Edit tour

Windows Analysis Report
2023121142000021ki01kvjs.html

Overview

General Information

Sample name:	2023121142000021ki01kvjs.html
Analysis ID:	1364387
MD5:	c173724b69b98820b9225eb00c004967
SHA1:	c6bfbdb60016db07f5799dd007bd4c0bda49a005
SHA256:	64f9656b3edfd752a50b500c2a08924fd58f84a288fb8d7721c7033e903a027b
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML file submission containing password form

Suspicious Javascript code found in HTML file

Creates files inside the system directory

HTML body contains password input but no form action

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

No HTML title found

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5700 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\2023121142000021ki01kvjs.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4912 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,13568755651350574847,2774750307757478582,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Suspicious Javascript code found in HTML file

Source: 2023121142000021ki01kvjs.html	HTTP Parser: document.write
Source: 2023121142000021ki01kvjs.html	HTTP Parser: location.href
Source: 2023121142000021ki01kvjs.html	HTTP Parser: window.location
Source: 2023121142000021ki01kvjs.html	HTTP Parser: Combo hit

Source: 2023121142000021ki01kvjs.html	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: file:///C:/Users/user/Desktop/2023121142000021ki01kvjs.html	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: 2023121142000021ki01kvjs.html	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/2023121142000021ki01kvjs.html	HTTP Parser: HTML title missing

Source: file:///C:/Users/user/Desktop/2023121142000021ki01kvjs.html

HTTP Parser: Has password / email / username input fields

Source: 2023121142000021ki01kvjs.html	HTTP Parser: <input type="password" .../> found
Source: file:///C:/Users/user/Desktop/2023121142000021ki01kvjs.html	HTTP Parser: <input type="password" .../> found

Source: 2023121142000021ki01kvjs.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/2023121142000021ki01kvjs.html	HTTP Parser: No favicon

Source: 2023121142000021ki01kvjs.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/2023121142000021ki01kvjs.html	HTTP Parser: No <meta name="author".. found

Source: 2023121142000021ki01kvjs.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/2023121142000021ki01kvjs.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49750 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.8:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.8:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.8:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.8:49751 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 151.101.66.137 151.101.66.137

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49750 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /html16/images/mail/ico_email.jpg HTTP/1.1Host: esemuro.bizmeka.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /html16/images/mail/btn_confirm.jpg HTTP/1.1Host: esemuro.bizmeka.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /html16/images/mail/bg_tit.jpg HTTP/1.1Host: esemuro.bizmeka.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /html16/images/mail/bg_cont.jpg HTTP/1.1Host: esemuro.bizmeka.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /html16/images/mail/ico_email.jpg HTTP/1.1Host: esemuro.bizmeka.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /html16/images/mail/btn_confirm.jpg HTTP/1.1Host: esemuro.bizmeka.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /html16/images/mail/bg_cont.jpg HTTP/1.1Host: esemuro.bizmeka.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /html16/images/mail/bg_tit.jpg HTTP/1.1Host: esemuro.bizmeka.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=D3aaZ1KaEyBDa5B&MD=FaHsa1pn HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=D3aaZ1KaEyBDa5B&MD=FaHsa1pn HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000008EDAF39BEB HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /jquery-latest.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE

Source: 2023121142000021ki01kvjs.html	String found in binary or memory: http://code.jquery.com/jquery-latest.min.js
Source: 2023121142000021ki01kvjs.html	String found in binary or memory: http://fonts.googleapis.com/earlyaccess/nanumgothic.css);
Source: 2023121142000021ki01kvjs.html	String found in binary or memory: https://esemuro.bizmeka.com/html16/images/mail/bg_cont.jpg)
Source: 2023121142000021ki01kvjs.html	String found in binary or memory: https://esemuro.bizmeka.com/html16/images/mail/bg_tit.jpg)
Source: 2023121142000021ki01kvjs.html	String found in binary or memory: https://esemuro.bizmeka.com/html16/images/mail/btn_confirm.jpg
Source: 2023121142000021ki01kvjs.html	String found in binary or memory: https://esemuro.bizmeka.com/html16/images/mail/ico_email.jpg
Source: 2023121142000021ki01kvjs.html	String found in binary or memory: https://itunes.apple.com/kr/app/xecureexpress-for-mobile/id839379759?mt=8
Source: 2023121142000021ki01kvjs.html	String found in binary or memory: https://play.google.com/store/apps/details?id=com.softforum.xemobile

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443

Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.8:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.8:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.8:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.8:49751 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_5700_2090408042

Jump to behavior

Source: classification engine

Classification label: mal48.phis.winHTML@26/27@14/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\2023121142000021ki01kvjs.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,13568755651350574847,2774750307757478582,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,13568755651350574847,2774750307757478582,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/2023121142000021ki01kvjs.html

HTTP Parser: file:///C:/Users/user/Desktop/2023121142000021ki01kvjs.html

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Ingress Tool Transfer			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file:///C:/Users/user/Desktop/2023121142000021ki01kvjs.html	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.64.173	true	false	high
code.jquery.com	151.101.66.137	true	false	high
esemuro.bizmeka.com	222.111.214.42	true	false	high
www.google.com	172.217.3.68	true	false	high
clients.l.google.com	142.250.64.142	true	false	high
clients1.google.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://esemuro.bizmeka.com/html16/images/mail/ico_email.jpg	false		high
file:///C:/Users/user/Desktop/2023121142000021ki01kvjs.html	true	Avira URL Cloud: safe	low
https://esemuro.bizmeka.com/html16/images/mail/btn_confirm.jpg	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false		high
http://code.jquery.com/jquery-latest.min.js	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://esemuro.bizmeka.com/html16/images/mail/bg_tit.jpg	false		high
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000008EDAF39BEB	false		high
https://esemuro.bizmeka.com/html16/images/mail/bg_cont.jpg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://esemuro.bizmeka.com/html16/images/mail/bg_tit.jpg)	2023121142000021ki01kvjs.html	false	high
https://play.google.com/store/apps/details?id=com.softforum.xemobile	2023121142000021ki01kvjs.html	false	high
https://esemuro.bizmeka.com/html16/images/mail/bg_cont.jpg)	2023121142000021ki01kvjs.html	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
222.111.214.42	esemuro.bizmeka.com	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
142.250.217.206	unknown	United States	15169	GOOGLEUS	false
142.250.64.173	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.64.142	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
172.217.3.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.22

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1364387
Start date and time:	2023-12-19 09:54:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2023121142000021ki01kvjs.html
Detection:	MAL
Classification:	mal48.phis.winHTML@26/27@14/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.178.50.67, 142.251.35.234, 192.178.50.35, 34.104.35.123, 208.111.136.128, 192.229.211.108, 142.250.217.202, 192.178.50.42, 142.250.189.138, 192.178.50.74, 142.250.64.202, 142.250.64.234, 142.250.64.170, 142.250.217.170, 142.250.217.234
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, fonts.gstatic.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, optimizationguide-pa.googleapis.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://trackinghub.info/	Get hash	malicious	Unknown	Browse
	PO46823.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse
	YIWta5djON.exe	Get hash	malicious	Unknown	Browse
	p3h5r9NsxY.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse
	http://payonresultsc.xyz	Get hash	malicious	Unknown	Browse
	YIWta5djON.exe	Get hash	malicious	Unknown	Browse
	XW9DuF7Pys.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse
	http://salpspa.shop/	Get hash	malicious	HTMLPhisher	Browse
	deEzk5CTqP.exe	Get hash	malicious	Unknown	Browse
	8UIc9QxZSj.exe	Get hash	malicious	Unknown	Browse
	deEzk5CTqP.exe	Get hash	malicious	Unknown	Browse
	oa1Ogjv3kL.exe	Get hash	malicious	Unknown	Browse
	8UIc9QxZSj.exe	Get hash	malicious	Unknown	Browse
	oa1Ogjv3kL.exe	Get hash	malicious	Unknown	Browse
	http://maineorthopaedicscomau.website	Get hash	malicious	Unknown	Browse
	t5tkGPp6bY.exe	Get hash	malicious	Unknown	Browse
	t5tkGPp6bY.exe	Get hash	malicious	Unknown	Browse
	31N825YHrQ.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse
	https://dynamicgiass.com/Masacks@hammond.com.au	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	http://62.233.50.101:11197/ncat.exe	Get hash	malicious	Unknown	Browse
151.101.66.137	http://salpspa.shop/	Get hash	malicious	HTMLPhisher	Browse
	https://steam-workshop.vip/	Get hash	malicious	HTMLPhisher	Browse
	https://sajfdgelmw3ps4aag3abidzdf2w3etc7y7mw376d3gsl4nrq6yyq.ar-io.dev/kBJRmItltvlwADbAFA8jLq2yTF_H2W3_w9mkvjYw9jE?	Get hash	malicious	HTMLPhisher	Browse
	https://aQ9dXs48VI-xn--p0pr4qy8-xn----c1ac4bxc-xn----p1ai.translate.goog/ccTlEF/lDif3dnSI/aQ9dXs48VI?WW5KNVlXNHVkMjlzWmtCbVlXRXVaMjkyOlBvQWVISmx4c1d1aXZtb0dSUU5v+&_x_tr_sch=http&_x_tr_sl=xgqbBJSb&_x_tr_tl=MZcTUhWl	Get hash	malicious	Unknown	Browse
	https://my.visme.co/view/mxkm0ny3-smart-uk-automotive-ltd	Get hash	malicious	HTMLPhisher	Browse
	http://fhtbi.eiterewat.ru/w98g7m47	Get hash	malicious	HTMLPhisher	Browse
	https://pub-29a90ecbb480460b88c5099b555c59db.r2.dev/favotrite.html	Get hash	malicious	HTMLPhisher	Browse
	https://numerous-fourth-cup.glitch.me/mon3.shtml	Get hash	malicious	HTMLPhisher	Browse
	https://nopqr.harveric.ru/hv44g3ya/	Get hash	malicious	HTMLPhisher	Browse
	https://acqsdasabm.edwhi.ru/x668/	Get hash	malicious	HTMLPhisher	Browse
	http://www.visitaurora.com/	Get hash	malicious	Unknown	Browse
	https://ecv.microsoft.com/yJ2g7mGqr0	Get hash	malicious	HTMLPhisher	Browse
	https://ecv.microsoft.com	Get hash	malicious	HTMLPhisher	Browse
	Updated Handbook Ilf.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-c4e5302210e84312b9607366a10338ec.r2.dev/bita.html	Get hash	malicious	Unknown	Browse
	https://pub-543b6c8da6ec4a2dbe07e8b2dc6002c6.r2.dev/floxcc.html	Get hash	malicious	HTMLPhisher	Browse
	Purchase_Order.html	Get hash	malicious	Unknown	Browse
	https://trk-mkt.tason.com/CheckNew.html?TV9JRD0xNDk4OTAyMjM5OQ==&U1RZUEU9TUFTUw==&RU1BSUxfSUQ9c2toOTk5QGtvbmt1ay5hYy5rcg==&TElTVF9UQUJMRT1FQkFEMTI2MA==&UE9TVF9JRD0yMDIzMTIwODEwMDAxNTg4OTIzOQ==&VEM9MjAyMzEyMjQ=&S0lORD1D&Q0lEPTAyNg==&URL=https://r20.rs6.net/tn.jsp?f=0019i-0m_nEfugoHpiXFvMtqR_s2scn-kHX7P9qnH1-Smy1dJmCuhMfGUDuQLbLHJWzBmsJaRMjdoJOz7E5Q2pAu2rYF3Ow8vsRxTcwygFGVxGUUgqNenIM2FuuCD8Bt5pJllEzgzpC1KuvSJqWp73eCdaByBLik1uyiPOufg9crAI=&c=RvtR3DcOnsvpISS6Wy4yTbJyqxLGnzcUjHSDGgLUS_DR3ec4AuVQLg==&ch=v0gJzGJxjA26bsaxk4cR8UwvJT91euZYKdHCGLfZsPeycZP1xt4RKg==&__=/qwer/Y2hyaXMuaGlnZG9uQGdyYWNlaGVhbHRobWkub3Jn	Get hash	malicious	HTMLPhisher	Browse
	https://trk-mkt.tason.com/CheckNew.html?TV9JRD0xNDk4OTAyMjM5OQ==&U1RZUEU9TUFTUw==&RU1BSUxfSUQ9c2toOTk5QGtvbmt1ay5hYy5rcg==&TElTVF9UQUJMRT1FQkFEMTI2MA==&UE9TVF9JRD0yMDIzMTIwODEwMDAxNTg4OTIzOQ==&VEM9MjAyMzEyMjQ=&S0lORD1D&Q0lEPTAyNg==&URL=https://r20.rs6.net/tn.jsp?f=0019i-0m_nEfugoHpiXFvMtqR_s2scn-kHX7P9qnH1-Smy1dJmCuhMfGUDuQLbLHJWzBmsJaRMjdoJOz7E5Q2pAu2rYF3Ow8vsRxTcwygFGVxGUUgqNenIM2FuuCD8Bt5pJllEzgzpC1KuvSJqWp73eCdaByBLik1uyiPOufg9crAI=&c=RvtR3DcOnsvpISS6Wy4yTbJyqxLGnzcUjHSDGgLUS_DR3ec4AuVQLg==&ch=v0gJzGJxjA26bsaxk4cR8UwvJT91euZYKdHCGLfZsPeycZP1xt4RKg==&__=/qwer/Y2hyaXMuaGlnZG9uQGdyYWNlaGVhbHRobWkub3Jn	Get hash	malicious	HTMLPhisher	Browse
	https://cocojonss.tumblr.com/	Get hash	malicious	Porn Scam	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
code.jquery.com	http://salpspa.shop/	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://summer-spurious-tithonia.glitch.me/mart.shtml	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://grass-cultured-copper.glitch.me/jigo.shtml	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://pub-58a2defbb13f4b89a485472b5baaef7e.r2.dev/q3223.html	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://sharepoint-bunteng-auth.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://sajfdgelmw3ps4aag3abidzdf2w3etc7y7mw376d3gsl4nrq6yyq.ar-io.dev/kBJRmItltvlwADbAFA8jLq2yTF_H2W3_w9mkvjYw9jE?	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://pub-2598caa00dcf4c658bf8753f6761f962.r2.dev/compki.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://speckle-sunrise-justice.glitch.me/gerar.shtml	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://www.google.com/search?q=%22VAC+%26+OFFICIAL+MATCHMAKING%22	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://egfyua-winter-sea-8755.smilingpurple.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	ATT00001.htm	Get hash	malicious	Unknown	Browse	151.101.2.137
	PO-709614.eml	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://documentshareportal.com.pl	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://lp.constantcontactpages.com/cu/tk5DZdJ/budgetlist	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	151.101.130.137
	https://shoutout.wix.com/so/d9OnulLek/c?w=aBwtj3vLyIt1v_BcFl1lIQUYUnO7j56NqO9d_ZxCWaE.eyJ1IjoiaHR0cHM6Ly84OG5iLmNjL3p2OGNvIiwiciI6ImQ5MjMyOTE1LTc5ZTMtNGQ2ZC05NmQ0LTQ3NTY4NWFlZmRjOCIsIm0iOiJtYWlsIiwiYyI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9	Get hash	malicious	Phisher	Browse	151.101.2.137
	https://aQ9dXs48VI-xn--p0pr4qy8-xn----c1ac4bxc-xn----p1ai.translate.goog/ccTlEF/lDif3dnSI/aQ9dXs48VI?WW5KNVlXNHVkMjlzWmtCbVlXRXVaMjkyOlBvQWVISmx4c1d1aXZtb0dSUU5v+&_x_tr_sch=http&_x_tr_sl=xgqbBJSb&_x_tr_tl=MZcTUhWl	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://r.srvtrck.com/v1/redirect?yk_tag=337_47d_c3_3b6f&site_id=56e7d51be4b05d750682348a&api_key=abbc5236946676eae219a734c0a1c5e8&url=https://h6b48.mallgy.ru/t868/NDQ0MzU1L2Zyb250ZW5kL2p1cGl0ZXIvZmlsZW1hbmFnZXIvaW5kZXguaHRtbDQ0NDM1NS9mcm9udGVuZC9qdXBpdGVyL2ZpbGVtYW5hZ2VyL2luZGV4Lmh0bWw/Xcmartinez@seprint.co	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://lookerstudio.google.com/s/rnl7Zh7YYXU	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://my.visme.co/view/mxkm0ny3-smart-uk-automotive-ltd	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://storage.googleapis.com/dfg153erh35ef1gdr/dfgremjflmgr.html#ju0fva66q2.gOMiCmdFIrHpIfFlsy?cbbbbcccTrBBcyM5jcdcL3c8cGVR7cbbccbbb5z	Get hash	malicious	Phisher	Browse	151.101.2.137

