Edit tour

Windows Analysis Report
https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/gallery

Overview

General Information

Sample URL:	https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/gallery
Analysis ID:	1467123
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found iframes

HTML body contains low number of good links

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=1888,i,7521391653640884176,2490811317560230940,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6432 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/gallery" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /g/collect?v=2&tid=G-WFQFFZ86BQ&cid=1368140035.1720022653&gtm=45je4710v9117459707z8812675860za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&frm=0 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://fannyvanphoto.pic-time.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://fannyvanphoto.pic-time.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_80.2.dr	String found in binary or memory: Http://bugs.jqueryui.com/ticket/9446
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/category/effects-core/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/data-selector/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/disableSelection/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/draggable/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/droppable/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/focusable-selector/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/form-reset-mixin/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/jQuery.ui.keyCode/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/jQuery.widget/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/labels/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/mouse/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/position/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/resizable/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/scrollParent/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/selectable/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/sortable/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/tabbable-selector/
Source: chromecache_80.2.dr	String found in binary or memory: http://api.jqueryui.com/uniqueId/
Source: chromecache_87.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12359
Source: chromecache_87.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/13378
Source: chromecache_87.2.dr	String found in binary or memory: http://dev.w3.org/csswg/cssom/#resolved-values
Source: chromecache_87.2.dr	String found in binary or memory: http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291
Source: chromecache_87.2.dr	String found in binary or memory: http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript
Source: chromecache_87.2.dr	String found in binary or memory: http://javascript.nwbox.com/IEContentLoaded/
Source: chromecache_87.2.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_80.2.dr, chromecache_87.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_80.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_80.2.dr	String found in binary or memory: http://jqueryui.com/draggable/
Source: chromecache_80.2.dr	String found in binary or memory: http://jqueryui.com/droppable/
Source: chromecache_80.2.dr	String found in binary or memory: http://jqueryui.com/effect/
Source: chromecache_80.2.dr	String found in binary or memory: http://jqueryui.com/position/
Source: chromecache_80.2.dr	String found in binary or memory: http://jqueryui.com/resizable/
Source: chromecache_80.2.dr	String found in binary or memory: http://jqueryui.com/selectable/
Source: chromecache_80.2.dr	String found in binary or memory: http://jqueryui.com/sortable/
Source: chromecache_80.2.dr	String found in binary or memory: http://jqueryui.com/widget/
Source: chromecache_80.2.dr	String found in binary or memory: http://jsfiddle.net/JZSMt/3/
Source: chromecache_87.2.dr	String found in binary or memory: http://jsperf.com/getall-vs-sizzle/2
Source: chromecache_87.2.dr	String found in binary or memory: http://jsperf.com/thor-indexof-vs-for/5
Source: chromecache_86.2.dr	String found in binary or memory: http://schema.org
Source: chromecache_87.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_81.2.dr	String found in binary or memory: http://typography.com.
