d855 MS-RequestId: 926f3b38-2920-40ca-a700-5a5df016baae MS-CV: alYXgifs7k+ob6ew.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 01 Nov 2023 10:18:51 GMT Connection: close Content-Length: 24490
2023-11-01 10:18:52 UTC	468	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-11-01 10:18:52 UTC	484	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:56 UTC	492	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1055797790:1698833333:Xv25X_gApLBM-ZAelZ-de14cATei4i97vw4UcgafKo0/81f3652c0bb8576a/6f65b3be807cf62 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 29577 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: 6f65b3be807cf62 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/14tba/0x4AAAAAAAMdtIbwKKuijiyA/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-01 10:18:56 UTC	493	OUT	Data Raw: 76 5f 38 31 66 33 36 35 32 63 30 62 62 38 35 37 36 61 3d 55 75 41 46 59 37 70 47 4f 42 41 41 75 70 52 70 63 47 68 24 34 6d 68 47 37 25 32 62 70 6b 57 68 7a 46 55 6d 68 54 68 39 52 6d 46 70 36 37 79 41 68 55 37 55 46 42 51 36 68 65 68 48 46 4a 36 32 51 37 71 68 4d 36 51 46 68 6e 46 56 53 6c 68 4b 36 70 37 42 68 53 36 4d 44 68 42 6d 35 6c 68 33 36 37 37 68 64 65 65 4f 68 43 56 24 4d 41 52 68 56 36 68 6f 38 5a 68 68 4d 4a 68 4e 36 68 5a 71 38 46 4a 53 56 7a 53 56 63 46 70 39 53 68 70 24 31 52 46 35 71 50 24 61 33 52 62 42 79 68 53 75 68 6b 24 36 68 42 65 4a 33 51 6e 4a 6e 49 74 66 33 46 6f 51 71 36 46 41 68 67 62 53 54 30 43 75 68 4a 24 4e 51 68 41 63 70 4c 33 34 68 79 71 62 54 68 74 66 4d 59 76 52 56 6e 6d 37 63 4d 4d 2d 79 58 57 34 55 64 64 74 50 4c 68 4a Data Ascii: v_81f3652c0bb8576a=UuAFY7pGOBAAupRpcGh$4mhG7%2bpkWhzFUmhTh9RmFp67yAhU7UFBQ6hehHFJ62Q7qhM6QFhnFVSlhK6p7BhS6MDhBm5lh3677hdeeOhCV$MARhV6ho8ZhhMJhN6hZq8FJSVzSVcFp9Shp$1RF5qP$a3RbByhSuhk$6hBeJ3QnJnItf3FoQq6FAhgbST0CuhJ$NQhAcpL34hyqbThtfMYvRVnm7cMM-yXW4UddtPLhJ
2023-11-01 10:18:56 UTC	509	OUT	Data Raw: 31 44 59 47 43 37 6d 53 52 70 45 70 6d 68 4d 68 56 4b 35 24 37 66 35 6b 62 4a 46 64 6a 65 6a 58 6f 46 34 68 61 68 37 41 68 4e 68 56 71 35 42 6d 39 75 53 75 68 65 68 4b 36 42 41 37 75 68 55 6d 70 4f 70 7a 68 59 68 37 36 35 24 68 78 68 61 36 68 4a 41 75 46 56 41 37 77 68 32 46 37 68 35 4e 68 6b 46 55 4f 70 6d 68 47 46 76 4f 70 34 68 6e 46 4e 51 68 6f 68 34 68 35 51 70 4f 24 58 6d 33 4b 68 53 68 69 46 70 46 67 44 6d 32 68 56 5a 35 33 68 51 47 35 6a 41 63 68 2d 46 42 53 37 6e 46 52 51 4e 46 37 31 68 33 68 61 51 35 39 68 39 6d 55 41 68 63 68 58 6d 53 4f 68 47 68 46 6d 55 53 68 43 36 64 5a 68 47 35 49 6c 4d 6e 62 64 70 77 46 7a 6d 4a 76 70 77 46 69 36 56 24 68 47 68 47 4f 53 6d 35 69 68 52 51 55 41 35 4f 71 39 46 4a 41 35 39 68 65 64 35 68 68 47 68 79 43 42 4c Data Ascii: 1DYGC7mSRpEpmhMhVK5$7f5kbJFdjejXoF4hah7AhNhVq5Bm9uSuhehK6BA7uhUmpOpzhYh765$hxha6hJAuFVA7wh2F7h5NhkFUOpmhGFvOp4hnFNQhoh4h5QpO$Xm3KhShiFpFgDm2hVZ53hQG5jAch-FBS7nFRQNF71h3haQ59h9mUAhchXmSOhGhFmUShC6dZhG5IlMnbdpwFzmJvpwFi6V$hGhGOSm5ihRQUA5Oq9FJA59hed5hhGhyCBL