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
KIXS-AS-KRKoreaTelecomKR	http://121.190.90.250:8081/js/3/paste.ps1	Get hash	malicious	Unknown	Browse	121.190.90.250
	https://trk-mkt.tason.com/CheckNew.html?TV9JRD0xNDk4OTAyMjM5OQ==&U1RZUEU9TUFTUw==&RU1BSUxfSUQ9c2toOTk5QGtvbmt1ay5hYy5rcg==&TElTVF9UQUJMRT1FQkFEMTI2MA==&UE9TVF9JRD0yMDIzMTIwODEwMDAxNTg4OTIzOQ==&VEM9MjAyMzEyMjQ=&S0lORD1D&Q0lEPTAyNg==&URL=https://r20.rs6.net/tn.jsp?f=001inaIzPueFoy4blFhj0ANmDQ_3bBZ6-Fd08Z3awxqaucSF5n93F7Gol2J0qoqHefvTr-Cwsu5IQJ4pFZDC7SoMdcHS7k9-SB8FTr3edBn6aZsyO-ruGQyz0QcAv2obC5aj5_XtxB2E3ISw-6PF3ykM7NDGG0ykesIGw4zwFiri5Q=&c=n5B1gTzS7EvGotDE-PFOQ8mqSX8m6wsl-yYcXoHM8CEU57dgwNo9JQ==&ch=BfOUTbW5oz2BVW8gYsMlrL5UyzJ78wlcwBATQA_2-vQiDjKK3MKu6g===&__=/qwer/vVQNx/YW1hbmV6QGFtY25ldHdvcmtzLmNvbQ==	Get hash	malicious	Unknown	Browse	119.207.76.97
	SKM_Order0722112023_PDF.exe	Get hash	malicious	FormBook	Browse	183.111.183.64
	http://rscnode.dothome.co.kr/upload.php	Get hash	malicious	Unknown	Browse	112.175.185.131
	http://rscnode.dothome.co.kr/index.php	Get hash	malicious	Unknown	Browse	112.175.185.131
	arm5-20231216-1307.elf	Get hash	malicious	Mirai	Browse	115.2.242.1
	arm7-20231216-1307.elf	Get hash	malicious	Mirai	Browse	125.147.81.137
	x86_64-20231216-1226.elf	Get hash	malicious	Mirai	Browse	221.156.179.137
	arm7-20231216-1225.elf	Get hash	malicious	Mirai	Browse	115.21.92.16
	arm4-20231215-1038.elf	Get hash	malicious	Mirai	Browse	118.40.193.6
	x86-20231215-0039.elf	Get hash	malicious	Mirai	Browse	121.179.211.243
	x86-20231214-2132.elf	Get hash	malicious	Mirai	Browse	118.62.185.190
	Co8GEPjv8j.elf	Get hash	malicious	Mirai	Browse	222.103.245.255
	GenOJdFvy7.elf	Get hash	malicious	Mirai	Browse	222.118.148.177
	https://trk-mkt.tason.com/CheckNew.html?TV9JRD0xNDk4OTAyMjM5OQ==&U1RZUEU9TUFTUw==&RU1BSUxfSUQ9c2toOTk5QGtvbmt1ay5hYy5rcg==&TElTVF9UQUJMRT1FQkFEMTI2MA==&UE9TVF9JRD0yMDIzMTIwODEwMDAxNTg4OTIzOQ==&VEM9MjAyMzEyMjQ=&S0lORD1D&Q0lEPTAyNg==&URL=https://r20.rs6.net/tn.jsp?f=001z8Ft_ToOytqJT1MjpJnRtEkqXx0RYdWKwvcgyNwdA64qSBqFph4RQgiKcGa8ftvdLXWraSpOHkjaagO3nD3y0Wy1HGfMXrIAO-gqcoAamOaLswJIbUYFv3BOhOWgG0BMQVeK8TOXR17z7_2JY2r0aN0z0oNNHvdv&c=FZIwAsEWPPUefzGjJm7P89UfwfKrPXYNnRzYaBNQoT91Cg_Du6OPmg==&ch=gMpHrg6DrwSuYOtpK9MBvDUyKDEYUKuEaGTLCD5M0abiFcHvPuFZAQ===&__=/qwer/a2F5QGF2ZXN0YXJjdS5jb20=	Get hash	malicious	HTMLPhisher	Browse	119.207.76.97
	8as7BA35XQ.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	211.104.254.139
	https://trk-mkt.tason.com/CheckNew.html?TV9JRD0xNDk4OTAyMjM5OQ==&U1RZUEU9TUFTUw==&RU1BSUxfSUQ9c2toOTk5QGtvbmt1ay5hYy5rcg==&TElTVF9UQUJMRT1FQkFEMTI2MA==&UE9TVF9JRD0yMDIzMTIwODEwMDAxNTg4OTIzOQ==&VEM9MjAyMzEyMjQ=&S0lORD1D&Q0lEPTAyNg==&URL=https://r20.rs6.net/tn.jsp?f=001z8Ft_ToOytqJT1MjpJnRtEkqXx0RYdWKwvcgyNwdA64qSBqFph4RQgiKcGa8ftvdLXWraSpOHkjaagO3nD3y0Wy1HGfMXrIAO-gqcoAamOaLswJIbUYFv3BOhOWgG0BMQVeK8TOXR17z7_2JY2r0aN0z0oNNHvdv&c=FZIwAsEWPPUefzGjJm7P89UfwfKrPXYNnRzYaBNQoT91Cg_Du6OPmg==&ch=gMpHrg6DrwSuYOtpK9MBvDUyKDEYUKuEaGTLCD5M0abiFcHvPuFZAQ===&__=/qwer/ZGVyZWsuY2FzdGVsbGFuYUBlcnQuY29t	Get hash	malicious	HTMLPhisher	Browse	119.207.76.97
	x86-20231214-0641.elf	Get hash	malicious	Mirai	Browse	14.54.46.168
	arm7-20231214-0334.elf	Get hash	malicious	Mirai	Browse	175.239.97.29
	arm5-20231213-1917.elf	Get hash	malicious	Mirai	Browse	119.209.45.251
FASTLYUS	900099668990900.js	Get hash	malicious	STRRAT	Browse	199.232.192.209
	900099668990900.js	Get hash	malicious	STRRAT	Browse	199.232.196.209
	p3h5r9NsxY.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	151.101.2.133
	XW9DuF7Pys.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	151.101.65.21
	http://salpspa.shop/	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	GarEwUZuLO.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	185.199.111.133
	http://maineorthopaedicscomau.website	Get hash	malicious	Unknown	Browse	151.101.129.44
	31N825YHrQ.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	151.101.1.21
	Zgh9WMogTw.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	185.199.111.133
	YEEonf5uFX.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	151.101.2.133
	QecR2L8QRt.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	QecR2L8QRt.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	8k5q0nli7N.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	151.101.2.133
	8GZXHbmsm8.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	151.101.2.133
	Qs9Qa2ra9M.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	151.101.2.133
	https://www.snbc.heichezxhk.com/ibg/client/home.php	Get hash	malicious	Unknown	Browse	151.101.1.194
	line.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	151.101.1.21
	https://summer-spurious-tithonia.glitch.me/mart.shtml	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	tSrcyVu7Nb.exe	Get hash	malicious	SmokeLoader	Browse	151.101.1.21
	https://www.51-20-0-29.cprapid.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.66.133

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://trackinghub.info/	Get hash	malicious	Unknown	Browse	23.206.229.226
	YIWta5djON.exe	Get hash	malicious	Unknown	Browse	23.206.229.226
	http://payonresultsc.xyz	Get hash	malicious	Unknown	Browse	23.206.229.226
	YIWta5djON.exe	Get hash	malicious	Unknown	Browse	23.206.229.226
	8UIc9QxZSj.exe	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://dynamicgiass.com/Masacks@hammond.com.au	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.206.229.226
	https://my-s0ftbank.com/sbid_auth/type1/2.0/authorization	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://au.oiwka.freeddns.com/mygov-login	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://xusrewyob.xyz/login.php	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://yuanweibar.com/	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://www.franciscoz.com/funccode.php	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://pypal0ch22.online/secure/3/4.php?join-us.x=7ab6f759f9cdcdf6bb3	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://www.51-20-0-29.cprapid.com/	Get hash	malicious	HTMLPhisher	Browse	23.206.229.226
	https://sharepoint-bunteng-auth.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	23.206.229.226
	https://pub-ece886618dfa41788215ebe75499391f.r2.dev/porn.html	Get hash	malicious	HTMLPhisher	Browse	23.206.229.226
	https://bafybeied3ykd6rwigyhlm3tqfluknhi5ypj5tg2lmfoabdrgpb6m5wfyl4.ipfs.w3s.link/officeshare.html	Get hash	malicious	HTMLPhisher	Browse	23.206.229.226
	https://pub-2598caa00dcf4c658bf8753f6761f962.r2.dev/compki.html	Get hash	malicious	HTMLPhisher	Browse	23.206.229.226
	https://index.cr-mufj-bk.com/bkindex/index.php?a8942eb4e6cecd05f8b2d6c58a117d64=a8942eb4e6cecd05f8b2d6c58a117d64	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://https.secure-links.bloemlight.com/XVEdSV1YycHFWaTl0VFZCQllWaHlOekJNY1UwcmRrWnJjbEpLVUdGVVJEUXlSa3hVTWtRcmFFWTBhRVpIYlZCUFoyNDFTM1ZqY0ZZMVlsbFJTRkZFVERab00zSnZTRGw2YUdKeWMydENObVJWY3pWWEwxRmtaM05HWm5WcVl5dDZRamxGZUVKMWFtSkJSRGhPUVZFNGRsZG5hRXBqUW1ObVpVRmFOekJoUTNkU1VIVmljM05NTUVscVRrNURNMEpUTmxaTGVEVlRSRTlCYW5GRGIyYzBPU3R2V0dOdlMzRlpSMUppVm01TVEwUjNaRzVKZVhGaEswaFZha2hSVFRaSExTMURia1puVVVKWFZtcGtRMXBEUWtFeGFuZFFRbkJuUFQwPS0tZDdiYmVmNzQwNzQ2NTYyNmM0ZDNmMzEwYWYyYTZhOTVhMzU5YTQ1ZQ==?cid=1845890172	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://labest.com/hits_banner_redirect.php?cat=55&redirect=http://Pfcu.paidperreview.com/a293ZW5zQHBmY3UuY29t&c=E,1,VE5i5zGOYN5lv7fX89L5vDQFSEjb4eQhCs4iwGW3NkFr3yVsZRj6iOoIyvq-9j3V5qfBQUqL0aLBbmd4GLfdDcPHFy78ScSF-AiaXYjWxSmUGQ,,&typo=1	Get hash	malicious	Unknown	Browse	23.206.229.226
28a2c9bd18a11de089ef85a160da29e4	IMG-20231215-WA0005[94].vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	https://trackinghub.info/	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	PO46823.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	invoice_29082365-paid_50_percent_12192023.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	YIWta5djON.exe	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	http://payonresultsc.xyz	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	YIWta5djON.exe	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	http://salpspa.shop/	Get hash	malicious	HTMLPhisher	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	deEzk5CTqP.exe	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	8UIc9QxZSj.exe	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	deEzk5CTqP.exe	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	oa1Ogjv3kL.exe	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	8UIc9QxZSj.exe	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	oa1Ogjv3kL.exe	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	http://maineorthopaedicscomau.website	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	t5tkGPp6bY.exe	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	t5tkGPp6bY.exe	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	https://dynamicgiass.com/Masacks@hammond.com.au	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	http://62.233.50.101:11197/ncat.exe	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183
	https://my-s0ftbank.com/sbid_auth/type1/2.0/authorization	Get hash	malicious	Unknown	Browse	23.206.229.226 13.85.23.86 23.193.120.112 20.114.59.183

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 19 07:55:40 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9809941746309576
Encrypted:	false
SSDEEP:	48:8d0ddTFR2HhidAKZdA1oehwiZUklqehoxy+3:8dCvZzy
MD5:	93E6CBEE52E0B700BE0537A92C04393E
SHA1:	CC1E10A643E3BAFB0DEDF6B5878611B32DD808F0
SHA-256:	704F72206B420E7975EB6D0738BDEE34B83012F9339E96CAFF0B0FAE5E7EE25D
SHA-512:	638BA0D23506BB534B03784595FBAEB1D5226977AB2BAF7D7610D2B108F1AAB46DC47EFB785A150E140938357D998CE67174D1619D0995A124D40CB110C72B9C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....;$Y2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.W.F....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.F....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.F....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.F..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.F...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 19 07:55:40 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.99525072414508
Encrypted:	false
SSDEEP:	48:88p0ddTFR2HhidAKZdA1leh/iZUkAQkqehZxy+2:8ACvL9QCy
MD5:	32518DEB296B88D9BEF269696EEEB019
SHA1:	532EAAE38E9D4D3A0EBA53969750343610A59EBA
SHA-256:	CEFA85D4D2F4BDD6C8F0E2CAEA8F8A9BDAEC9EB31A6AF19957322CDECB3ECF6E
SHA-512:	EC9E7A58DD7098FDFA3ECF09BDE8FECAF591C3BC3134850256E2E7D8E51F9EB2453CC6FF06CA506985B1E4CE09CE0E6BE9593C4B77672DE2D7726F01DE35CE28
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....!1$Y2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.W.F....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.F....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.F....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.F..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.F...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.007280208561232
Encrypted:	false
SSDEEP:	48:8Y0ddTFRbHhidAKZdA14t5eh7sFiZUkmgqeh7sXxy+BX:8YCvUn3y
MD5:	5C2371AEFD80CB4E447F76A9900E77C6
SHA1:	ACA2CB6EFD785AB492E6F1628C1C6E229337D35D
SHA-256:	82378B09E452EEC7E4DA2EDE7A662F59D962530067B90BA51DD0A6DE298D68A5
SHA-512:	F356F8FEB2B5FEC2B4A4EF2E9F4DABE1EE6DFEE56818ADF7BE50423CB0EFAC4533F4A28201F5996EF92EDC73861111782A847E827EC5D84CC1E28BA9BFE55313
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.W.F....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.F....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.F....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.F..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 19 07:55:40 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.993818442041776
Encrypted:	false
SSDEEP:	48:8+0ddTFR2HhidAKZdA16ehDiZUkwqehdxy+R:8+CvYpy
MD5:	CF0810EA2A74A31B0B98AFE9EA516ACF
SHA1:	4677194EACE6C0EEA2C1282E266D4D00D58CF950
SHA-256:	D999107E834A4BB725B2203D454F20B032602ED7F5FCC7CBD9258DF8172BC4A0
SHA-512:	70BAE15A858B722F96DA1E78894012369224381DF2593CD7FD08CFFB7F30A75E5EB03D5DC9D844A2C90EC60B84D6F404A20F060F2781975FB4D7FF44452DA8F3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......+$Y2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.W.F....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.F....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.F....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.F..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.F...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 19 07:55:40 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9815221846491564
Encrypted:	false
SSDEEP:	48:880ddTFR2HhidAKZdA1UehBiZUk1W1qehTxy+C:88CvI9ly
MD5:	01EC19F91C4EE11C35133A234807890A
SHA1:	6E79D82A6D031C23BBCB58FE36BA6A944A479447
SHA-256:	B1A77DEDC18BA9DD523ABDDC9A5AA877A44F33724FADE07A7F9D19980E129BD8
SHA-512:	A3D6DF03FD7801D0F2D6785320FE138164F8B14A07C554F6E691CFDD5448179A6B6D2474EEED4B2CD65E476DFDE7B8D25C4EDECBF8D00AB6A98CE7A83F3A6F2E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....y6$Y2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.W.F....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.F....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.F....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.F..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.F...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 19 07:55:40 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9919599719575243
Encrypted:	false
SSDEEP:	48:860ddTFR2HhidAKZdA1duTrehOuTbbiZUk5OjqehOuTblxy+yT+:86CvlTYTbxWOvTb3y7T
MD5:	FC6A874310699B1BFC14F2906930F6E8
SHA1:	D11719C57B4FEED1D9EE1B6E8F876FD6CF492266
SHA-256:	DA43F2EF68BF62F55F4F04CF0EF27519DF7580B6E2D7109DE6791F63F16D1C31
SHA-512:	44C221074E58235995A8D6EC6E9E2CDB87FB50D1A0E6DA72E3B308182C33E2C369EA91969E94840D61E8B3FF1C5D559DD11F6A4721FA1E1244CCCFA6662696AD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...... $Y2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.W.F....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.F....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.F....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.F..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.F...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 41x33, components 3
Category:	downloaded
Size (bytes):	1937
Entropy (8bit):	7.0256952739892595
Encrypted:	false
SSDEEP:	24:2QK1he91Wwh82lYSKwDNnMzyV+zNT3ouyJ3VQ2GKeLTqgQ7JPRqq91Zk8EQwx/7z:mqQvnLyJCy+NIJ3HVGmXvXMD+MSwf
MD5:	019831C6832BD1E018FBBF35F1A7B029
SHA1:	D829AC71A8E35FB837980F2538A9CCE29DDC0AA3
SHA-256:	CA0EA0A5AE68A19374D4B356F61E08BD7458E02957C4EA6575A670C71E007710
SHA-512:	6E139779569F97CD7B7A7DC5B2AFBCE8762C907F6AED937A7D026C3A9645291E249855553EBE741014A94A6E50D5148ACFC6681CA6DCF4AFCBB6848120AE0F74
Malicious:	false
Reputation:	low
URL:	https://esemuro.bizmeka.com/html16/images/mail/ico_email.jpg
Preview:	......Exif..II*.................Ducky.......d.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C423A0177EA5E611B687E1DE4528220A" xmpMM:DocumentID="xmp.did:9DA59870A71411E6A487A2D94F77ECF5" xmpMM:InstanceID="xmp.iid:9DA5986FA71411E6A487A2D94F77ECF5" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:44C6124CDCA6E6119E7EECB597D82439" stRef:documentID="xmp.did:C423A0177EA5E611B687E1DE4528220A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 25240, version 1.0
Category:	downloaded
Size (bytes):	25240
Entropy (8bit):	7.991283302324036
Encrypted:	true
SSDEEP:	768:IXDsvyy4RzOoJF6tOzh4DqvXtWbzK19bme7:WDs4zOkF6wmOv98zk9bx7
MD5:	CD52597265276989FEDD8B3EC16B13AA
SHA1:	5F189B9DBD1EDB1BB1FE339CC07C11FFDF231440
SHA-256:	AE8E51E03E4EE55582783100BB12E331A72159293EDE206858D90C59E5849303
SHA-512:	2625EF626E983C8140B9AA4DDB6B7925C3554243752E2B03A23D80A78B3CFCBA2C73B060F9A0D325BEB96DBDE8CF453C3932E972DF3815677EF51E2F4623036B
Malicious:	false
Reputation:	low
URL:	http://fonts.gstatic.com/s/nanumgothic/v23/PN_3Rfi-oW3hYwmKDpxS7F_z-7rJxHVIsPV5MbNO2rV2_va-Nv6p.113.woff2
Preview:	wOF2......b..........b=.........................`..4..4..#.....X..T..R..6.$..\. .... ..j..5.mjO.m.@.Z{..F"d....ohfP.8. ..4.......~ .VF.aC...68<{..l8..Mg.w.a3.g...^ W^0.p....O^.(.3>%b.&T..3T.w.@A..JvRp@+....&....<O..k.\|.....c....l...0...z...\|..#.q.....qG....3.m...F......}...(...#'..@`.b.@..A. `......n......8.]...[w.9.N}..>..%E..."..'.l..R 6].%R..t.J..i....v..)J....Au...m.2..!....E.\2@s._...w..1b........"..I.h....4...1.F.b.R.3.........?.3..O...+.J8..../y.r..b......$Ej!4.Y..{...^H.'..L..dz._#.<....w...H.+BGh...`.K...%$HiX..ZUX....._.i@..8.735..~Ny.....m9-..i......;....J..=r,.&......l.,..&.......!...!..v...."..6K.zh=v.9..o.3.~bq#n;....t.f...9. ......m...........xwE....PR.Oo.l...6l..CE...%..5.z%.i.../....#.B.cY.suP......w..j.LSez,S....].&F.Y.=.7+?.;.//.<e?.. T..jvf.....G......n.r8.K....K.:..).2...x......1.H.M.. J.$..5.n6..Q....P.._.,.!....7..L...UU.:......7.$.ZZ.@#....s.......=...T[Z..BB..IX.... f.......?<..}...\eb0R.L`.!.1...i...a...Q..._JY.