Source: chromecache_87.2.dr	String found in binary or memory: http://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_87.2.dr	String found in binary or memory: http://weblogs.java.net/blog/driscoll/archive/2009/09/08/eval-javascript-global-context
Source: chromecache_80.2.dr	String found in binary or memory: http://www.robertpenner.com/easing)
Source: chromecache_75.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_80.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=107380
Source: chromecache_87.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: chromecache_87.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_87.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=491668
Source: chromecache_80.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=561664
Source: chromecache_87.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=649285
Source: chromecache_87.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: chromecache_84.2.dr, chromecache_75.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_66.2.dr	String found in binary or memory: https://clientlocal.pic-time.com
Source: chromecache_87.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=378607
Source: chromecache_87.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=449857
Source: chromecache_87.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=470258
Source: chromecache_80.2.dr	String found in binary or memory: https://code.google.com/p/maashaack/source/browse/packages/graphics/trunk/src/graphics/colors/HUE2RG
Source: chromecache_87.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_87.2.dr	String found in binary or memory: https://developer.mozilla.org/en/Security/CSP)
Source: chromecache_80.2.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: chromecache_86.2.dr	String found in binary or memory: https://fannyvandecandelaere.com
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v19/wlp2gwHKFkZgtmSR3NB0oRJfYAhTM_I.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v19/wlp2gwHKFkZgtmSR3NB0oRJfYQhTM_I.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v19/wlp2gwHKFkZgtmSR3NB0oRJfbwhT.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v19/wlpogwHKFkZgtmSR3NB0oRJfajhRK_Y.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v19/wlpogwHKFkZgtmSR3NB0oRJfajheK_Zt3Q.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v19/wlpogwHKFkZgtmSR3NB0oRJfajhfK_Zt3Q.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v19/wlppgwHKFkZgtmSR3NB0oRJX1C1GA9NQ5LE.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v19/wlppgwHKFkZgtmSR3NB0oRJX1C1GAtNQ5LE.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v19/wlppgwHKFkZgtmSR3NB0oRJX1C1GDNNQ.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v19/wlppgwHKFkZgtmSR3NB0oRJXsCxGA9NQ5LE.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v19/wlppgwHKFkZgtmSR3NB0oRJXsCxGAtNQ5LE.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v19/wlppgwHKFkZgtmSR3NB0oRJXsCxGDNNQ.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizYRExUiTo99u79D0e0w8mIEDQ.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizYRExUiTo99u79D0e0x8mI.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizYRExUiTo99u79D0e0ycmIEDQ.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizYRExUiTo99u79D0e0ysmIEDQ.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0-ExdGM.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0KExQ.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0aExdGM.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0yExdGM.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0O6tLQ.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0OCtLQ0Z.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0OOtLQ0Z.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0OqtLQ0Z.woff2)
Source: chromecache_77.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngRUXNadjH0qYEzV7ab-oWlsbCCwR26eg.woff2)
Source: chromecache_77.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngRUXNadjH0qYEzV7ab-oWlsbCGwR0.woff2)
Source: chromecache_77.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngRUXNadjH0qYEzV7ab-oWlsbCIwR26eg.woff2)
Source: chromecache_77.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngRUXNadjH0qYEzV7ab-oWlsbCLwR26eg.woff2)
Source: chromecache_77.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngSUXNadjH0qYEzV7ab-oWlsbg95AiBW_3QRQ.woff2)
Source: chromecache_77.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngSUXNadjH0qYEzV7ab-oWlsbg95AiFW_0.woff2)
Source: chromecache_77.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngSUXNadjH0qYEzV7ab-oWlsbg95AiIW_3QRQ.woff2)