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:57 UTC	526	OUT	POST /main/main.php HTTP/1.1 Host: zoom-meeting.top Connection: keep-alive Content-Length: 560 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://zoom-meeting.top Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://zoom-meeting.top/main/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=muhgooi7klmprcut1jd5a6vml5
2023-11-01 10:18:57 UTC	527	OUT	Data Raw: 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 3d 30 2e 6d 2d 33 47 57 4d 30 44 65 6a 50 36 4c 37 6d 79 53 6b 46 61 67 76 71 4e 6f 48 68 41 48 7a 76 6a 32 2d 42 55 70 48 52 34 56 30 37 67 4c 4e 6c 62 6b 47 36 31 5f 68 67 6f 5a 6d 4f 57 7a 47 78 6a 56 39 7a 32 36 45 31 47 64 73 64 35 42 66 45 47 30 6c 6a 51 74 30 63 47 4a 5f 70 41 4d 64 48 52 75 36 45 37 64 38 39 65 76 36 44 32 68 52 4e 4c 5f 31 44 64 79 73 50 78 6e 57 41 37 30 75 49 5f 78 37 4c 78 37 77 62 41 6e 55 4a 72 43 33 33 36 75 6e 4f 43 4e 37 63 4c 64 7a 4e 51 57 47 6c 65 6f 53 77 4e 42 75 51 71 33 32 77 4b 39 43 67 6d 50 4c 4c 71 55 79 6d 69 53 50 5f 53 44 61 35 53 50 45 4b 49 64 4a 70 34 64 33 57 6c 43 5a 31 56 53 76 52 52 4f 32 6c 35 7a 41 70 52 2d 50 6f 74 52 46 51 62 39 6b 69 Data Ascii: cf-turnstile-response=0.m-3GWM0DejP6L7mySkFagvqNoHhAHzvj2-BUpHR4V07gLNlbkG61_hgoZmOWzGxjV9z26E1Gdsd5BfEG0ljQt0cGJ_pAMdHRu6E7d89ev6D2hRNL_1DdysPxnWA70uI_x7Lx7wbAnUJrC336unOCN7cLdzNQWGleoSwNBuQq32wK9CgmPLLqUymiSP_SDa5SPEKIdJp4d3WlCZ1VSvRRO2l5zApR-PotRFQb9ki

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:39 UTC	5	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 Nov 2023 10:12:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 139 Connection: close Last-Modified: Sun, 16 Apr 2023 16:50:42 GMT ETag: "8b-5f976dfef1c80" Accept-Ranges: bytes
2023-11-01 10:18:39 UTC	5	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 3f 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 73 70 6c 69 74 28 22 3f 22 29 5b 31 5d 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html> <body> <script>window.location.href="/index.php?" + window.location.href.split("?")[1];</script> </body></html>

Timestamp	kBytes transferred	Direction	Data
2023-11-01 10:18:58 UTC	588	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 30273041 Cache-Control: public, max-age=31536000 Content-MD5: Ibdh8rH9N/WH1yIgI7CSdg== Content-Type: image/svg+xml Date: Wed, 01 Nov 2023 10:18:57 GMT Etag: 0x8D79A1BA1110D7A Last-Modified: Thu, 16 Jan 2020 00:32:55 GMT Server: ECAcc (dcb/7319) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 4e496257-a01e-0059-6e57-f9442d000000 x-ms-version: 2009-09-19 Content-Length: 250 Connection: close
2023-11-01 10:18:58 UTC	589	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 33 38 2c 33 30 56 31 32 48 31 30 56 33 30 68 34 76 34 2e 35 37 38 4c 31 38 2e 35 37 38 2c 33 30 48 33 38 4d 31 32 2c 33 32 48 38 56 31 30 48 34 30 56 33 32 48 31 39 2e 34 32 32 4c 31 32 2c 33 39 2e 34 32 32 5a 22 20 66 69 6c 6c 3d 22 23 34 30 34 30 34 30 22 2f 3e 3c 2f 73 76 67 3e Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M38,30V12H10V30h4v4.578L18.578,30H38M12,32H8V10H40V32H19.422L12,39.422Z" fill="#404040"/></svg>