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18568, version 1.0
Category:	downloaded
Size (bytes):	18568
Entropy (8bit):	7.987885623098422
Encrypted:	false
SSDEEP:	384:1cbd7YtWLz8TSU0FveGApvjImOu/UPmJKyXdSWYVgpJLmNDofio:14J/z8TSU0P+7x/UiXddGgzaDJo
MD5:	0F8573160BBA1A05624EAA58FD188573
SHA1:	7316EE1A02DF07420BD76AC51E949E907271025E
SHA-256:	039F951D6366B6BE3FFA909BEA03C904182CFED9877855F1889FA7FAAC2138EB
SHA-512:	C62EA436FFB053760D2BA79DEA7177A91658F0926F3E4B48970D749159357EEA8B761D52460C60858FA3E69E847876E0A8995E91BB70FC39CC0078AAA885ED09
Malicious:	false
Reputation:	low
URL:	http://fonts.gstatic.com/s/nanumgothic/v23/PN_3Rfi-oW3hYwmKDpxS7F_z-7rJxHVIsPV5MbNO2rV2_va-Nv6p.118.woff2
Preview:	wOF2......H...........H,.........................`..<..4..#.....4..F..P..6.$..`. .... ..j...5x.i......Z.(..#...E...MN.(.;...;d.......+E.@&.0...Yc.}.....dW...Y..b$.Z......y.T.....x._a!./...n6.T..R..u.c......;."t.;H._.w..~(..k6.Lf..Fw..].<}KU.).3..L.P.a?W.>Bc..._.o.fV...a6US... .h.E.CT3B.LD#b.!..(f.....IHZ.....!.......0A.AE_...._.h...rj.g[`..Y..3...Zv..kW....sf......./g:.F...(.6.......v........[o_-.z........P.,..P..8@.H%...PT.T..M{S..M]D..W.......E..k}k...z7.......^..........'........Y%.h...Im\W....9.Q...v...o...wC..P.....]...,/.m............I...W...C.MM.E.......b...z..Y.r". .....r\..C...`.]...9.weuV....}......Qj.t...5.C..R......Q9.._:-.`.....a.....@gR1..H..r.C.......K..RB....h..4...c.N.K.I(.T..J....(.a.S$.y.J)T..u.q...s..&..w'.g.+\|.......ny.y{[B..BU.i.^..{......J.$.>.s....f.B.q..@m..{.......L..."..h...J....).P5A..gU....#.Q........FP...#..._.%S....p.a~Amt........1..!O.>.s.i.hm........:P.....^.........v.<t.....M>..x..'.O\lv6.k.o.."kQ..>D

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 22676, version 1.0
Category:	downloaded
Size (bytes):	22676
Entropy (8bit):	7.991250490927075
Encrypted:	true
SSDEEP:	384:NqI/Ubfh+OGdN1ZPFErgCi0+/sLQ+GS3ycEZVCVk/Y8bcIZwtQ24a:v8sllFAi0vLniVCVTX0EQ4
MD5:	6D8521F56C60346CFF88564A142A1694
SHA1:	AAA2A34906FB1215105504951FEBA9688F90BF58
SHA-256:	48FCF86EBA788B483AFCB5587FD516330D5A74497508E53A706F9135B93C22B1
SHA-512:	164E6D0CB31DC76F99E429FA5982986AD2ED776CFCC24BB408D3E6140BC0F7E7E376EEFE7A41C6AC4AAD49CEC56089E52294EA48E42755C1237378D75B0CACA7
Malicious:	false
URL:	http://fonts.gstatic.com/s/nanumgothic/v23/PN_oRfi-oW3hYwmKDpxS7F_LQv37yzkx1Yl3P690375P--a0I5vFgZwP.115.woff2
Preview:	wOF2......X...........X;.........................`..<..4..#.....`..x..R..6.$..b. ..4. ..j...%.n.....Osj....d42....,vk.....C.:..^..cA.!...0...3.........n...M.....#..3,..g.M.K....k.../.:...A_..W.p`..D.....'...$.@R..,._.G...t.]...{>n.z...p..Mq..._..\|UED.#....$.g.9D..h..o.U........Q.E.$H.A$@.. E..".....`.......6Iuckr.....\|..A...\|H...s)z..Y.`.Q......m4...........".s........".r..2.<O......&.\|.k..6...7o...I.J#4.............-.!..f%....b>H..?.6O...T.2f..N,mu.Y(.N.,.....hW......^.).8E.. .b..as"Uy...L.lN7?....T,DD........@.....\|).k..@..JA.Lepq.;.....i...+M..<.>.k...INY~.BJ:.*.)Zh.h..%....Z..G..s...s.k.+.C9......,......>0M..3...A.2.......E.kPl.d..1./..X....X...eMflf\|.LA. uidl.).'..Ie........<...x(.1..e..$+..\|...m..,....t....f.V@.;.y..5...d[7..2....%...9qq.d"VB./z.i....r.Z@A.i.....0...7.......q0..S.D..\|R..y.X".....@(..wD.._L..........Q.k....}P g.....w..2.W.........B.........;#KF......c...x....i.s......N..~.....B.......p/s{........%.?..~._....A

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 132x33, components 3
Category:	dropped
Size (bytes):	1976
Entropy (8bit):	6.946124852008806
Encrypted:	false
SSDEEP:	48:mqQvnLyLchA3yIJ3HV77wcMvNsey3KQbXzeo:XQOYUyuV77wc8y3KQbXzeo
MD5:	7DAF9BFBED80AB1308FF2EA8E2EC8EBA
SHA1:	37C1D0F3877B5C396840B0CFE3A90668B8A89E7F
SHA-256:	AD91DF1C0467C7EF18CF12C04D83DCF2AC6DFE58A66DE03F7D5606B63030075D
SHA-512:	0D853327D4BC703264412FA1BAFE4D3725D8A9DBD60D21267BA76ED1D7141482E3F522B90762EF6EBFCED271C0CCCAFE523DF858D409F3918E8F2D9669617A68
Malicious:	false
Preview:	......Exif..II*.................Ducky.......d.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C423A0177EA5E611B687E1DE4528220A" xmpMM:DocumentID="xmp.did:AD95441CA71411E69733FB3451657AC5" xmpMM:InstanceID="xmp.iid:AD95441BA71411E69733FB3451657AC5" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:44C6124CDCA6E6119E7EECB597D82439" stRef:documentID="xmp.did:C423A0177EA5E611B687E1DE4528220A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 17108, version 1.0
Category:	downloaded
Size (bytes):	17108
Entropy (8bit):	7.989560823490416
Encrypted:	false
SSDEEP:	384:b2+2ncPp9TwyNTDnwhx4aNzi0PTGDPxexAzLxU:b2+2cx9JT2NZTAiAz+
MD5:	01FE0D37C63C0CDC03B3745C03D01E2D
SHA1:	FFEA61C3D4362B6AD9405E84B55458908201A0AD
SHA-256:	08CF22BF32D06BB0425A7780A99C59A8AC6ADF811868200F544C826873113BF4
SHA-512:	E0BA30867DC63C363D774FCC37FBB836E0C8925DF089413D422ECD9938574B6C17AC865E3FF9E76DE095EC0A8BA31C691200B0FBDFCA1245C3DB24B898432458
Malicious:	false
URL:	http://fonts.gstatic.com/s/nanumgothic/v23/PN_3Rfi-oW3hYwmKDpxS7F_D-dje.woff2
Preview:	wOF2......B...........Bx.........................`..<..4..#..............6.$.....8. .... ..j..v5x.~..T....#.........(].A...Br"c......,..n(A........5K...{...Sc&..}\.:...../.}.......y.~...?.k.+.k.Y.%............ .1.J...W..n..[...yn...}Y.L.b.l.-Gh....f....Y....%!- (.....(.s....\.....".7.....^......w.deKO....l#.....e.NP...Dw{.....f.fV.RU....0)2....&zB.......iN.8....$........./^..OL.z-i...S.....nV..G...h...2T...L..J...R9@Jp..#../.Y.W.rAv.%..J..._.l....a.0...a....=0.R.`_Ib..k....fv....J......[.;.n.....C.$......[........X$.H.r..DS...S_~..&..6.......V......a.=...,..P..i..."..D.._...I...cZ...u>..............j..A)...;;.)L.b.bQ^Q.........b.0,H.....N.Z%...J7...$'........ .S.9..)...UTN.r.tY9......j.A..2McP.'g.'.$.....I.['41.....K....<....."tT....gO.-.p....B.I`.,l.._.......\@....5.v/.4..)Fn...~....5v...hk..d.C0p..D...b...5...>..Z!....Q...}0.&.@..]......k...........;..h\|...`bD.'&..:0.....h..`..N....{.......Y..h=..g..4.M..t.~E.j3.~.^X.....Xm...;.[.

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 276719
Category:	downloaded
Size (bytes):	70103
Entropy (8bit):	7.989933933165842
Encrypted:	false
SSDEEP:	1536:WCtGLd/kKNmvmmbioRsM8v5MLR4AwiK33Re2vbFaIAbM:Wckd8eyKa8vilyiI3RVvbFazM
MD5:	7563B78B3A3A830B5CD517D842038359
SHA1:	4884E11B010B38A5B11A5C50FC4E24AD88B207F1
SHA-256:	FDEA9557C8543F549A22D21571BB7B8F3F94DDA01648A663A6BE16681225C2DB
SHA-512:	56E1DED8492753C9AD9223F13E56561D7ABF8B38B4B7A777CDD7262088DFDC2E32415A33A487BF9FAE9547EF0C0252289C9D94EA0FCE34A4A4E3716294D1B318
Malicious:	false
URL:	http://fonts.googleapis.com/earlyaccess/nanumgothic.css
Preview:	...........K...m.....s...~.o..rE. A..A`T.${..1.sA.{..z..l..6"(Q.>..b....'.......\|..].}........?......_}........_~..._.......>..o.>\|..........W....................~..d~..~.4>}.~.........._.k....?...............?\|.................._....._.?...././.?.~...........loa...~.............q.}?.....?........\\|.C.....%.c\|..?6...fNfN.:yF.,...G..fr....{&....{.Ho...?[$<.".E.....nf...fb6&q%.J.6..1..,.\a$..+.+...A[.X.0........ .$.......]...........Lc.........<^.Y.`...V.....j.+..H\|mg.U.pe._A.2....#.)0..+...(8..B.%.z\..y......g..gx-..Z....X>..a..s.......].YP.x...,b..;..SZ...\|5..{.G..(q.....:..!.%......B&rO.b.... .O.1.....<T.T..J..d.ei+D#).(...>.U~FP.{A......w.<.....qK......K..-9.t...Z.d<.5Cd<...t...2]dM..pO!...(z...$+..m.q...!.....{.......[.O%....:.L.C.vKj...4#.6`...H".=.....Bv...>.......H...d...#.7....\.rE.,.1M.........)i0..?..=.....S.e.K0E..d^.^&&.E......_1HG@G....U'.x8.5J+sZ.]....a..3...IZQI+R.E....c..P..7.u.AG.6....-.

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18032, version 1.0
Category:	downloaded
Size (bytes):	18032
Entropy (8bit):	7.988725539387882
Encrypted:	false
SSDEEP:	384:MKnNEl0kuw5ZiPjz9/0aKK/lP9N3/qFVCKMKX86QJwTjr0I2BcoD/:MSNY0kfZw/0qdP9N3yFQKrvrEcoD/
MD5:	159BF8FCF27CC27CD20DBEB6CBC6C447
SHA1:	C0CE8B7B825FD49205E17A39DAC8489C30A5D06A
SHA-256:	D51D17289FBC3F09AA424B050CF5C9F222BDA8DD62779D69A11DD2324CBBBFEE
SHA-512:	1D64EF18EE8446EF47F27B6D36EFBB31BEF0F0AF780D75855E800907076389BCEA87C3B8ECBAF03D13C403C92A838D1B0DDCB7B108F868D13637A633F4ED2100
Malicious:	false
URL:	http://fonts.gstatic.com/s/nanumgothic/v23/PN_oRfi-oW3hYwmKDpxS7F_LQv37yzkx1Yl3P690375P--a0I5vFgZwP.118.woff2
Preview:	wOF2......Fp..........F..........................`..<..4..#.....4..{..P..6.$..`. ..4. ..j.....X/..@A.'j....&.`.....:..[rc.`?`.6...p.B....F.a:8d.V.vh0..x...~..I+...f..o..t..U(2..z]X.M'I...#.~...Bn...q+.....'t..J...;u....V.\|..>.%.X{.ww...T.H....".L....,..............#.[..XD.6jokV...0...6...F.D.....J....>......7.E.I...`H Q! ...{"(-.jQ{.eJk?u...T.9Gz.....ng).k....e-.9.^....,..-_=.oZ._.K.jk.4.Zr..$+..H5m.,q.......N..LAT.....J.(.).S...].d....c...l...;.....Z.b... ..}s+.....e.US..).......\..p."d.C....>........?H3i...D....]K.pt#.).F)f.b39A.......&.........Unjn7..P.X... P...M5....K:.S...H9.!..M..v...? ...`A..%. %{..7 (...nL.)..^.......L9.T.:..]...t....9....to@JX....P,yu.mYJ.yR.dc..[T.X@..-.....}....X.R%.;?.e.Fxe-bc. .W.._.5...5..f..Vf.....D..&..8..?)4.?....f..'.....!S}<7...q..o..PL.?.i...N.].2.%.C..x.G."....B.B.p......~.x........'....;.....<:.}..!=..i.^.9q@Z*....=r........H4..m.........b.'.&w&..R....).:R 5..K.R%.Fk..j....^...........kt......I'r.