Source: chromecache_77.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsansnarrow/v18/BngSUXNadjH0qYEzV7ab-oWlsbg95AiLW_3QRQ.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://github.com/jquery/jquery-color
Source: chromecache_80.2.dr	String found in binary or memory: https://github.com/jquery/jquery/blob/e539bac79e666bba95bba86d690b4e609dca2286/src/selector/escapeSe
Source: chromecache_87.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: chromecache_87.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/764
Source: chromecache_87.2.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: chromecache_87.2.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: chromecache_75.2.dr	String found in binary or memory: https://google.com
Source: chromecache_75.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_73.2.dr, chromecache_78.2.dr	String found in binary or memory: https://help.pic-time.com/en/articles/7905508-how-do-i-set-up-art-gallery-pricing/
Source: chromecache_87.2.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: chromecache_73.2.dr, chromecache_78.2.dr	String found in binary or memory: https://intercom.help/photo-gallery/en/articles/9092218-how-can-i-activate-the-ai-photo-search
Source: chromecache_66.2.dr	String found in binary or memory: https://my.tempsite.temp
Source: chromecache_66.2.dr	String found in binary or memory: https://my.tempsite.temp/
Source: chromecache_75.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_84.2.dr, chromecache_75.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_86.2.dr	String found in binary or memory: https://pictime5neu1public-m.azureedge.net/pictures/39/486/39486841/homepage/homepage.jpg?rs=1336405
Source: chromecache_86.2.dr	String found in binary or memory: https://pictimecloudaf-e.azureedge.net/pictures/scripts/compiled/frontend_base.js?Ts=7/3/2024
Source: chromecache_86.2.dr	String found in binary or memory: https://pictimecloudaf-e.azureedge.net/pictures/scripts/compiled/pack_login.js?Ts=7/3/2024
Source: chromecache_86.2.dr	String found in binary or memory: https://pictimecloudaf-e.azureedge.net/pictures/scripts/compiled/pack_projectbase.js?Ts=7/3/2024
Source: chromecache_73.2.dr, chromecache_78.2.dr	String found in binary or memory: https://player.vimeo.com/video/
Source: chromecache_73.2.dr, chromecache_78.2.dr	String found in binary or memory: https://s3.amazonaws.com/embed.animoto.com/play.html?f=
Source: chromecache_66.2.dr	String found in binary or memory: https://static.pic-time.com
Source: chromecache_66.2.dr	String found in binary or memory: https://static.portraits.com
Source: chromecache_84.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_84.2.dr, chromecache_75.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_72.2.dr	String found in binary or memory: https://use.typekit.net/swz4kaf.js
Source: chromecache_75.2.dr	String found in binary or memory: https://www.clarity.ms
Source: chromecache_75.2.dr	String found in binary or memory: https://www.clarity.ms/tag/
Source: chromecache_75.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_75.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_66.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?render=$
Source: chromecache_75.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_75.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_75.2.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_86.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-WFQFFZ86BQ
Source: chromecache_86.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_84.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_78.2.dr	String found in binary or memory: https://www.pic-time.com
Source: chromecache_73.2.dr, chromecache_78.2.dr	String found in binary or memory: https://www.youtube.com/embed/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49758 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@17/44@12/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=1888,i,7521391653640884176,2490811317560230940,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/gallery"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=1888,i,7521391653640884176,2490811317560230940,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/gallery	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://bugs.webkit.org/show_bug.cgi?id=136851	0%	URL Reputation	safe
http://jquery.org/license	0%	URL Reputation	safe
https://www.youtube.com/embed/	0%	URL Reputation	safe
http://sizzlejs.com/	0%	URL Reputation	safe
http://jqueryui.com	0%	URL Reputation	safe
https://html.spec.whatwg.org/#strip-and-collapse-whitespace	0%	URL Reputation	safe
https://drafts.csswg.org/cssom/#common-serializing-idioms	0%	URL Reputation	safe
https://bugs.webkit.org/show_bug.cgi?id=29084	0%	URL Reputation	safe
http://schema.org	0%	URL Reputation	safe
http://api.jqueryui.com/data-selector/	0%	Avira URL Cloud	safe
Http://bugs.jqueryui.com/ticket/9446	0%	Avira URL Cloud	safe
https://my.tempsite.temp/	0%	Avira URL Cloud	safe
https://static.portraits.com	0%	Avira URL Cloud	safe
http://api.jqueryui.com/tabbable-selector/	0%	Avira URL Cloud	safe
https://player.vimeo.com/video/	0%	Avira URL Cloud	safe
https://code.google.com/p/chromium/issues/detail?id=470258	0%	Avira URL Cloud	safe
https://code.google.com/p/chromium/issues/detail?id=449857	0%	Avira URL Cloud	safe
https://code.google.com/p/maashaack/source/browse/packages/graphics/trunk/src/graphics/colors/HUE2RG	0%	Avira URL Cloud	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	0%	URL Reputation	safe
https://code.google.com/p/chromium/issues/detail?id=378607	0%	Avira URL Cloud	safe
http://api.jqueryui.com/position/	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://developer.mozilla.org/en-US/docs/CSS/display	0%	URL Reputation	safe
https://td.doubleclick.net	0%	URL Reputation	safe
https://www.merchant-center-analytics.goog	0%	URL Reputation	safe
http://api.jqueryui.com/mouse/	0%	Avira URL Cloud	safe
https://www.clarity.ms/tag/	0%	Avira URL Cloud	safe
http://jquery.com/	0%	URL Reputation	safe
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-WFQFFZ86BQ&cid=1368140035.1720022653&gtm=45je4710v9117459707z8812675860za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&frm=0	0%	Avira URL Cloud	safe
http://jqueryui.com/position/	0%	Avira URL Cloud	safe
http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript	0%	Avira URL Cloud	safe
http://jsfiddle.net/JZSMt/3/	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery-color	0%	Avira URL Cloud	safe
http://api.jqueryui.com/jQuery.widget/	0%	Avira URL Cloud	safe
http://jsperf.com/getall-vs-sizzle/2	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery/blob/e539bac79e666bba95bba86d690b4e609dca2286/src/selector/escapeSe	0%	Avira URL Cloud	safe
http://api.jqueryui.com/focusable-selector/	0%	Avira URL Cloud	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=561664	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery/pull/557)	0%	Avira URL Cloud	safe
http://dev.w3.org/csswg/cssom/#resolved-values	0%	Avira URL Cloud	safe
https://intercom.help/photo-gallery/en/articles/9092218-how-can-i-activate-the-ai-photo-search	0%	Avira URL Cloud	safe
http://api.jqueryui.com/draggable/	0%	Avira URL Cloud	safe
https://bugs.webkit.org/show_bug.cgi?id=107380	0%	Avira URL Cloud	safe
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	0%	Avira URL Cloud	safe
http://jqueryui.com/widget/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/form-reset-mixin/	0%	Avira URL Cloud	safe
https://www.clarity.ms	0%	Avira URL Cloud	safe
http://jqueryui.com/resizable/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/category/effects-core/	0%	Avira URL Cloud	safe
https://fannyvanphoto.pic-time.com/favicon.ico	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery/pull/764	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/embed.animoto.com/play.html?f=	0%	Avira URL Cloud	safe
http://api.jqueryui.com/uniqueId/	0%	Avira URL Cloud	safe
https://use.typekit.net/swz4kaf.js	0%	Avira URL Cloud	safe
http://bugs.jquery.com/ticket/12359	0%	Avira URL Cloud	safe
https://static.pic-time.com	0%	Avira URL Cloud	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=649285	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net	0%	Avira URL Cloud	safe
https://www.google.com/recaptcha/api.js?render=$	0%	Avira URL Cloud	safe
http://api.jqueryui.com/selectable/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/jQuery.ui.keyCode/	0%	Avira URL Cloud	safe
http://weblogs.java.net/blog/driscoll/archive/2009/09/08/eval-javascript-global-context	0%	Avira URL Cloud	safe
http://jqueryui.com/droppable/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/disableSelection/	0%	Avira URL Cloud	safe
https://my.tempsite.temp	0%	Avira URL Cloud	safe
http://typography.com.	0%	Avira URL Cloud	safe
http://api.jqueryui.com/scrollParent/	0%	Avira URL Cloud	safe
http://bugs.jquery.com/ticket/13378	0%	Avira URL Cloud	safe
http://jqueryui.com/effect/	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en/Security/CSP)	0%	Avira URL Cloud	safe