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 17136, version 1.0
Category:	downloaded
Size (bytes):	17136
Entropy (8bit):	7.988124307377875
Encrypted:	false
SSDEEP:	384:Z9vfOOgQCJWkUOugXdIum3SKWVp9mdtTo9HCOuEnlP:LdgxJWRHR3Kg7TLNEJ
MD5:	B2ADE457986A3CBB7CBEA2D6B36A2641
SHA1:	E5F6E63EAA8ACCBC295AB09D8CA76766440A9626
SHA-256:	BD226A3CAA42416D1A4A9A464D11533F5E7500D9870EE98A5F507E93F92B53BD
SHA-512:	1BD8B0354F086ECA12F0C0C22F9DD948D925AC2A9BAFCE8EA44FE177B00588E7E47594DAD52C7283016FE9C926F94CDEB51D25B67BAB938E7C2B728B90FDF40A
Malicious:	false
URL:	http://fonts.gstatic.com/s/nanumgothic/v23/PN_oRfi-oW3hYwmKDpxS7F_LQv3LyVsm.woff2
Preview:	wOF2......B...........B..........................`..<..4..#.....P........6.$.....8. ..4. ..j..w............6..YC..nr...%7.(..._....\...v.v...u0.@...7.7Tz...t.#.d.:.lO.$.......#.Y&...oiPK..@?.....=.E..."Z....>r....Or.z.~?G3#.i.dY.d'......I..rz..^.t..%.....u......k9.....0....D...H.QI.Dh...f-tU..E....._...^}l_M....w/.2...H.[U....D-#.....$;.;...?.4a[Nm2U......FN9.....aa..HF.$.w?<~...e...06...(..mc.:.E...Y..\|..r.g'lx`.>.}....Ua.=...#.e.c.J....._..ks....M.!n<..W.\|.d...h..B0.Xp......k.W.:h.."....{_..`..Y.P.....R........$..wR.N.J..X9.r9.g..3.%.......\...P..<>.P....');.Jw..%.K.{~$...b.R.u.lR..6.k..~?.{.E;4..N'j$Q=....{r....". .'.E.D.gmmy.......B...k...}./.C........;..#.dS...a.+...J.Xf....-...s........./F......6.].].fS.X.`....\n90..:......6..6.2A..(Z..P....7\|B..}.....w/A...<...J.....m. ....+t. .{...8.Qw=..........E.o..i....L:..s.r...C.W;c,.}..#...f;.t.5......~.{?...s.C.._YFW.../X...].#2.?fq.V.@.k.k......V.%..w.?..O..%0.=..n..3o5.#.}P..w...j.:t..[.......

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 12316, version 1.0
Category:	downloaded
Size (bytes):	12316
Entropy (8bit):	7.982861380785692
Encrypted:	false
SSDEEP:	384:1Lp+hJBJ4TuROUgEZISBniNNBY3dOvnr2:1Lpi14TuvgKFsyday
MD5:	3B067D25CB94009AE23ABD4FE00A7DBC
SHA1:	1F1D3F89A8188104F63957712E75216A41E13AF0
SHA-256:	B0AD896039FDCD68F2B45BD389A8D394B65AA544F434626847C12394CA3E74D2
SHA-512:	C70B923EB9178E85493A5502FE97B03D20DC2EAE83247C4D1775E8498DD9914C5BED91D4572E55A19C276E1C66B032FDDB476344555E9515A8A8C37B2EF80F59
Malicious:	false
URL:	http://fonts.gstatic.com/s/nanumgothic/v23/PN_3Rfi-oW3hYwmKDpxS7F_z-7rJxHVIsPV5MbNO2rV2_va-Nv6p.119.woff2
Preview:	wOF2......0.......Z.../..........................`..,..4..#.....L.6..L..6.$.....8. .... ..j..NUG\|.....b....O......A.JT.B......cr.l..q..hx..B.....;.%. J.K...8z..G...o.....-..S.[\|d>ky.U.........^.R".dt.$........5-..W.BA...RI%[.'[.....vH!R[.Z.......U....QCN;..b.].Ag..5...T....$..."....QQQ1f...X...\D..2....Q..I.PN..C.;...f\|D..s.~.....C:.:....X....okke..[.......N.@2..(!........>H.,...$..\..!..h...Y`..c......u.tcR.......K>..^..t.[..GTq..[.:..v...oN.....NG.ji..?.V./i..0.-....Mt.P.W..VuwIv.%..-.h.....@[....#/..1j[K..4.....Bx.Q./...................K......./..-.YU.W@..N..(R..].j.h.g.2...<....,....36.....N........?..>3yT".....0..<..a.....E &.?....#./yO....w.....d......B.>.....l\|.zFN........N8.G.D@`.Y.A...N..........N?...1.;y/..g..#.cd.,C......?p..U.fM.7.W.BZ....._.K..y.7{tV\Z..?....p.0Q3...Z#..@ax......gaK...D...=F[..=".,z.......s.r....$......E.r.X..t*.J.......lomn.......L...U.2.w.....2.Q.(\|.B.p. .sR..h.,.nG..2....M..y...G..xk.8.6..,.$0..-d...Ee......D_.b...

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 23624, version 1.0
Category:	downloaded
Size (bytes):	23624
Entropy (8bit):	7.99122388553472
Encrypted:	true
SSDEEP:	384:dfjUxrFsg+jGLoB+AZIR6zaPiemTWtIj5DawYBTZfr9X92C6EyW91omPMr+oS:VkrFJoB+HR6+qDWt8xYPt92vEyWLT/
MD5:	D1C6F2F40B755C524BCBF1286D60F314
SHA1:	E18CA192F62EA9FE27D27FB0427E35E26C2D0ECB
SHA-256:	E99A2FCB27479C91FF6B300E0FCE0FE93B491184698BC6179C511224E88283CF
SHA-512:	E42864BB1B4DC31651B793052FFA3476001A7D85F9E089D634950039E5A565D4A65282BC2537DAA8AAABC9118C49D2E39A1EB49BE7ED1EA6429E78282F5AEB33
Malicious:	false
URL:	http://fonts.gstatic.com/s/nanumgothic/v23/PN_3Rfi-oW3hYwmKDpxS7F_z-7rJxHVIsPV5MbNO2rV2_va-Nv6p.116.woff2
Preview:	wOF2......\H..........[..........................`..4..4..#...........R..6.$..d. .... ..j.....6..m.....+....a......H..q.2s^[...ON.(.;.... ..J...J(...=.=..^.\.....$\|..ZP!..C..a2&..N{T.6.>"......W../...N.+..s.........j.0..e.y...P.._..6...eI..x..b.[..f..&.b]xU.Z.[..k..6o....N..;.q/..h.F.CU..+]9..F.$'..On..73...h.....(...2F....A.....]=.....fJ#...7.U.V....w.Mv....:...0...M...BH#.P.K3HF.H.i..H.....9.l6....K.]..R./E...w.Rd_.z.\.^..........3...e{.h^..$$.&2%P".....`..!.....^...!].L..u....2.........P.w....[@.A..KT@.\.6.tg.\./+m..e.Z..ec..Z...l..%.s.H..S..6.....Q..:.?....~O..L.....f..2...G......E.u.W..m..2..~..1...X...l.L.;...6.a{._..T.KA.5...../.R......{k..-.i.t..I.[..].6...d.WA......6.T....}...af..{[S...#.1.-W..;...".q.._8...w.....{~FN.#..6v@..p...L...h.l..h..L.0U..uL~.g.a..$J!..R....#m/.n...T.....q._.@..6R[.[4.v..v..y.g..\|B.......^. .1....B..TAr7W.+...B...s@l.@...bhCj..K..O.Ku...]W..+m....9!.H.^.R.......I..".9.kQ.1.._+.....<2.r7B.N.U4.P.\....a..w..

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 20368, version 1.0
Category:	downloaded
Size (bytes):	20368
Entropy (8bit):	7.991475913565987
Encrypted:	true
SSDEEP:	384:VHirjvrX0IqTj56mtXJVN8fpj7EjAd3X65478Op9t+OhhbHeXsfoVzuM:N6v70Lxn4ajAMst+OhhK8uuM
MD5:	5E428707E6DFAE431A15601DA4114ABA
SHA1:	C69AB80FAF9EDC1776309A1BFD7CA322018210DC
SHA-256:	9CEDB5CBB123561C6520AE4516D4B7829F554228638E9AF28B4114AE37F982EB
SHA-512:	8724647BF84CA6BEA281F3FC9696685456853F61E34851A83EA7794BBB5B9C29A19BFBB5BA689B880BDD62F87A0A03198FCB86A71B5AC3E770C57B188F57F4FA
Malicious:	false
URL:	http://fonts.gstatic.com/s/nanumgothic/v23/PN_oRfi-oW3hYwmKDpxS7F_LQv37yzkx1Yl3P690375P--a0I5vFgZwP.117.woff2
Preview:	wOF2......O...........O4.........................`..,..4..#.....,..L..P..6.$..\. ..4. ..j.R.%.~........E.......qc...h..$X.4.=..[_..3..^>.Ko.4.P.......UI.z....F......BI(.......c.M..[0..J?x7..T."...a$X*.J..U..S..T...M..L.9N)..._..n%. ..M!....Ge..GH2;......T....(....%....[........S..m......;....5..[{{.+W.@~.g...rl...~O....P.(S...}...2)..y........d....j.Y".E..NI4...7{....:...$TD......Wg.9.....#......:.O.JBF ...#..D.W.....R..$...CH~..`....g..)u......4....=.z....$.X...r..V.\...I:.i.%^.........J.......0.......n0.S..h....wp.M..ma.HY.k..b.[;.\.T.(t.....(.]._.d.YY.}. .`.d.ah.../.......f7.\|!J....(........AtV..V.....O......7.l..$pq?u)Pt.3..H8..M.....> .KJ...1..7.(.....\......C...;;... .4C./P.E..R.\.X.].....7.;.............mN..}...g......B...d.I7.g.O{V.2.p."gj.....u.K./)j.6..d./...@9...b............5...:........d.A ...]^.B..iC.V.B..#5.U._n$....s ......_b.G..6Q]&.........M.N.z.9.#....g7x.~\|{hD.9.=.].."............hdJL_..,.f^.T3_d=...].+m...?...&..d!\.,\|X

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 480x77, components 3
Category:	dropped
Size (bytes):	17231
Entropy (8bit):	7.951371363819503
Encrypted:	false
SSDEEP:	384:XJ7tccM5G6BbOSUKZ4KZMrJhH39sj2d282ETIf/8mcOIou:XvccM5G6BbyKZ2jX9sj2Y4g/UOC
MD5:	0A8F01DEF01B4EA7AECFB4C344D0F091
SHA1:	FAB41F30AB81D0D4D603FDF12718FFDCC6EFB4D5
SHA-256:	3A685B9D11139980143EB535EB18DE01955A6C24B96BA2789C72A5C83A6ECAB8
SHA-512:	19D58E7DADF9EDA578ADBF92AE851AC5AA5BC7F5EDCEB51745A0807426A751F7282449123737B00FE41868DA7465486D51334D2A054C10516E7B1624A0CB7C62
Malicious:	false
Preview:	......Exif..II*.................Ducky.......d.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C423A0177EA5E611B687E1DE4528220A" xmpMM:DocumentID="xmp.did:2ACC5279A71511E68AC0A4DCD8BB0730" xmpMM:InstanceID="xmp.iid:2ACC5278A71511E68AC0A4DCD8BB0730" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:44C6124CDCA6E6119E7EECB597D82439" stRef:documentID="xmp.did:C423A0177EA5E611B687E1DE4528220A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 132x33, components 3
Category:	downloaded
Size (bytes):	1976
Entropy (8bit):	6.946124852008806
Encrypted:	false
SSDEEP:	48:mqQvnLyLchA3yIJ3HV77wcMvNsey3KQbXzeo:XQOYUyuV77wc8y3KQbXzeo
MD5:	7DAF9BFBED80AB1308FF2EA8E2EC8EBA
SHA1:	37C1D0F3877B5C396840B0CFE3A90668B8A89E7F
SHA-256:	AD91DF1C0467C7EF18CF12C04D83DCF2AC6DFE58A66DE03F7D5606B63030075D
SHA-512:	0D853327D4BC703264412FA1BAFE4D3725D8A9DBD60D21267BA76ED1D7141482E3F522B90762EF6EBFCED271C0CCCAFE523DF858D409F3918E8F2D9669617A68
Malicious:	false
URL:	https://esemuro.bizmeka.com/html16/images/mail/btn_confirm.jpg
Preview:	......Exif..II*.................Ducky.......d.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C423A0177EA5E611B687E1DE4528220A" xmpMM:DocumentID="xmp.did:AD95441CA71411E69733FB3451657AC5" xmpMM:InstanceID="xmp.iid:AD95441BA71411E69733FB3451657AC5" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:44C6124CDCA6E6119E7EECB597D82439" stRef:documentID="xmp.did:C423A0177EA5E611B687E1DE4528220A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 482x228, components 3
Category:	dropped
Size (bytes):	4252
Entropy (8bit):	5.777826906032296
Encrypted:	false
SSDEEP:	96:XQOMuVnFYEzVzVzVzVzVzVze4vvvvvvxj:XJVFYr4vvvvvvN
MD5:	0F2679F1AE697148C69B06DB75F00882
SHA1:	F256C70F57DC429ACB935D7F95B0D1B26D654DDB
SHA-256:	A68A8723C8A907851286C2BE8C90BBC7C67EA79E163306098A37BE1F5EFE470C
SHA-512:	537BAE6502939AE48B199A61F8B39B10E1B82E5DD3CAB993A23AA97FCF2E67A9C09CB6B3F174D00A33360D43C3A71385621E6DEDC88DCFDD203141D6F4847087
Malicious:	false
Preview:	......Exif..II*.................Ducky.......d.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C423A0177EA5E611B687E1DE4528220A" xmpMM:DocumentID="xmp.did:929D7D66A71411E690E6D9D65AABC5BC" xmpMM:InstanceID="xmp.iid:929D7D65A71411E690E6D9D65AABC5BC" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:44C6124CDCA6E6119E7EECB597D82439" stRef:documentID="xmp.did:C423A0177EA5E611B687E1DE4528220A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 20536, version 1.0
Category:	downloaded
Size (bytes):	20536
Entropy (8bit):	7.990261585262839
Encrypted:	true
SSDEEP:	384:R0Xk1qNp0Il5wYEENCqGnPG4zR84o3F/7VV0liommD5HAu86XWQ:R0Xcqnl5wYEENCVPKHdf0cG1YGT
MD5:	5028030FAA614B473D57E4B58FBA1A4C
SHA1:	1CEF09C87E146FC4AC030B2AF6A4820E5E57FD25
SHA-256:	9E23820B7BAADC6764496B12FC21E97B92381DC807645E87D58DFD241BEA4E70
SHA-512:	4E6FA7F60C15DEC03265AB1385186978C2133FE626C1C92D2F804B7198F4D4C464EE5B9DC86102EE39599C4216570218B4D9BBEAD31EB131D9A750E125BA1F45
Malicious:	false
URL:	http://fonts.gstatic.com/s/nanumgothic/v23/PN_3Rfi-oW3hYwmKDpxS7F_z-7rJxHVIsPV5MbNO2rV2_va-Nv6p.117.woff2
Preview:	wOF2......P8.......0..O..........................`..,..4..#........:..P..6.$..\. .... ..j. .5........6ud .8..j3Q.... m............. `K.....uc..h6..m2.....A.&..4..I..Y..O....,s.Q......j....I$.:..f7.?.....0........]\|g.~.XG..j..V..B..._w.4..B......k.....}....G.'3k..d....VmD.(b.W..L....y.f..`.jF..A. C.. :#.2.2...d..h.&R...'.l...._..f...W.......V..v..........+H.s...Dz.(!b'...R.;?;.5...Z.....].v.+.}?....o..v.j..{....m.oc.>.....g.....1.. R9..H9)......&D.&...0.......Mi.W'^9"Jmc.H....o.....y...U.{.Cl.#c.if....5.2j.Z.-..t..f.N.?. ...s.ex...LQ.LePq.;._Eg.4...s4.%pd....9.$.."?..rK!uh=&>U.%>.u.M.jq......T.Vk....>._j....]..I.p..PH4"...{.. ..n., ....GuU.X........\|......'...).rJ.C/.1...fwv.;.....w.@\|.......r/...,....N9...8.....Dww.S.b..\T.\|8W...II$M7MaS<.TwO..4......^=...9...V..f^XQ/86....>;.eh...9..I.]..~Lkj....<.5..Y[...">.3...~....[.E.)~[..\S..)...w......qH.~....V'v..~. E.gb......R...}.Je..U4.}g'...=R.V.k.....kG..Y#..=.#...).,.Z...e.LwHwn.....I.S.}.>N.......g

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, from Unix, original size modulo 2^32 95786
Category:	downloaded
Size (bytes):	33202
Entropy (8bit):	7.992535159036483
Encrypted:	true
SSDEEP:	768:EUK4XbDcMV+IBEVjFurBuUhzWaOtq48mXM0OyB0R2:EiPcMnBSjFulThSa8vXM01B08
MD5:	9AB2D34CDD077EC5A91586CEBC1FF297
SHA1:	CB18107F95DD1988F957C1AE5C268B15B3F1442C
SHA-256:	DEE709E32B71B22C78B10CF69C90CDCD56761124B6FEDDE53E518C2402D2A387
SHA-512:	481E52EF3635D73C23C22EB8A0D7A7DEFC0A5144AE058AEE4608F7C485E5C85F942D8115A6EB2FC32D2F5080AD7418B10048F4BD39A8370D09E2B2160B7C66D6
Malicious:	false
URL:	http://code.jquery.com/jquery-latest.min.js
Preview:	...........y{.F./...."....E:.=...'..I&.I2....IH.DR.....o...4..s..............Z..v..v.o.....C.....O..g.....?2._..VY./.+q...S..[......H...?{z.....E>?.I...<.{R..6.zz.\gw...=....n..........e..G.....a.P.XL.N.%.....U~...v......6..+...,>./V../.sz3%.`...w......C..{4.\|Z..........b'.#..o.R9..L...fH....Wi..Sz....bF.TG.......(._..o..L\..<.}...a.......A....yb)....c...tE..{N9....u\|....../..z..`.;..\..../w..b#/...U...>..f..mo,........w...GhY....z...G.-.B.....t..K...9?z.X..~...~..v.?.+l...i.X..n..,.W....n...8.\..r...~...I..M.jeX.W.8..T.ULh$.\|;.9k.........n..{.k... .>..^.H."..y.:..>.%.Vm.o.F.U.N...x.W.0.......'T.P...-s\.8....A.h;.}.C..b... ....g..3.....-S.He/..X.$.....3...n7.L.1/p:....._e'Gi..ph.-.H.E8.;BC!md....O....-..=.#y..g.M.....>......9.L....s9..o?.._..p4..K..E..J.9.v.k9.T6..z.h`....../L.f...........7S.;??.F..\|..............Y..r6.&.R9~f.)St....Z.a..+5.t.P..U.7:}...O..4\.q.[&.A.c%C...Si.h^.u.i.........7.........?.A..*..Q...E..x?.o.y..A..o.q...W/.Kz