http://jsperf.com/thor-indexof-vs-for/5	0%	Avira URL Cloud	safe
http://jqueryui.com/draggable/	0%	Avira URL Cloud	safe
http://jqueryui.com/sortable/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/droppable/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/resizable/	0%	Avira URL Cloud	safe
http://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/	0%	Avira URL Cloud	safe
https://www.pic-time.com	0%	Avira URL Cloud	safe
https://google.com	0%	Avira URL Cloud	safe
https://clientlocal.pic-time.com	0%	Avira URL Cloud	safe
https://github.com/jquery/sizzle/pull/225	0%	Avira URL Cloud	safe
https://fannyvandecandelaere.com	0%	Avira URL Cloud	safe
http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291	0%	Avira URL Cloud	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=491668	0%	Avira URL Cloud	safe
http://jqueryui.com/selectable/	0%	Avira URL Cloud	safe
http://javascript.nwbox.com/IEContentLoaded/	0%	Avira URL Cloud	safe
https://help.pic-time.com/en/articles/7905508-how-do-i-set-up-art-gallery-pricing/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/labels/	0%	Avira URL Cloud	safe
http://www.robertpenner.com/easing)	0%	Avira URL Cloud	safe
https://adservice.google.com/pagead/regclk?	0%	Avira URL Cloud	safe
http://api.jqueryui.com/sortable/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fannyvanphoto.pic-time.com	52.191.249.70	true	false	unknown
www.google.com	142.250.185.196	true	false	unknown
analytics.google.com	142.250.184.206	true	false	unknown
td.doubleclick.net	216.58.206.34	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
stats.g.doubleclick.net	142.251.173.156	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://td.doubleclick.net/td/ga/rul?tid=G-WFQFFZ86BQ&gacid=1368140035.1720022653&gtm=45je4710v9117459707z8812675860za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=419836533	false		unknown
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-WFQFFZ86BQ&cid=1368140035.1720022653&gtm=45je4710v9117459707z8812675860za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&frm=0	false	Avira URL Cloud: safe	unknown
https://fannyvanphoto.pic-time.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery	false		unknown
https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/gallery	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
Http://bugs.jqueryui.com/ticket/9446	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/tabbable-selector/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://code.google.com/p/chromium/issues/detail?id=470258	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/g/collect	chromecache_84.2.dr	false	URL Reputation: safe	unknown
https://bugs.webkit.org/show_bug.cgi?id=136851	chromecache_87.2.dr	false	URL Reputation: safe	unknown
https://code.google.com/p/chromium/issues/detail?id=449857	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://player.vimeo.com/video/	chromecache_73.2.dr, chromecache_78.2.dr	false	Avira URL Cloud: safe	unknown
http://jquery.org/license	chromecache_80.2.dr, chromecache_87.2.dr	false	URL Reputation: safe	unknown
https://my.tempsite.temp/	chromecache_66.2.dr	false	Avira URL Cloud: safe	unknown
https://static.portraits.com	chromecache_66.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/data-selector/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/embed/	chromecache_73.2.dr, chromecache_78.2.dr	false	URL Reputation: safe	unknown
http://sizzlejs.com/	chromecache_87.2.dr	false	URL Reputation: safe	unknown
https://code.google.com/p/maashaack/source/browse/packages/graphics/trunk/src/graphics/colors/HUE2RG	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com	chromecache_80.2.dr	false	URL Reputation: safe	unknown
https://code.google.com/p/chromium/issues/detail?id=378607	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://html.spec.whatwg.org/#strip-and-collapse-whitespace	chromecache_87.2.dr	false	URL Reputation: safe	unknown
http://jsfiddle.net/JZSMt/3/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://www.clarity.ms/tag/	chromecache_75.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/mouse/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/jquery-color	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/position/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/jQuery.widget/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://jsperf.com/getall-vs-sizzle/2	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://drafts.csswg.org/cssom/#common-serializing-idioms	chromecache_80.2.dr	false	URL Reputation: safe	unknown