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 23828, version 1.0
Category:	downloaded
Size (bytes):	23828
Entropy (8bit):	7.991362324605653
Encrypted:	true
SSDEEP:	384:zMCWojH1kvpoPNMEDu4Z6zIkqvmHndkeOsD5bHOmu3u2xfFywABC:TW4+o/1Z6zXnPFOV+2x9ywABC
MD5:	11C0CAEDAA76FF1DEF876A749B4EFD8F
SHA1:	CEE6A2624E2D198468ECB03CDC45B05402C47112
SHA-256:	E74B32ADDCE51642AD5E847E7220EC7CFD604C8D5F18AD4EC0ADC84AB0E339F9
SHA-512:	0167F23D120870995BC3780BA6559E258EA0EE0B523F663630EF5107FA13F390BB41AB65C19E7C255731D6165B166FC22CCD19F24FE36D23B4C104D472C245B0
Malicious:	false
URL:	http://fonts.gstatic.com/s/nanumgothic/v23/PN_3Rfi-oW3hYwmKDpxS7F_z-7rJxHVIsPV5MbNO2rV2_va-Nv6p.114.woff2
Preview:	wOF2......]........8..\..........................`..<..4..#.....x..q..R..6.$..^. .... ..j.i.%cc.u..`.}V.Z;......s$B.8.=.V........v......=..P.$pD....4p....Q.`S..B......<....Z.J....av%..s ...8.o.......UZ.......P7u#..@ht...q.[..h...`.&,......?..;..J.. [.-...< 5j'..8.5+d/.W.Ul2;.{BN...........V}W.."#m..h..(......t..Z..3--#..(a..I.E.^J3/...\|_/.y!.y./......}.$/.aX(t......D...U.2.z.V..~.......Ya'T.....I.........m.1.#...1..M.hQ.Y3..."...B.Q.(.}..~[..p....wc..\,P./6(p.....b..N:...Jx.......\|Q.+._...~.~.-}.Fk.5....6.=W.....).7!..E....28...~Qm4.=0@nK.;.q'.R.tp..Mwq..TD.R.RK._m..5..k..oM[.3-..M......C..{l...yN.g".l.T%b....4}....i6k.+ke.F....x..CIXu..:S.C....s.N..\|.R.....vS.T....w1..t.q....2..h.;<..r.;.R.. ..\I2.......=.X.. ..........aA~...5...A..A.X9.........ORE...@A..y7{m..5\.....I^..?...........k..m}.....J...o.k....o..M:...F.3....R.+?W{.6j..r..\..K..}:W!....l...'E..G..t....Vx.".....v&...]#.#...t-.....$....).Z....X.\.?]3....w.........}.Xw&..Q .;.V.{.E.M..

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 41x33, components 3
Category:	dropped
Size (bytes):	1937
Entropy (8bit):	7.0256952739892595
Encrypted:	false
SSDEEP:	24:2QK1he91Wwh82lYSKwDNnMzyV+zNT3ouyJ3VQ2GKeLTqgQ7JPRqq91Zk8EQwx/7z:mqQvnLyJCy+NIJ3HVGmXvXMD+MSwf
MD5:	019831C6832BD1E018FBBF35F1A7B029
SHA1:	D829AC71A8E35FB837980F2538A9CCE29DDC0AA3
SHA-256:	CA0EA0A5AE68A19374D4B356F61E08BD7458E02957C4EA6575A670C71E007710
SHA-512:	6E139779569F97CD7B7A7DC5B2AFBCE8762C907F6AED937A7D026C3A9645291E249855553EBE741014A94A6E50D5148ACFC6681CA6DCF4AFCBB6848120AE0F74
Malicious:	false
Preview:	......Exif..II*.................Ducky.......d.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C423A0177EA5E611B687E1DE4528220A" xmpMM:DocumentID="xmp.did:9DA59870A71411E6A487A2D94F77ECF5" xmpMM:InstanceID="xmp.iid:9DA5986FA71411E6A487A2D94F77ECF5" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:44C6124CDCA6E6119E7EECB597D82439" stRef:documentID="xmp.did:C423A0177EA5E611B687E1DE4528220A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 482x228, components 3
Category:	downloaded
Size (bytes):	4252
Entropy (8bit):	5.777826906032296
Encrypted:	false
SSDEEP:	96:XQOMuVnFYEzVzVzVzVzVzVze4vvvvvvxj:XJVFYr4vvvvvvN
MD5:	0F2679F1AE697148C69B06DB75F00882
SHA1:	F256C70F57DC429ACB935D7F95B0D1B26D654DDB
SHA-256:	A68A8723C8A907851286C2BE8C90BBC7C67EA79E163306098A37BE1F5EFE470C
SHA-512:	537BAE6502939AE48B199A61F8B39B10E1B82E5DD3CAB993A23AA97FCF2E67A9C09CB6B3F174D00A33360D43C3A71385621E6DEDC88DCFDD203141D6F4847087
Malicious:	false
URL:	https://esemuro.bizmeka.com/html16/images/mail/bg_cont.jpg
Preview:	......Exif..II*.................Ducky.......d.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C423A0177EA5E611B687E1DE4528220A" xmpMM:DocumentID="xmp.did:929D7D66A71411E690E6D9D65AABC5BC" xmpMM:InstanceID="xmp.iid:929D7D65A71411E690E6D9D65AABC5BC" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:44C6124CDCA6E6119E7EECB597D82439" stRef:documentID="xmp.did:C423A0177EA5E611B687E1DE4528220A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 480x77, components 3
Category:	downloaded
Size (bytes):	17231
Entropy (8bit):	7.951371363819503
Encrypted:	false
SSDEEP:	384:XJ7tccM5G6BbOSUKZ4KZMrJhH39sj2d282ETIf/8mcOIou:XvccM5G6BbyKZ2jX9sj2Y4g/UOC
MD5:	0A8F01DEF01B4EA7AECFB4C344D0F091
SHA1:	FAB41F30AB81D0D4D603FDF12718FFDCC6EFB4D5
SHA-256:	3A685B9D11139980143EB535EB18DE01955A6C24B96BA2789C72A5C83A6ECAB8
SHA-512:	19D58E7DADF9EDA578ADBF92AE851AC5AA5BC7F5EDCEB51745A0807426A751F7282449123737B00FE41868DA7465486D51334D2A054C10516E7B1624A0CB7C62
Malicious:	false
URL:	https://esemuro.bizmeka.com/html16/images/mail/bg_tit.jpg
Preview:	......Exif..II*.................Ducky.......d.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C423A0177EA5E611B687E1DE4528220A" xmpMM:DocumentID="xmp.did:2ACC5279A71511E68AC0A4DCD8BB0730" xmpMM:InstanceID="xmp.iid:2ACC5278A71511E68AC0A4DCD8BB0730" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:44C6124CDCA6E6119E7EECB597D82439" stRef:documentID="xmp.did:C423A0177EA5E611B687E1DE4528220A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................

Static File Info

General

File type:	HTML document, ISO-8859 text, with very long lines (20429)
Entropy (8bit):	6.209696562206671
TrID:	Scalable Vector Graphics (18501/1) 28.03% HyperText Markup Language with DOCTYPE (12503/2) 18.94% HyperText Markup Language (12001/1) 18.18% HyperText Markup Language (12001/1) 18.18% HyperText Markup Language (11001/1) 16.67%
File name:	2023121142000021ki01kvjs.html
File size:	338'193 bytes
MD5:	c173724b69b98820b9225eb00c004967
SHA1:	c6bfbdb60016db07f5799dd007bd4c0bda49a005
SHA256:	64f9656b3edfd752a50b500c2a08924fd58f84a288fb8d7721c7033e903a027b
SHA512:	9a45003babc4991c09f3054de4d87933a37c1163ff1b45527f37360453b096fc628fa4ea2264b97389dd732a769350b728d3ffbf49e13a4b61f32f61cf02be72
SSDEEP:	6144:H7xnO28KjVHqCHwYDeJG5RXdGVhSV1GIB/zW0tnZyfsAltm/Yy3mJtteaq6ueUV0:HFnO2JjwmdGOV16ymxMtq
TLSH:	89748DB9B782317957F720A4B03F2B1E793B9AA789088050F568A8E42CF4D45407BF7D
File Content Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">.<html>. ****** description *****... JavaScript Version v1.1.5... * .........: 2015.10.28... ******************************.-->.<head>.<meta

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2023 09:55:23.563736916 CET	49673	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:55:23.938692093 CET	49672	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:55:27.173120022 CET	49676	443	192.168.2.8	52.182.143.211
Dec 19, 2023 09:55:30.288816929 CET	443	49706	23.206.229.226	192.168.2.8
Dec 19, 2023 09:55:30.288919926 CET	49706	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:55:33.173049927 CET	49673	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:55:33.548055887 CET	49672	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:55:38.514219046 CET	49708	443	192.168.2.8	142.250.64.142
Dec 19, 2023 09:55:38.514256954 CET	443	49708	142.250.64.142	192.168.2.8
Dec 19, 2023 09:55:38.514307022 CET	49708	443	192.168.2.8	142.250.64.142
Dec 19, 2023 09:55:38.514672995 CET	49708	443	192.168.2.8	142.250.64.142
Dec 19, 2023 09:55:38.514687061 CET	443	49708	142.250.64.142	192.168.2.8
Dec 19, 2023 09:55:38.515124083 CET	49709	443	192.168.2.8	142.250.64.173
Dec 19, 2023 09:55:38.515153885 CET	443	49709	142.250.64.173	192.168.2.8
Dec 19, 2023 09:55:38.515218973 CET	49709	443	192.168.2.8	142.250.64.173
Dec 19, 2023 09:55:38.515721083 CET	49709	443	192.168.2.8	142.250.64.173
Dec 19, 2023 09:55:38.515734911 CET	443	49709	142.250.64.173	192.168.2.8
Dec 19, 2023 09:55:38.516772032 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.653520107 CET	49713	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.653887033 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.653976917 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.654320002 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.790817976 CET	80	49713	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.790936947 CET	49713	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.791371107 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.791964054 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.792148113 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.792198896 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.792233944 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.792306900 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.792359114 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.792371988 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.792452097 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.792495012 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.792562008 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.792659044 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.792706013 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.792743921 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.792767048 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.792809010 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.792818069 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.796798944 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.796854973 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.796879053 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.801140070 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.801199913 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.801218033 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.805897951 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.805929899 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.805980921 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.810283899 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.810400963 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.810417891 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.814917088 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.814981937 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.815053940 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.819411039 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.819475889 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.819495916 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.824033022 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.824080944 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.824107885 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.828644991 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.828708887 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:38.828840971 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:38.852593899 CET	443	49708	142.250.64.142	192.168.2.8
Dec 19, 2023 09:55:38.852901936 CET	49708	443	192.168.2.8	142.250.64.142
Dec 19, 2023 09:55:38.852966070 CET	443	49708	142.250.64.142	192.168.2.8
Dec 19, 2023 09:55:38.853602886 CET	443	49708	142.250.64.142	192.168.2.8
Dec 19, 2023 09:55:38.853677034 CET	49708	443	192.168.2.8	142.250.64.142
Dec 19, 2023 09:55:38.854424953 CET	443	49709	142.250.64.173	192.168.2.8
Dec 19, 2023 09:55:38.854703903 CET	443	49708	142.250.64.142	192.168.2.8
Dec 19, 2023 09:55:38.854773998 CET	49708	443	192.168.2.8	142.250.64.142
Dec 19, 2023 09:55:38.855187893 CET	49709	443	192.168.2.8	142.250.64.173
Dec 19, 2023 09:55:38.855209112 CET	443	49709	142.250.64.173	192.168.2.8
Dec 19, 2023 09:55:38.856650114 CET	49708	443	192.168.2.8	142.250.64.142
Dec 19, 2023 09:55:38.856735945 CET	443	49708	142.250.64.142	192.168.2.8
Dec 19, 2023 09:55:38.857001066 CET	49708	443	192.168.2.8	142.250.64.142
Dec 19, 2023 09:55:38.857017994 CET	443	49708	142.250.64.142	192.168.2.8
Dec 19, 2023 09:55:38.857080936 CET	443	49709	142.250.64.173	192.168.2.8
Dec 19, 2023 09:55:38.857136011 CET	49709	443	192.168.2.8	142.250.64.173
Dec 19, 2023 09:55:38.857923985 CET	49709	443	192.168.2.8	142.250.64.173
Dec 19, 2023 09:55:38.858016014 CET	443	49709	142.250.64.173	192.168.2.8
Dec 19, 2023 09:55:38.858119011 CET	49709	443	192.168.2.8	142.250.64.173
Dec 19, 2023 09:55:38.858125925 CET	443	49709	142.250.64.173	192.168.2.8
Dec 19, 2023 09:55:38.922600031 CET	49716	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:38.922638893 CET	443	49716	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:38.922722101 CET	49716	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:38.923088074 CET	49717	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:38.923114061 CET	443	49717	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:38.923206091 CET	49717	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:38.923648119 CET	49716	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:38.923660994 CET	443	49716	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:38.923934937 CET	49717	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:38.923947096 CET	443	49717	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:39.008841038 CET	49708	443	192.168.2.8	142.250.64.142
Dec 19, 2023 09:55:39.008903027 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:39.024635077 CET	49709	443	192.168.2.8	142.250.64.173
Dec 19, 2023 09:55:39.178623915 CET	443	49708	142.250.64.142	192.168.2.8
Dec 19, 2023 09:55:39.178797960 CET	443	49708	142.250.64.142	192.168.2.8
Dec 19, 2023 09:55:39.178891897 CET	49708	443	192.168.2.8	142.250.64.142
Dec 19, 2023 09:55:39.179193974 CET	49708	443	192.168.2.8	142.250.64.142
Dec 19, 2023 09:55:39.179235935 CET	443	49708	142.250.64.142	192.168.2.8
Dec 19, 2023 09:55:39.197274923 CET	443	49709	142.250.64.173	192.168.2.8
Dec 19, 2023 09:55:39.197674990 CET	443	49709	142.250.64.173	192.168.2.8
Dec 19, 2023 09:55:39.197765112 CET	49709	443	192.168.2.8	142.250.64.173
Dec 19, 2023 09:55:39.199420929 CET	49709	443	192.168.2.8	142.250.64.173
Dec 19, 2023 09:55:39.199438095 CET	443	49709	142.250.64.173	192.168.2.8
Dec 19, 2023 09:55:39.619223118 CET	443	49716	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:39.619620085 CET	49716	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:39.619642973 CET	443	49716	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:39.621912003 CET	443	49717	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:39.621925116 CET	443	49716	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:39.621998072 CET	49716	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:39.622175932 CET	49717	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:39.622190952 CET	443	49717	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:39.623121977 CET	49716	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:39.623205900 CET	443	49716	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:39.623313904 CET	443	49717	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:39.623313904 CET	49716	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:39.623326063 CET	443	49716	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:39.623426914 CET	49717	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:39.624309063 CET	49717	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:39.624373913 CET	443	49717	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:39.624448061 CET	49717	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:39.624454975 CET	443	49717	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:39.805932999 CET	49716	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:39.821199894 CET	49717	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:39.838006020 CET	80	49713	151.101.66.137	192.168.2.8
Dec 19, 2023 09:55:39.838083982 CET	49713	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:55:40.272438049 CET	443	49716	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.272501945 CET	443	49716	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.272562981 CET	49716	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.272574902 CET	443	49716	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.272584915 CET	443	49716	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.272624969 CET	49716	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.273365974 CET	49716	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.273376942 CET	443	49716	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.281028986 CET	443	49717	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.281091928 CET	443	49717	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.281140089 CET	49717	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.281152010 CET	443	49717	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.281162977 CET	443	49717	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.281197071 CET	49717	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.281946898 CET	49717	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.281955004 CET	443	49717	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.288865089 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.288964033 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.289042950 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.289556980 CET	49720	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.289589882 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.289649963 CET	49720	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.290930986 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.290967941 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.291362047 CET	49720	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.291373014 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.659415960 CET	49727	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.659465075 CET	443	49727	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.659554958 CET	49727	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.659796000 CET	49728	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.659825087 CET	443	49728	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.659871101 CET	49728	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.660104990 CET	49727	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.660132885 CET	443	49727	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.660307884 CET	49728	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.660320997 CET	443	49728	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.951566935 CET	49730	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:55:40.951597929 CET	443	49730	172.217.3.68	192.168.2.8
Dec 19, 2023 09:55:40.951683044 CET	49730	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:55:40.952049971 CET	49730	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:55:40.952064991 CET	443	49730	172.217.3.68	192.168.2.8
Dec 19, 2023 09:55:40.993845940 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.993907928 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.996073961 CET	49720	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.996094942 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.996217012 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.996232033 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.996551991 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.996665001 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.998368979 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.998442888 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.998636007 CET	49720	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.998717070 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:40.998766899 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:40.998811007 CET	49720	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.040743113 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.040743113 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.332922935 CET	443	49728	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.333230019 CET	49728	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.333249092 CET	443	49728	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.334434986 CET	443	49728	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.334516048 CET	49728	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.334795952 CET	49728	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.334862947 CET	443	49728	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.335007906 CET	49728	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.335014105 CET	443	49728	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.345268011 CET	443	49727	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.345530033 CET	49727	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.345597029 CET	443	49727	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.347012043 CET	443	49730	172.217.3.68	192.168.2.8
Dec 19, 2023 09:55:41.347326994 CET	49730	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:55:41.347345114 CET	443	49730	172.217.3.68	192.168.2.8
Dec 19, 2023 09:55:41.347676992 CET	443	49727	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.347748041 CET	49727	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.348156929 CET	49727	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.348246098 CET	443	49727	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.348417044 CET	49727	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.348433018 CET	443	49727	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.348452091 CET	443	49730	172.217.3.68	192.168.2.8
Dec 19, 2023 09:55:41.348514080 CET	49730	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:55:41.349728107 CET	49730	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:55:41.349787951 CET	443	49730	172.217.3.68	192.168.2.8
Dec 19, 2023 09:55:41.383960962 CET	49728	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.399585009 CET	49730	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:55:41.399593115 CET	49727	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.399595976 CET	443	49730	172.217.3.68	192.168.2.8
Dec 19, 2023 09:55:41.446464062 CET	49730	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:55:41.633416891 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.633749962 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.633826971 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.633857965 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.634002924 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.634088993 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.634177923 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.634231091 CET	49720	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.634258032 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.634295940 CET	49720	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.634303093 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.634330988 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.634366035 CET	49720	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.640904903 CET	49720	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.640942097 CET	443	49720	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.641447067 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.641518116 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.645288944 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.645368099 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.645513058 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.645570040 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.647088051 CET	49731	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.647123098 CET	443	49731	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.647224903 CET	49731	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.647685051 CET	49731	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.647697926 CET	443	49731	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.649055958 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.649100065 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.649106979 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.649127960 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.649164915 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.649501085 CET	49719	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.649513960 CET	443	49719	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.659065962 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.659084082 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.659154892 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.659749985 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.659761906 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.998857975 CET	443	49728	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.998909950 CET	443	49728	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.998997927 CET	49728	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:41.999016047 CET	443	49728	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.999114990 CET	443	49728	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:41.999157906 CET	49728	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.002521038 CET	443	49727	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.002827883 CET	443	49727	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.002877951 CET	49727	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.002887964 CET	443	49727	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.002928019 CET	49727	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.025518894 CET	49727	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.025566101 CET	443	49727	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.025990009 CET	49728	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.026010990 CET	443	49728	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.312189102 CET	443	49731	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.312659979 CET	49731	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.312674046 CET	443	49731	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.313029051 CET	443	49731	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.313621044 CET	49731	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.313697100 CET	443	49731	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.313843012 CET	49731	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.329288006 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.329610109 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.329619884 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.329976082 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.330593109 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.330661058 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.330720901 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.356734991 CET	443	49731	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.376738071 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.972119093 CET	443	49731	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.972208977 CET	443	49731	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.972307920 CET	443	49731	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.972421885 CET	49731	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.972421885 CET	49731	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.980740070 CET	49731	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.980756044 CET	443	49731	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.992959976 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.993016005 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.993079901 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.993098974 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.993145943 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:42.997078896 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:42.997162104 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:43.000875950 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:43.000931978 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:43.001157999 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:43.001204014 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:43.001265049 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:43.001312971 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:43.001319885 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:43.001363039 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:43.001403093 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:43.001851082 CET	49732	443	192.168.2.8	222.111.214.42
Dec 19, 2023 09:55:43.001859903 CET	443	49732	222.111.214.42	192.168.2.8
Dec 19, 2023 09:55:43.166306973 CET	49734	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:43.166343927 CET	443	49734	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:43.166423082 CET	49734	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:43.170007944 CET	49734	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:43.170032978 CET	443	49734	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:43.432092905 CET	443	49734	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:43.432188988 CET	49734	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:43.437346935 CET	49734	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:43.437357903 CET	443	49734	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:43.437640905 CET	443	49734	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:43.493030071 CET	49734	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:43.590792894 CET	49734	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:43.636739016 CET	443	49734	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:43.716748953 CET	443	49734	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:43.716815948 CET	443	49734	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:43.716872931 CET	49734	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:43.717057943 CET	49734	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:43.717066050 CET	443	49734	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:43.770035982 CET	49735	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:43.770066023 CET	443	49735	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:43.770173073 CET	49735	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:43.770654917 CET	49735	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:43.770668030 CET	443	49735	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:44.027050018 CET	443	49735	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:44.027143002 CET	49735	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:44.028451920 CET	49735	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:44.028459072 CET	443	49735	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:44.028709888 CET	443	49735	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:44.030147076 CET	49735	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:44.060678959 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:44.060729027 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:44.060810089 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:44.063164949 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:44.063180923 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:44.076739073 CET	443	49735	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:44.267182112 CET	49706	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:55:44.275799990 CET	443	49735	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:44.275917053 CET	443	49735	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:44.275971889 CET	49735	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:44.278476000 CET	49735	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:44.278491974 CET	443	49735	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:44.278536081 CET	49735	443	192.168.2.8	23.193.120.112
Dec 19, 2023 09:55:44.278542042 CET	443	49735	23.193.120.112	192.168.2.8
Dec 19, 2023 09:55:44.455152988 CET	443	49706	23.206.229.226	192.168.2.8
Dec 19, 2023 09:55:44.456151009 CET	443	49706	23.206.229.226	192.168.2.8
Dec 19, 2023 09:55:44.456201077 CET	443	49706	23.206.229.226	192.168.2.8
Dec 19, 2023 09:55:44.456229925 CET	49706	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:55:44.456259012 CET	443	49706	23.206.229.226	192.168.2.8
Dec 19, 2023 09:55:44.456273079 CET	443	49706	23.206.229.226	192.168.2.8
Dec 19, 2023 09:55:44.456387043 CET	49706	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:55:44.456387043 CET	49706	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:55:44.456387043 CET	49706	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:55:44.720352888 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:44.720495939 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:44.724668980 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:44.724679947 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:44.724946976 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:44.774281025 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:45.221312046 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:45.264743090 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:45.650224924 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:45.650255919 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:45.650263071 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:45.650273085 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:45.650326014 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:45.650352955 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:45.650430918 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:45.650469065 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:45.650471926 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:45.650499105 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:45.650512934 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:45.650541067 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:45.650552988 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:45.650566101 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:45.650593042 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:45.995281935 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:45.995325089 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:45.995357990 CET	49736	443	192.168.2.8	20.114.59.183
Dec 19, 2023 09:55:45.995368004 CET	443	49736	20.114.59.183	192.168.2.8
Dec 19, 2023 09:55:50.585314035 CET	443	49706	23.206.229.226	192.168.2.8
Dec 19, 2023 09:55:50.585453987 CET	49706	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:55:51.334260941 CET	443	49730	172.217.3.68	192.168.2.8
Dec 19, 2023 09:55:51.334317923 CET	443	49730	172.217.3.68	192.168.2.8
Dec 19, 2023 09:55:51.334379911 CET	49730	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:55:51.714605093 CET	49730	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:55:51.714632034 CET	443	49730	172.217.3.68	192.168.2.8
Dec 19, 2023 09:56:14.857988119 CET	49706	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:56:14.858092070 CET	49706	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:56:14.858469009 CET	49750	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:56:14.858516932 CET	443	49750	23.206.229.226	192.168.2.8
Dec 19, 2023 09:56:14.858592033 CET	49750	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:56:14.858953953 CET	49750	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:56:14.858963966 CET	443	49750	23.206.229.226	192.168.2.8
Dec 19, 2023 09:56:15.047291040 CET	443	49706	23.206.229.226	192.168.2.8
Dec 19, 2023 09:56:15.047314882 CET	443	49706	23.206.229.226	192.168.2.8
Dec 19, 2023 09:56:15.243602991 CET	443	49750	23.206.229.226	192.168.2.8
Dec 19, 2023 09:56:15.243711948 CET	49750	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:56:22.917478085 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:22.917531013 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:22.917601109 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:22.920011997 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:22.920030117 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.404206038 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.404300928 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:23.408199072 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:23.408206940 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.408443928 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.420695066 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:23.460750103 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.806183100 CET	49713	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:56:23.837419987 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:56:23.876739979 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.876771927 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.876787901 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.876894951 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:23.876915932 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.876938105 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:23.876966000 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:23.877018929 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.877055883 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.877077103 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:23.877083063 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.877119064 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:23.877120972 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.877162933 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:23.885281086 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:23.885303020 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.885320902 CET	49751	443	192.168.2.8	13.85.23.86
Dec 19, 2023 09:56:23.885328054 CET	443	49751	13.85.23.86	192.168.2.8
Dec 19, 2023 09:56:23.942984104 CET	80	49713	151.101.66.137	192.168.2.8
Dec 19, 2023 09:56:23.974675894 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:56:34.428556919 CET	443	49750	23.206.229.226	192.168.2.8
Dec 19, 2023 09:56:34.428666115 CET	49750	443	192.168.2.8	23.206.229.226
Dec 19, 2023 09:56:40.636007071 CET	49713	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:56:40.772753954 CET	80	49713	151.101.66.137	192.168.2.8
Dec 19, 2023 09:56:40.772887945 CET	80	49713	151.101.66.137	192.168.2.8
Dec 19, 2023 09:56:40.772958994 CET	49713	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:56:40.885435104 CET	49753	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:56:40.885519981 CET	443	49753	172.217.3.68	192.168.2.8
Dec 19, 2023 09:56:40.885598898 CET	49753	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:56:40.885992050 CET	49753	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:56:40.886025906 CET	443	49753	172.217.3.68	192.168.2.8
Dec 19, 2023 09:56:41.272758961 CET	443	49753	172.217.3.68	192.168.2.8
Dec 19, 2023 09:56:41.273242950 CET	49753	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:56:41.273303986 CET	443	49753	172.217.3.68	192.168.2.8
Dec 19, 2023 09:56:41.273689032 CET	443	49753	172.217.3.68	192.168.2.8
Dec 19, 2023 09:56:41.274017096 CET	49753	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:56:41.274097919 CET	443	49753	172.217.3.68	192.168.2.8
Dec 19, 2023 09:56:41.321640015 CET	49753	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:56:51.275264025 CET	443	49753	172.217.3.68	192.168.2.8
Dec 19, 2023 09:56:51.275338888 CET	443	49753	172.217.3.68	192.168.2.8
Dec 19, 2023 09:56:51.275397062 CET	49753	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:56:52.700297117 CET	49753	443	192.168.2.8	172.217.3.68
Dec 19, 2023 09:56:52.700349092 CET	443	49753	172.217.3.68	192.168.2.8
Dec 19, 2023 09:57:05.981740952 CET	49754	443	192.168.2.8	142.250.217.206
Dec 19, 2023 09:57:05.981791019 CET	443	49754	142.250.217.206	192.168.2.8
Dec 19, 2023 09:57:05.981862068 CET	49754	443	192.168.2.8	142.250.217.206
Dec 19, 2023 09:57:05.982337952 CET	49754	443	192.168.2.8	142.250.217.206
Dec 19, 2023 09:57:05.982352018 CET	443	49754	142.250.217.206	192.168.2.8
Dec 19, 2023 09:57:06.310739040 CET	443	49754	142.250.217.206	192.168.2.8
Dec 19, 2023 09:57:06.311218977 CET	49754	443	192.168.2.8	142.250.217.206
Dec 19, 2023 09:57:06.311244965 CET	443	49754	142.250.217.206	192.168.2.8
Dec 19, 2023 09:57:06.311608076 CET	443	49754	142.250.217.206	192.168.2.8
Dec 19, 2023 09:57:06.311671019 CET	49754	443	192.168.2.8	142.250.217.206
Dec 19, 2023 09:57:06.312318087 CET	443	49754	142.250.217.206	192.168.2.8
Dec 19, 2023 09:57:06.312386036 CET	49754	443	192.168.2.8	142.250.217.206
Dec 19, 2023 09:57:06.313611031 CET	49754	443	192.168.2.8	142.250.217.206
Dec 19, 2023 09:57:06.313673019 CET	443	49754	142.250.217.206	192.168.2.8
Dec 19, 2023 09:57:06.313872099 CET	49754	443	192.168.2.8	142.250.217.206
Dec 19, 2023 09:57:06.313879967 CET	443	49754	142.250.217.206	192.168.2.8
Dec 19, 2023 09:57:06.368254900 CET	49754	443	192.168.2.8	142.250.217.206
Dec 19, 2023 09:57:06.713540077 CET	443	49754	142.250.217.206	192.168.2.8
Dec 19, 2023 09:57:06.714360952 CET	443	49754	142.250.217.206	192.168.2.8
Dec 19, 2023 09:57:06.714466095 CET	49754	443	192.168.2.8	142.250.217.206
Dec 19, 2023 09:57:06.714565039 CET	49754	443	192.168.2.8	142.250.217.206
Dec 19, 2023 09:57:06.714585066 CET	443	49754	142.250.217.206	192.168.2.8
Dec 19, 2023 09:57:08.977469921 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:57:09.114624023 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:57:54.118818998 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:57:54.256692886 CET	80	49711	151.101.66.137	192.168.2.8
Dec 19, 2023 09:58:39.259571075 CET	49711	80	192.168.2.8	151.101.66.137
Dec 19, 2023 09:58:39.396881104 CET	80	49711	151.101.66.137	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2023 09:55:38.387994051 CET	50544	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:55:38.388176918 CET	53986	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:55:38.388659000 CET	56939	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:55:38.389038086 CET	50952	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:55:38.391230106 CET	63964	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:55:38.391503096 CET	51808	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:55:38.392010927 CET	61284	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:55:38.392292976 CET	65438	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:55:38.508260012 CET	53	52887	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:38.513328075 CET	53	56939	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:38.513461113 CET	53	50544	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:38.513818026 CET	53	53986	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:38.514704943 CET	53	50952	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:38.514880896 CET	53	60693	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:38.516143084 CET	53	51808	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:38.516242027 CET	53	63964	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:38.719773054 CET	53	65438	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:38.921974897 CET	53	61284	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:39.033369064 CET	53	58646	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:39.358875036 CET	53	57700	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:40.278275013 CET	64884	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:55:40.278592110 CET	49879	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:55:40.608499050 CET	53	64884	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:40.825063944 CET	56922	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:55:40.825391054 CET	65353	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:55:40.848870993 CET	53	49879	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:40.949770927 CET	53	56922	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:40.950727940 CET	53	65353	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:50.919114113 CET	53	58845	1.1.1.1	192.168.2.8
Dec 19, 2023 09:55:56.661389112 CET	53	51792	1.1.1.1	192.168.2.8
Dec 19, 2023 09:56:07.993103981 CET	138	138	192.168.2.8	192.168.2.255
Dec 19, 2023 09:56:15.448426962 CET	53	54010	1.1.1.1	192.168.2.8
Dec 19, 2023 09:56:37.929300070 CET	53	52386	1.1.1.1	192.168.2.8
Dec 19, 2023 09:56:37.969888926 CET	53	52608	1.1.1.1	192.168.2.8
Dec 19, 2023 09:57:05.604068995 CET	53	54210	1.1.1.1	192.168.2.8
Dec 19, 2023 09:57:05.855061054 CET	63680	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:57:05.855211020 CET	62307	53	192.168.2.8	1.1.1.1
Dec 19, 2023 09:57:05.980643034 CET	53	63680	1.1.1.1	192.168.2.8
Dec 19, 2023 09:57:05.981134892 CET	53	62307	1.1.1.1	192.168.2.8
Dec 19, 2023 09:57:50.933424950 CET	53	54495	1.1.1.1	192.168.2.8