http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/jquery/blob/e539bac79e666bba95bba86d690b4e609dca2286/src/selector/escapeSe	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://bugs.webkit.org/show_bug.cgi?id=29084	chromecache_87.2.dr	false	URL Reputation: safe	unknown
http://api.jqueryui.com/focusable-selector/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=561664	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com	chromecache_75.2.dr	false	Avira URL Cloud: safe	unknown
http://dev.w3.org/csswg/cssom/#resolved-values	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
http://schema.org	chromecache_86.2.dr	false	URL Reputation: safe	unknown
https://github.com/jquery/jquery/pull/557)	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://intercom.help/photo-gallery/en/articles/9092218-how-can-i-activate-the-ai-photo-search	chromecache_73.2.dr, chromecache_78.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/draggable/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://bugs.webkit.org/show_bug.cgi?id=107380	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/widget/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/form-reset-mixin/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://www.clarity.ms	chromecache_75.2.dr	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	chromecache_87.2.dr	false	URL Reputation: safe	unknown
http://api.jqueryui.com/category/effects-core/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/resizable/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://s3.amazonaws.com/embed.animoto.com/play.html?f=	chromecache_73.2.dr, chromecache_78.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/jquery/pull/764	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://use.typekit.net/swz4kaf.js	chromecache_72.2.dr	false	Avira URL Cloud: safe	unknown
http://bugs.jquery.com/ticket/12359	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/uniqueId/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://static.pic-time.com	chromecache_66.2.dr	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=649285	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net	chromecache_75.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/jQuery.ui.keyCode/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/position/	chromecache_80.2.dr	false	URL Reputation: safe	unknown
http://api.jqueryui.com/selectable/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api.js?render=$	chromecache_66.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/disableSelection/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/droppable/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://weblogs.java.net/blog/driscoll/archive/2009/09/08/eval-javascript-global-context	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://cct.google/taggy/agent.js	chromecache_84.2.dr, chromecache_75.2.dr	false	URL Reputation: safe	unknown
https://my.tempsite.temp	chromecache_66.2.dr	false	Avira URL Cloud: safe	unknown
http://typography.com.	chromecache_81.2.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/effect/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/CSS/display	chromecache_87.2.dr	false	URL Reputation: safe	unknown
http://api.jqueryui.com/scrollParent/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://bugs.jquery.com/ticket/13378	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
http://jsperf.com/thor-indexof-vs-for/5	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en/Security/CSP)	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://td.doubleclick.net	chromecache_84.2.dr, chromecache_75.2.dr	false	URL Reputation: safe	unknown
http://jqueryui.com/draggable/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/sortable/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/droppable/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
https://www.merchant-center-analytics.goog	chromecache_84.2.dr	false	URL Reputation: safe	unknown
http://api.jqueryui.com/resizable/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://www.pic-time.com	chromecache_78.2.dr	false	Avira URL Cloud: safe	unknown
https://clientlocal.pic-time.com	chromecache_66.2.dr	false	Avira URL Cloud: safe	unknown
http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/sizzle/pull/225	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://google.com	chromecache_75.2.dr	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=491668	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://fannyvandecandelaere.com	chromecache_86.2.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/selectable/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://javascript.nwbox.com/IEContentLoaded/	chromecache_87.2.dr	false	Avira URL Cloud: safe	unknown
https://help.pic-time.com/en/articles/7905508-how-do-i-set-up-art-gallery-pricing/	chromecache_73.2.dr, chromecache_78.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/labels/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://jquery.com/	chromecache_87.2.dr	false	URL Reputation: safe	unknown
https://adservice.google.com/pagead/regclk?	chromecache_75.2.dr	false	Avira URL Cloud: safe	unknown
http://www.robertpenner.com/easing)	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/sortable/	chromecache_80.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.206.34	td.doubleclick.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
142.250.184.206	analytics.google.com	United States	15169	GOOGLEUS	false
142.251.173.156	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
52.191.249.70	fannyvanphoto.pic-time.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467123
Start date and time:	2024-07-03 18:03:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/gallery
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/44@12/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.168.84, 216.58.212.174, 216.58.212.131, 34.104.35.123, 142.250.185.136, 152.199.19.161, 142.250.181.234, 142.250.185.67, 20.114.59.183, 173.222.108.226, 173.222.108.147, 20.242.39.171, 192.229.221.95, 142.250.186.67
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, a767.dspw65.akamai.net, clients2.google.com, ocsp.digicert.com, www.googletagmanager.com, pictimecloudaf-e.azureedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, sls.update.microsoft.com, update.googleapis.com, wu-b-net.trafficmanager.net, pictimecloudaf-e.ec.azureedge.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, pictime1neu1account-e.azureedge.net, fonts.gstatic.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, pictime1neu1account-e.ec.azureedge.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com, cs9.wpc.v0cdn.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/gallery

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1877), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	180213
Entropy (8bit):	5.487972120060974
Encrypted:	false
SSDEEP:	1536:W8y9aStDR05x67PfXeXcx6s9KTO/Wmx8cvClHmvrCB5gvaWKJrszeDxjZBhHcqZj:W8y9Ht37PvdqiReDxjZXc5Ng44
MD5:	1BAF713A37C98BC5B937A3B6F4985066
SHA1:	0AA45F9126C5FBAB6AEBB75E283F987CB4A39199
SHA-256:	7022F629795F5663A2D2AC961AF08607A8214EB3510E86038F6E1A9F01CEA7B2
SHA-512:	DBED0FC0407647AA0CC7233FD4ED8AA20445996F4F5D44714044A9A14584BDFA8CC933595D56CFD816557F26A4A62D5EDF5C5320DE344D002CB2536AD635FC08
Malicious:	false
Reputation:	low
URL:	https://pictimecloudaf-e.azureedge.net/pictures/scripts/compiled/pack_projectbase.js?Ts=7/3/2024%201:29:14%20PM
Preview:	/pic-time proprietary code. any use outside of a licensed pic-time site is not allowed/var _pictimeProduction=true;..var $jscomp=$jscomp\|\|{};$jscomp.scope={};$jscomp.ASSUME_ES5=!1;$jscomp.ASSUME_NO_NATIVE_MAP=!1;$jscomp.ASSUME_NO_NATIVE_SET=!1;$jscomp.SIMPLE_FROUND_POLYFILL=!1;$jscomp.ISOLATE_POLYFILLS=!1;$jscomp.FORCE_POLYFILL_PROMISE=!1;$jscomp.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;$jscomp.defineProperty=$jscomp.ASSUME_ES5\|\|"function"==typeof Object.defineProperties?Object.defineProperty:function(a,q,p){if(a==Array.prototype\|\|a==Object.prototype)return a;a[q]=p.value;return a};.$jscomp.getGlobal=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var q=0;q<a.length;++q){var p=a[q];if(p&&p.Math==Math)return p}throw Error("Cannot find global object");};$jscomp.global=$jscomp.getGlobal(this);$jscomp.IS_SYMBOL_NATIVE="function"===typeof Symbol&&"symbol"===typeof Symbol(

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	44593
Entropy (8bit):	4.403714985623125
Encrypted:	false
SSDEEP:	384:NMucI45r2OpPKTEpdR/fKZpBZML5OKtmO4xCK21/MsKOw8b9LTd7V4Bzm:NX45r2IK0RHKZ9DMmZi1/MsK78xTsBzm
MD5:	8C4117ECADA769554C5A2B75F8F33E31
SHA1:	1A0798A26B6B7C5A4FF5C2B2262759687087452A
SHA-256:	C0D9E4043F8DECA7CBCE7FCB4A87E47E5C6547A0E12D8C0D95398F078F45E21A
SHA-512:	96D03A2CC4F5584E141ABF4F403BED4739FCBCF7F35500AD420A199E8FBA21134AF72EC254D4586D635BD45CCF2BC18C9B19B5E5687F374458F2B90B669CCB9D
Malicious:	false
Reputation:	low
URL:	https://pictime1neu1account-e.azureedge.net/pictures/accountdata/263/263573/accountinfo.json.en-us.txt?ts=t202406031600