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 19, 2023 09:55:40.848932028 CET	192.168.2.8	1.1.1.1	c223	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2023 09:55:38.387994051 CET	192.168.2.8	1.1.1.1	0xfa6c	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:38.388176918 CET	192.168.2.8	1.1.1.1	0x36af	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Dec 19, 2023 09:55:38.388659000 CET	192.168.2.8	1.1.1.1	0xae90	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:38.389038086 CET	192.168.2.8	1.1.1.1	0x9a	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Dec 19, 2023 09:55:38.391230106 CET	192.168.2.8	1.1.1.1	0x917c	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:38.391503096 CET	192.168.2.8	1.1.1.1	0x175a	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Dec 19, 2023 09:55:38.392010927 CET	192.168.2.8	1.1.1.1	0x4b8c	Standard query (0)	esemuro.bizmeka.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:38.392292976 CET	192.168.2.8	1.1.1.1	0xba82	Standard query (0)	esemuro.bizmeka.com	65	IN (0x0001)	false
Dec 19, 2023 09:55:40.278275013 CET	192.168.2.8	1.1.1.1	0xd8e5	Standard query (0)	esemuro.bizmeka.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:40.278592110 CET	192.168.2.8	1.1.1.1	0xade8	Standard query (0)	esemuro.bizmeka.com	65	IN (0x0001)	false
Dec 19, 2023 09:55:40.825063944 CET	192.168.2.8	1.1.1.1	0xaf53	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:40.825391054 CET	192.168.2.8	1.1.1.1	0xbb4f	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 19, 2023 09:57:05.855061054 CET	192.168.2.8	1.1.1.1	0xbd19	Standard query (0)	clients1.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:57:05.855211020 CET	192.168.2.8	1.1.1.1	0xe0f1	Standard query (0)	clients1.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2023 09:55:38.513328075 CET	1.1.1.1	192.168.2.8	0xae90	No error (0)	accounts.google.com		142.250.64.173	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:38.513461113 CET	1.1.1.1	192.168.2.8	0xfa6c	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 09:55:38.513461113 CET	1.1.1.1	192.168.2.8	0xfa6c	No error (0)	clients.l.google.com		142.250.64.142	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:38.513818026 CET	1.1.1.1	192.168.2.8	0x36af	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 09:55:38.516242027 CET	1.1.1.1	192.168.2.8	0x917c	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:38.516242027 CET	1.1.1.1	192.168.2.8	0x917c	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:38.516242027 CET	1.1.1.1	192.168.2.8	0x917c	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:38.516242027 CET	1.1.1.1	192.168.2.8	0x917c	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:38.921974897 CET	1.1.1.1	192.168.2.8	0x4b8c	No error (0)	esemuro.bizmeka.com		222.111.214.42	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:40.608499050 CET	1.1.1.1	192.168.2.8	0xd8e5	No error (0)	esemuro.bizmeka.com		222.111.214.42	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:40.949770927 CET	1.1.1.1	192.168.2.8	0xaf53	No error (0)	www.google.com		172.217.3.68	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:55:40.950727940 CET	1.1.1.1	192.168.2.8	0xbb4f	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 19, 2023 09:57:05.980643034 CET	1.1.1.1	192.168.2.8	0xbd19	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2023 09:57:05.980643034 CET	1.1.1.1	192.168.2.8	0xbd19	No error (0)	clients.l.google.com		142.250.217.206	A (IP address)	IN (0x0001)	false
Dec 19, 2023 09:57:05.981134892 CET	1.1.1.1	192.168.2.8	0xe0f1	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

clients2.google.com

accounts.google.com

esemuro.bizmeka.com

fs.microsoft.com

slscr.update.microsoft.com

clients1.google.com

code.jquery.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49711	151.101.66.137	80	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 09:55:38.654320002 CET	288	OUT	GET /jquery-latest.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 19, 2023 09:55:38.791964054 CET	602	IN	HTTP/1.1 200 OK Connection: keep-alive Content-Length: 33202 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: W/"28feccc0-1762a" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Content-Encoding: gzip Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Tue, 19 Dec 2023 08:55:38 GMT Age: 8175516 X-Served-By: cache-lga21983-LGA, cache-pdk-kpdk1780126-PDK X-Cache: HIT, HIT X-Cache-Hits: 74, 66179 X-Timer: S1702976139.711130,VS0,VE0 Vary: Accept-Encoding
Dec 19, 2023 09:55:38.792148113 CET	1286	IN	Data Raw: 1f 8b 08 00 00 00 00 00 02 03 dc bd 79 7b db 46 b2 2f fc ff f9 14 22 c6 87 01 cc 16 45 3a cb 3d 03 ba 85 27 b1 93 49 26 eb 8c 9d 49 32 14 93 07 1b 49 48 dc 44 52 96 15 91 f3 d9 6f fd aa 17 34 16 da 99 73 ee fb bc f7 b9 99 b1 08 a0 f7 ee ea ea aa Data Ascii: y{F/"E:='I&I2IHDRo4sZ.vvoCOg?2_VY/+qS[H.?{zE>?I<{R6zz\gw=n.eGaPXLN%U~v6+
Dec 19, 2023 09:55:38.792233944 CET	1286	IN	Data Raw: b4 d7 f2 f4 55 ba 2d 36 7b 07 56 29 23 a5 50 59 67 00 81 8f 51 a4 f1 32 5f 80 a2 68 1b 4a 6c b7 e3 5a 78 44 ac 78 e5 fe dc 88 5b de 6a 59 fe 1d d5 d0 7e cc 2a b8 40 3a 81 ac 7d 26 32 e6 9b f5 bd 21 63 30 b1 d5 2f 2d 07 37 8e 58 c0 21 21 76 39 00 Data Ascii: U-6{V)#PYgQ2_hJlZxDx[jY~*@:}&2!c0/-7X!!v92{&)K8^\Wk<yD+JAc er`.{w)XwA+Wj,&Q\|M="C1/h5H@WV6jbn0TLx;bv,
Dec 19, 2023 09:55:38.792306900 CET	1286	IN	Data Raw: 1a 09 64 1c b5 71 03 fe bf a1 71 3e d1 59 56 79 9e ed 5e 28 49 5a d8 b2 ce 6a 99 c3 b2 57 f9 ed 61 46 63 52 23 2a 07 58 1d 03 bd d0 ee cc 82 88 bb ee 74 cc 8f e4 f8 57 ea fb 13 dd c5 a3 f8 45 5e a0 57 c5 6a 73 b7 d7 88 e7 80 ce c4 84 2a 0e c9 dd Data Ascii: dqq>YVy^(IZjWaFcR#XtWE^Wjs~^O.O7r_'*oO%D^iX"'W3&F-jx,ot=?=@H!z"u<z\"[//
Dec 19, 2023 09:55:38.792371988 CET	1286	IN	Data Raw: 42 0c cb 68 80 31 f2 4e 16 0e 2c b9 82 fe d4 9c 94 92 28 70 a2 7e 6a c7 97 4d 26 7c 8e 1a db c0 e1 64 dd 74 9c e4 ab 4c e1 b5 5c 23 d0 17 eb a5 42 a0 74 2c ea e6 9a 44 02 d8 47 0d cf cd 56 ed d9 2e 9f a8 d3 2e 3f 45 25 74 bb a7 7a 56 ac 68 de 01 Data Ascii: Bh1N,(p~jM&\|dtL\#Bt,DGV..?E%tzVh_{N)??\|~Ag\6w CFb+SG;-kk,3*&<Hj,!Wj8(bo"DCD$ekV8? oGY5d1B
Dec 19, 2023 09:55:38.792452097 CET	1286	IN	Data Raw: 4b c4 47 f9 34 08 1c f9 62 ac 75 b3 59 9c 24 08 d7 19 0c c2 82 4b e8 36 e5 90 d1 d0 4c be 86 7e 7e 8b 62 86 f4 3c 8b f4 0c 14 33 42 e2 1d 09 96 82 10 dc 9f d5 cf 90 5f 39 a1 a9 7f d6 c7 ed 20 df 58 ae f6 16 1d ba 1f 59 97 2c 96 2e df 3e 8a 47 f8 Data Ascii: KG4buY$K6L~~b<3B_9 XY,.>G"d]smj#n,WUq%'$U7#?Eu8O#gQ:t0w/f3\|.1+W]O@;kI=y)w;=JD<}yxp"_xK`
Dec 19, 2023 09:55:38.792562008 CET	1286	IN	Data Raw: 96 cf d8 7f f3 ca 3d 9a 3a 51 87 ca 78 ac c8 88 29 5a af 5b ad d4 21 11 5b 13 a9 09 3d f5 53 e9 ab 7e 9c 82 a1 d2 b2 5e a8 86 71 93 5f b0 72 fb a1 7c f6 41 c1 75 3a d8 ff 2c dc 8d fb f3 6d 4e dc e1 bf e8 43 9c b0 e2 0b 5b 42 b3 d4 bf 9d fc 34 77 Data Ascii: =:Qx)Z[![=S~^q_r\|Au:,mNC[B4wlE~}fbJ+_HO\f$sAtof+ez9lT{r656V6Y{u6qoOYJL7SrWuMj5+~`5aEo
Dec 19, 2023 09:55:38.792659044 CET	1286	IN	Data Raw: 40 9f b0 b4 10 7c ed 53 9c 3f 53 55 46 b4 09 43 cf 3b 3a be 8f 8c 6d 0c ad f5 65 d1 ed de 97 55 16 40 31 82 3a a9 be 5a e1 b2 fd ca 07 6a 70 5c 1a aa d5 9c cd dc c3 12 aa de 56 6d 3f ac b4 c4 b1 23 b9 c4 ad 6c 1d b9 88 1b 55 06 a2 66 08 9a 07 84 Data Ascii: @\|S?SUFC;:meU@1:Zjp\Vm?#lUf)G{Pm; 5JPIj+Pwf7b]n.40Fn\|;fEfk%ne!+0RC@0h^)8%ds18h2#j[jkMw
Dec 19, 2023 09:55:38.792706013 CET	1286	IN	Data Raw: c7 db 4f f7 44 70 12 95 79 59 f9 64 18 36 e2 35 f9 d6 54 51 a3 f2 c3 68 ac f8 5d be 55 9f 84 bf 1b df 23 02 f2 aa 4e 4a b4 66 b7 6b a8 c5 4e 82 5b 61 e5 3e 3c 82 64 e8 6d a0 41 27 08 1b 3e 9b 13 9b c6 22 1f e3 c4 84 48 cd 33 82 cd 7d bc 4a d9 d5 Data Ascii: ODpyYd65TQh]U#NJfkN[a><dmA'>"H3}J\|&M/g29mZi5EtP(?cPAOuQf[*^9F)mKeLdS[;I59].Cnl/3WJUjcAX{jm^";_oc+
Dec 19, 2023 09:55:38.792767048 CET	1286	IN	Data Raw: 9f 8a 7d 25 ca 44 e9 ac 8f c6 0b 15 8c 82 55 a5 52 de dd 6c 1c a0 15 8f 23 a3 80 4c b0 42 0c 6c 54 58 d0 e1 75 d7 cd a3 89 96 3e df f4 4d db f5 60 4f 4e b9 b6 5e 77 b2 a3 c5 40 37 6e 50 9d 97 70 b6 bd 6d 55 0c 1e 8f bd 6d be 5b 2f de 40 a8 9d ad Data Ascii: }%DURl#LBlTXu>M`ON^w@7nPpmUm[/@W #xK3 y3o"P]o~Okr>x8D34bL_.\|fqmS[4x`[~cVs5&mt<}8U2p:}[[TyYA}`zx
Dec 19, 2023 09:55:38.792818069 CET	1286	IN	Data Raw: d7 74 1b ec 23 a3 21 9e 7b bd d2 75 d8 77 c2 3b 87 72 6f cd 04 90 ef 7a 6b dd ce 82 e6 fd 75 aa 11 89 f4 f6 db 3b c6 c8 29 c7 cb 9a 42 0e a3 5f 87 a1 87 45 50 6f ec 00 a6 97 f6 3c f5 da 4b c3 6f 8d c3 97 48 5f c6 fe f5 d5 f7 df b1 e0 c3 71 1b b6 Data Ascii: t#!{uw;rozku;)B_EPo<KoH_qzJp)aFq;)U"ba[Jxu>I0BdAcfKaLd#nw>2[Yxf4k{J7Dz6a/sfNxCl:IkP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49713	151.101.66.137	80	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 09:56:23.806183100 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Dec 19, 2023 09:55:44.456259012 CET	23.206.229.226	443	192.168.2.8	49706	CN=r.bing.com, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US	CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Oct 18 22:32:40 CEST 2023 Wed Aug 12 02:00:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024 Fri Jun 28 01:59:59 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
Dec 19, 2023 09:55:44.456259012 CET	23.206.229.226	443	192.168.2.8	49706	CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Aug 12 02:00:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024		28a2c9bd18a11de089ef85a160da29e4

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	142.250.64.142	443	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:38 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 08:55:39 UTC	731	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-WH8FzLShTlKjMgP4psYOiQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Dec 2023 08:55:39 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6196 X-Daystart: 3339 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 08:55:39 UTC	521	IN	Data Raw: 32 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 39 36 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 33 33 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 20 Data Ascii: 2c8<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6196" elapsed_seconds="3339"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-12-19 08:55:39 UTC	198	IN	Data Raw: 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 3f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-12-19 08:55:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	142.250.64.173	443	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:38 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE
2023-12-19 08:55:38 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-12-19 08:55:39 UTC	1627	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Dec 2023 08:55:39 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-mh5EkTGbUwiK9UEskVL0-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-19 08:55:39 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-12-19 08:55:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49716	222.111.214.42	443	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:39 UTC	575	OUT	GET /html16/images/mail/ico_email.jpg HTTP/1.1 Host: esemuro.bizmeka.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 08:55:40 UTC	215	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 08:53:21 GMT ETag: "0-791-58463a12" Last-Modified: Tue, 06 Dec 2016 04:09:54 GMT Accept-Ranges: bytes Content-Length: 1937 Content-Type: image/jpeg Connection: close
2023-12-19 08:55:40 UTC	1937	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 6f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckydohttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49717	222.111.214.42	443	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:39 UTC	577	OUT	GET /html16/images/mail/btn_confirm.jpg HTTP/1.1 Host: esemuro.bizmeka.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 08:55:40 UTC	215	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 08:55:40 GMT Connection: close ETag: "0-7b8-58463a11" Last-Modified: Tue, 06 Dec 2016 04:09:53 GMT Accept-Ranges: bytes Content-Length: 1976 Content-Type: image/jpeg
2023-12-19 08:55:40 UTC	1976	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 6f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckydohttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49719	222.111.214.42	443	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:40 UTC	572	OUT	GET /html16/images/mail/bg_tit.jpg HTTP/1.1 Host: esemuro.bizmeka.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 08:55:41 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 08:55:41 GMT Connection: close ETag: "0-434f-58463a11" Last-Modified: Tue, 06 Dec 2016 04:09:53 GMT Accept-Ranges: bytes Content-Length: 17231 Content-Type: image/jpeg
2023-12-19 08:55:41 UTC	4096	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 6f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckydohttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xm
2023-12-19 08:55:41 UTC	4096	IN	Data Raw: be d4 a2 cd 53 5e 80 28 54 a2 50 86 14 bf 44 ac cf 89 91 f9 a3 38 e9 10 0b 6e 08 f0 94 0c fa 56 a9 ba 83 9b 78 4c 8d 1e 01 39 6e 5e e9 ec 9e ed 35 9f 63 36 db 9f 79 6d d7 1d 61 a2 e2 52 b0 48 59 40 98 eb 13 31 8b 66 d2 d7 70 4b ef 02 b2 b5 20 5a ca c5 ee 38 55 75 fe 1f 9e 5c 71 ba 86 5e a5 a8 52 5a 9a 4a 90 14 40 97 03 d7 ca 3a 7b 59 24 85 d5 8c e0 bc e7 54 b4 86 e9 a4 4a 2a e5 dd fb 7b f1 16 aa 8a 04 d3 3d 73 7a 99 e4 23 81 ed 48 13 03 94 89 20 18 e9 a0 d6 5c d6 70 17 10 e0 17 9a ea 5c a6 c7 49 e2 b5 81 cc 2a b5 eb e2 9b 26 b2 3c ea 29 2f ed bc 84 93 a4 3c 86 5c 20 71 e1 30 01 8d 4d cf 36 df db 48 5b 1c 80 8e 90 0a c8 b5 f2 ff 00 4d ba 8c 3a 48 9c d3 d0 48 50 ee 55 f1 97 9d dc e9 2a ad ea ba 34 8a 77 90 b6 9c ec 18 43 6b 29 20 82 03 93 24 4c 18 d6 4f ce Data Ascii: S^(TPD8nVxL9n^5c6ymaRHY@1fpK Z8Uu\q^RZJ@:{Y$TJ{=sz#H \p\I&<)/<\ q0M6H[M:HHPU*4wCk) $LO
2023-12-19 08:55:41 UTC	4096	IN	Data Raw: 15 bc d7 ab 7d a3 73 be 19 f3 0d 9a 71 9b 72 1e bc 3f 7d af b6 5c ad e6 e0 14 1b 55 2d b2 b2 dc f2 d5 56 da a4 57 a9 6d b7 24 f0 22 71 78 48 24 20 00 40 e9 0a c9 0e 14 0f a5 7a 32 5e 94 30 db ba 52 57 24 09 02 47 4f e8 8b ea 93 23 46 59 aa ae 14 48 26 7c ba 7a 7e 8e 98 2a 5a 5e 4d 76 26 07 42 47 da 90 1d 7f 96 15 57 96 15 f7 82 9c 25 2a 04 03 cc 10 65 c4 75 43 03 92 85 ae 65 0e 29 06 d6 ad 44 7f ac a0 79 78 91 f9 a2 d4 83 10 8a e2 e9 4c f5 57 60 a3 35 25 b0 85 a5 27 91 52 47 a2 7f d1 e7 12 f6 38 aa e3 70 69 a9 5c a3 f1 37 b7 57 0c eb 6e af 54 4e 20 d4 f6 6c a9 e0 ca 81 52 1d 4a 06 a5 20 8e 91 20 63 1e 48 8b 9b 88 c1 6c ac ae cc 32 55 a6 85 46 1b 73 b2 d6 1b ce de 63 b5 0b b1 50 97 5b b7 b2 d2 c1 a7 6c e8 5a 12 12 41 25 27 8e a4 f4 c4 7c bb 48 a7 08 59 72 Data Ascii: }sqr?}\U-VWm$"qxH$ @z2^0RW$GO#FYH&\|z~Z^Mv&BGW%euCe)DyxLW`5%'RG8pi\7WnTN lRJ cHl2UFscP[lZA%'\|HYr
2023-12-19 08:55:41 UTC	4096	IN	Data Raw: 68 06 2b d7 af b5 7d 2b 90 39 6f f8 9e b0 e0 18 c0 19 1b 3e 29 5e 7d d8 da 3b 31 39 35 a0 b8 e4 bb 6f 2c cd f0 cd a0 b7 5a b6 8f 6c 91 f7 65 92 ca 84 d4 df ef 75 4d 84 dd 2f d5 f4 ed 4a ae f5 7e a9 08 42 aa 2f 97 7a a4 69 65 af b2 cb 67 4a 12 96 d1 28 eb ef 75 7d 2f 48 6b 74 4d 24 b4 35 82 b2 3b e2 71 da e7 7e 51 38 35 bb 06 58 02 bc bf 49 d0 35 6e 63 2f e6 ce 61 3e 2d cc a6 91 46 0d 5b 1b 49 c1 91 8a 9a 46 c6 9a bd df 11 cc 97 39 71 fe e0 50 e7 f7 7c 72 e5 97 57 59 2f 94 18 a5 ad 90 ed 45 ee eb 4a fd 23 0b 4b 8a 93 49 a4 6e ac 34 ed 62 96 ae 5a 06 9e 33 24 08 e4 b5 3b 3b cf 92 1a b5 dc 33 0d 3c 10 d0 f7 34 86 92 72 a5 69 5e b1 87 4a f4 0d 0f 51 d0 ee b5 e1 cb 7a 7d dd ab f5 c7 d4 98 58 f0 4b 40 cc bb 86 bc 3d 47 bd b8 2f 19 37 67 e2 5b 72 28 6f d5 f6 ec Data Ascii: h+}+9o>)^};195o,ZleuM/J~B/ziegJ(u}/HktM$5;q~Q85XI5nc/a>-F[IF9qP\|rWY/EJ#KIn4bZ3$;;3<4ri^JQz}XK@=G/7g[r(o
2023-12-19 08:55:41 UTC	847	IN	Data Raw: 9e e3 3d b8 ce e2 ef 26 df 6e b3 d0 36 2a 59 37 07 69 6f 35 d7 7a 85 d2 cc 8d 25 8a 8b 0d 91 a6 e9 83 fa 4b ca ed 14 4a 38 48 0d 44 65 38 0e 1c cf a3 ef 5a e6 17 71 9e 26 b4 e1 f8 88 ff 00 94 ac fe 33 55 96 8b 45 b8 53 59 31 f7 1b 14 ac e9 53 d9 4d cd a7 54 74 8d 45 d4 23 0f 79 09 78 ae 7a 80 51 1a a7 23 14 51 9b cd 7a be f5 6c 97 ee 6d 3a fe e5 b4 22 af 35 ff 00 d0 31 9f 9f 2f bb 0f fe c8 31 71 80 57 33 4e af bd 63 48 46 e1 5e 83 ed c1 57 4d 5e 6d ec fe 2d f3 e6 17 6f f9 1a 2e 77 7a 7e 9d aa ce 35 c2 8a aa 6b 33 6e 3f d5 ec 57 c6 37 7e 5e 05 94 3b bd 3f 4e d5 27 89 54 15 99 b7 b3 d8 a4 bf be 57 7f f9 12 18 6f 3f 4e d5 18 f4 55 3f be 66 de ce e2 7e 33 bc 7f c8 70 ee f4 fd 3b 53 bc b9 8b e2 46 b3 64 ff 00 65 aa ff 00 fe 88 c7 76 5f ee ae c5 dd 1f 7e e6 75 Data Ascii: =&n6*Y7io5z%KJ8HDe8Zq&3UESY1SMTtE#yxzQ#Qzlm:"51/1qW3NcHF^WM^m-o.wz~5k3n?W7~^;?N'TWo?NU?f~3p;SFdev_~u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49720	222.111.214.42	443	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:40 UTC	573	OUT	GET /html16/images/mail/bg_cont.jpg HTTP/1.1 Host: esemuro.bizmeka.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 08:55:41 UTC	216	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 08:55:41 GMT Connection: close ETag: "0-109c-58463a11" Last-Modified: Tue, 06 Dec 2016 04:09:53 GMT Accept-Ranges: bytes Content-Length: 4252 Content-Type: image/jpeg
2023-12-19 08:55:41 UTC	4096	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 6f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckydohttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xm
2023-12-19 08:55:41 UTC	156	IN	Data Raw: 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 f2 f8 3f ff d9 Data Ascii: 4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{A?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49728	222.111.214.42	443	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:41 UTC	375	OUT	GET /html16/images/mail/ico_email.jpg HTTP/1.1 Host: esemuro.bizmeka.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 08:55:41 UTC	215	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 08:53:21 GMT ETag: "0-791-58463a12" Last-Modified: Tue, 06 Dec 2016 04:09:54 GMT Accept-Ranges: bytes Content-Length: 1937 Content-Type: image/jpeg Connection: close
2023-12-19 08:55:41 UTC	1937	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 6f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckydohttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49727	222.111.214.42	443	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:41 UTC	377	OUT	GET /html16/images/mail/btn_confirm.jpg HTTP/1.1 Host: esemuro.bizmeka.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 08:55:41 UTC	215	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 08:55:40 GMT ETag: "0-7b8-58463a11" Last-Modified: Tue, 06 Dec 2016 04:09:53 GMT Accept-Ranges: bytes Content-Length: 1976 Content-Type: image/jpeg Connection: close
2023-12-19 08:55:41 UTC	1976	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 6f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckydohttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49731	222.111.214.42	443	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:42 UTC	373	OUT	GET /html16/images/mail/bg_cont.jpg HTTP/1.1 Host: esemuro.bizmeka.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 08:55:42 UTC	216	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 08:55:42 GMT Connection: close ETag: "0-109c-58463a11" Last-Modified: Tue, 06 Dec 2016 04:09:53 GMT Accept-Ranges: bytes Content-Length: 4252 Content-Type: image/jpeg
2023-12-19 08:55:42 UTC	4096	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 6f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckydohttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xm
2023-12-19 08:55:42 UTC	156	IN	Data Raw: 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 73 47 b4 1b ae 07 34 7b 41 ba e0 f2 f8 3f ff d9 Data Ascii: 4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{AsG4{A?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49732	222.111.214.42	443	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:42 UTC	372	OUT	GET /html16/images/mail/bg_tit.jpg HTTP/1.1 Host: esemuro.bizmeka.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-19 08:55:42 UTC	217	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 08:55:42 GMT Connection: close ETag: "0-434f-58463a11" Last-Modified: Tue, 06 Dec 2016 04:09:53 GMT Accept-Ranges: bytes Content-Length: 17231 Content-Type: image/jpeg
2023-12-19 08:55:42 UTC	4096	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 6f 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckydohttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xm
2023-12-19 08:55:42 UTC	4096	IN	Data Raw: be d4 a2 cd 53 5e 80 28 54 a2 50 86 14 bf 44 ac cf 89 91 f9 a3 38 e9 10 0b 6e 08 f0 94 0c fa 56 a9 ba 83 9b 78 4c 8d 1e 01 39 6e 5e e9 ec 9e ed 35 9f 63 36 db 9f 79 6d d7 1d 61 a2 e2 52 b0 48 59 40 98 eb 13 31 8b 66 d2 d7 70 4b ef 02 b2 b5 20 5a ca c5 ee 38 55 75 fe 1f 9e 5c 71 ba 86 5e a5 a8 52 5a 9a 4a 90 14 40 97 03 d7 ca 3a 7b 59 24 85 d5 8c e0 bc e7 54 b4 86 e9 a4 4a 2a e5 dd fb 7b f1 16 aa 8a 04 d3 3d 73 7a 99 e4 23 81 ed 48 13 03 94 89 20 18 e9 a0 d6 5c d6 70 17 10 e0 17 9a ea 5c a6 c7 49 e2 b5 81 cc 2a b5 eb e2 9b 26 b2 3c ea 29 2f ed bc 84 93 a4 3c 86 5c 20 71 e1 30 01 8d 4d cf 36 df db 48 5b 1c 80 8e 90 0a c8 b5 f2 ff 00 4d ba 8c 3a 48 9c d3 d0 48 50 ee 55 f1 97 9d dc e9 2a ad ea ba 34 8a 77 90 b6 9c ec 18 43 6b 29 20 82 03 93 24 4c 18 d6 4f ce Data Ascii: S^(TPD8nVxL9n^5c6ymaRHY@1fpK Z8Uu\q^RZJ@:{Y$TJ{=sz#H \p\I&<)/<\ q0M6H[M:HHPU*4wCk) $LO
2023-12-19 08:55:42 UTC	4096	IN	Data Raw: 15 bc d7 ab 7d a3 73 be 19 f3 0d 9a 71 9b 72 1e bc 3f 7d af b6 5c ad e6 e0 14 1b 55 2d b2 b2 dc f2 d5 56 da a4 57 a9 6d b7 24 f0 22 71 78 48 24 20 00 40 e9 0a c9 0e 14 0f a5 7a 32 5e 94 30 db ba 52 57 24 09 02 47 4f e8 8b ea 93 23 46 59 aa ae 14 48 26 7c ba 7a 7e 8e 98 2a 5a 5e 4d 76 26 07 42 47 da 90 1d 7f 96 15 57 96 15 f7 82 9c 25 2a 04 03 cc 10 65 c4 75 43 03 92 85 ae 65 0e 29 06 d6 ad 44 7f ac a0 79 78 91 f9 a2 d4 83 10 8a e2 e9 4c f5 57 60 a3 35 25 b0 85 a5 27 91 52 47 a2 7f d1 e7 12 f6 38 aa e3 70 69 a9 5c a3 f1 37 b7 57 0c eb 6e af 54 4e 20 d4 f6 6c a9 e0 ca 81 52 1d 4a 06 a5 20 8e 91 20 63 1e 48 8b 9b 88 c1 6c ac ae cc 32 55 a6 85 46 1b 73 b2 d6 1b ce de 63 b5 0b b1 50 97 5b b7 b2 d2 c1 a7 6c e8 5a 12 12 41 25 27 8e a4 f4 c4 7c bb 48 a7 08 59 72 Data Ascii: }sqr?}\U-VWm$"qxH$ @z2^0RW$GO#FYH&\|z~Z^Mv&BGW%euCe)DyxLW`5%'RG8pi\7WnTN lRJ cHl2UFscP[lZA%'\|HYr
2023-12-19 08:55:42 UTC	4096	IN	Data Raw: 68 06 2b d7 af b5 7d 2b 90 39 6f f8 9e b0 e0 18 c0 19 1b 3e 29 5e 7d d8 da 3b 31 39 35 a0 b8 e4 bb 6f 2c cd f0 cd a0 b7 5a b6 8f 6c 91 f7 65 92 ca 84 d4 df ef 75 4d 84 dd 2f d5 f4 ed 4a ae f5 7e a9 08 42 aa 2f 97 7a a4 69 65 af b2 cb 67 4a 12 96 d1 28 eb ef 75 7d 2f 48 6b 74 4d 24 b4 35 82 b2 3b e2 71 da e7 7e 51 38 35 bb 06 58 02 bc bf 49 d0 35 6e 63 2f e6 ce 61 3e 2d cc a6 91 46 0d 5b 1b 49 c1 91 8a 9a 46 c6 9a bd df 11 cc 97 39 71 fe e0 50 e7 f7 7c 72 e5 97 57 59 2f 94 18 a5 ad 90 ed 45 ee eb 4a fd 23 0b 4b 8a 93 49 a4 6e ac 34 ed 62 96 ae 5a 06 9e 33 24 08 e4 b5 3b 3b cf 92 1a b5 dc 33 0d 3c 10 d0 f7 34 86 92 72 a5 69 5e b1 87 4a f4 0d 0f 51 d0 ee b5 e1 cb 7a 7d dd ab f5 c7 d4 98 58 f0 4b 40 cc bb 86 bc 3d 47 bd b8 2f 19 37 67 e2 5b 72 28 6f d5 f6 ec Data Ascii: h+}+9o>)^};195o,ZleuM/J~B/ziegJ(u}/HktM$5;q~Q85XI5nc/a>-F[IF9qP\|rWY/EJ#KIn4bZ3$;;3<4ri^JQz}XK@=G/7g[r(o
2023-12-19 08:55:42 UTC	847	IN	Data Raw: 9e e3 3d b8 ce e2 ef 26 df 6e b3 d0 36 2a 59 37 07 69 6f 35 d7 7a 85 d2 cc 8d 25 8a 8b 0d 91 a6 e9 83 fa 4b ca ed 14 4a 38 48 0d 44 65 38 0e 1c cf a3 ef 5a e6 17 71 9e 26 b4 e1 f8 88 ff 00 94 ac fe 33 55 96 8b 45 b8 53 59 31 f7 1b 14 ac e9 53 d9 4d cd a7 54 74 8d 45 d4 23 0f 79 09 78 ae 7a 80 51 1a a7 23 14 51 9b cd 7a be f5 6c 97 ee 6d 3a fe e5 b4 22 af 35 ff 00 d0 31 9f 9f 2f bb 0f fe c8 31 71 80 57 33 4e af bd 63 48 46 e1 5e 83 ed c1 57 4d 5e 6d ec fe 2d f3 e6 17 6f f9 1a 2e 77 7a 7e 9d aa ce 35 c2 8a aa 6b 33 6e 3f d5 ec 57 c6 37 7e 5e 05 94 3b bd 3f 4e d5 27 89 54 15 99 b7 b3 d8 a4 bf be 57 7f f9 12 18 6f 3f 4e d5 18 f4 55 3f be 66 de ce e2 7e 33 bc 7f c8 70 ee f4 fd 3b 53 bc b9 8b e2 46 b3 64 ff 00 65 aa ff 00 fe 88 c7 76 5f ee ae c5 dd 1f 7e e6 75 Data Ascii: =&n6*Y7io5z%KJ8HDe8Zq&3UESY1SMTtE#yxzQ#Qzlm:"51/1qW3NcHF^WM^m-o.wz~5k3n?W7~^;?N'TWo?NU?f~3p;SFdev_~u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49734	23.193.120.112	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:43 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-12-19 08:55:43 UTC	494	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=28534 Date: Tue, 19 Dec 2023 08:55:43 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49735	23.193.120.112	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:44 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-12-19 08:55:44 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=28504 Date: Tue, 19 Dec 2023 08:55:44 GMT Content-Length: 55 Connection: close X-CID: 2
2023-12-19 08:55:44 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49736	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:55:45 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=D3aaZ1KaEyBDa5B&MD=FaHsa1pn HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-19 08:55:45 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 74cc0607-de0d-4330-9346-dfb20ef9c38e MS-RequestId: a4dbee3d-0fdf-4089-9f53-20035581c753 MS-CV: //zBai1qn0q1TiFl.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 08:55:44 GMT Connection: close Content-Length: 24490
2023-12-19 08:55:45 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-12-19 08:55:45 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49751	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:56:23 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=D3aaZ1KaEyBDa5B&MD=FaHsa1pn HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-19 08:56:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: e6f8ead7-bc0f-44ed-9c49-7ddfb3b913e7 MS-RequestId: 4aed7a60-0ce4-4071-9425-40cf32549c76 MS-CV: neU+ET756E+Skb4t.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Dec 2023 08:56:23 GMT Connection: close Content-Length: 25457
2023-12-19 08:56:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-12-19 08:56:23 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49754	142.250.217.206	443	4912	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 08:57:06 UTC	449	OUT	GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000008EDAF39BEB HTTP/1.1 Host: clients1.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2023-12-19 08:57:06 UTC	817	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-YA78W1pd9jxKexnh1cO6_w' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Security-Policy: script-src 'report-sample' 'nonce-rrV-4HupbCO4-wAiRzFw4Q' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Type: text/plain; charset=utf-8 Content-Length: 220 Date: Tue, 19 Dec 2023 08:57:06 GMT Expires: Tue, 19 Dec 2023 08:57:06 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-19 08:57:06 UTC	220	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 39 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 39 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 39 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 39 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 39 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 39 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 37 38 33 38 39 64 38 31 0a Data Ascii: rlzC1: 1C1ONGR_enUS1089rlzC2: 1C2ONGR_enUS1089rlzC7: 1C7ONGR_enUS1089dcc: set_dcc: C1:1C1ONGR_enUS1089,C2:1C2ONGR_enUS1089,C7:1C7ONGR_enUS1089events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: 78389d81

Target ID:	0
Start time:	09:55:34
Start date:	19/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\2023121142000021ki01kvjs.html
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:55:35
Start date:	19/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,13568755651350574847,2774750307757478582,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2023121142000021ki01kvjs.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Windows Analysis Report
2023121142000021ki01kvjs.html