Preview:	{"aiFilterMode":1,"blockAI":false,"pickerFirstDay":1,"features":{"702":false,"100":false,"750":false,"403":true},"productId_photoStandardDownload":519,"productIds_photoDownload":[515,516,517,518,519],"productIds_slideshow":[520,521,522],"digitalDeliveryProductIds":[],"requireLoginOnActions":false,"blockStoreMyPhotos":false,"skipLoginUI":null,"skipHold":null,"externalTestimonials":null,"blockAccountRecommendation":false,"taxCalcType":100,"blockTieredPromotion":false,"setCollectionDownload":false,"allowProjectDownload":true,"enabledIntro":true,"cartDeliveryCustomMessage":null,"mobileNotSupported":null,"disabledOrderMore":null,"forceFacebookPopup":false,"downloadPolicy":{"freeDownloadsCount":0,"freeDownloadsActive":false,"hiresScope":0,"lowresScope":100,"isDirect":false,"sceneIds":null,"hiresSampling":0,"lowresSampling":0,"boundWidth":2000,"boundHeight":2000},"fulfillers":[[1000,"EUR"],[1100,"EUR"],[1208,"EUR"],[1220,"EUR"],[1300,"EUR"],[3000,"AUD"],[3101,"NZD"],[4000,"CAD"],[4001,"CAD"]]

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (551), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	622419
Entropy (8bit):	5.528990526810159
Encrypted:	false
SSDEEP:	6144:BES2tF+/CJ1aRregl4mal9t1QkSZ1MexC426tEf0d0H4//VAdHnj4Kk6mYCfXLk1:+S2tQKDaRregl4l2lZjCmm+/VAdHBdp
MD5:	073EEE0A04C085AE1C2A54BD7BEB5AE9
SHA1:	E952B5849B998DD44DC6FEBAEFCD05C276E860BF
SHA-256:	0FD4B4030ED7F63E4A9AAA25A78674B791D0A59C79F9880D0D45D5E5A7C09172
SHA-512:	E5FE0FB895FD26317CADC9876A0ABA16CB2B4F9A139FD874FE30AECF322E5D6AC2827D35CBB72AAB7C9B998BA5FFF04647892DF72C56C5F71099181270563A59
Malicious:	false
Reputation:	low
URL:	https://pictimecloudaf-e.azureedge.net/pictures/scripts/compiled/frontend_base.js?Ts=7/3/2024%201:29:12%20PM
Preview:	/pic-time proprietary code. any use outside of a licensed pic-time site is not allowed/var _pictimeProduction=true;..var $jscomp=$jscomp\|\|{};$jscomp.scope={};$jscomp.ASSUME_ES5=!1;$jscomp.ASSUME_NO_NATIVE_MAP=!1;$jscomp.ASSUME_NO_NATIVE_SET=!1;$jscomp.SIMPLE_FROUND_POLYFILL=!1;$jscomp.ISOLATE_POLYFILLS=!1;$jscomp.FORCE_POLYFILL_PROMISE=!1;$jscomp.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;$jscomp.defineProperty=$jscomp.ASSUME_ES5\|\|"function"==typeof Object.defineProperties?Object.defineProperty:function(b,g,e){if(b==Array.prototype\|\|b==Object.prototype)return b;b[g]=e.value;return b};.$jscomp.getGlobal=function(b){b=["object"==typeof globalThis&&globalThis,b,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var g=0;g<b.length;++g){var e=b[g];if(e&&e.Math==Math)return e}throw Error("Cannot find global object");};$jscomp.global=$jscomp.getGlobal(this);$jscomp.IS_SYMBOL_NATIVE="function"===typeof Symbol&&"symbol"===typeof Symbol(

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	15086
Entropy (8bit):	1.0971265060597182
Encrypted:	false
SSDEEP:	48:j/xW4OTn4uAbC7dL8nJYmnlhki4c/Y0iM:TxHOTnKSL8nTrkFcQ0X
MD5:	4A373BAFC5400FC34D09EB45B885D5A6
SHA1:	EA831ADD10D21C50CB62035CBC32F68C9BEEBA2F
SHA-256:	340F207CCD09B1205507ED74EA5CF96BDE3B88E185560C34334BB13B72C9A5F2
SHA-512:	63018E1DAD387D1259959B2C2C6A7EC7B88029B295EA09B2FA5A6B25F212DAB9B8588C2F938BEB22CBD2B9445B7E5C8A602AD340066E04C137477C95657EF73E
Malicious:	false
Reputation:	low
URL:	https://fannyvanphoto.pic-time.com/favicon.ico
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... .....@...........................................................................................................................................................................................................................................................................................................;;;.===.................................................&&&.................GGG.....................................................................................................&&&.........................GGG.................................&&&.........................GGG.....................................................................................................&&&.................GGG.........222.222.................................;;;.===.................................................................................222.222...................................................................................

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44593
Entropy (8bit):	4.403714985623125
Encrypted:	false
SSDEEP:	384:NMucI45r2OpPKTEpdR/fKZpBZML5OKtmO4xCK21/MsKOw8b9LTd7V4Bzm:NX45r2IK0RHKZ9DMmZi1/MsK78xTsBzm
MD5:	8C4117ECADA769554C5A2B75F8F33E31
SHA1:	1A0798A26B6B7C5A4FF5C2B2262759687087452A
SHA-256:	C0D9E4043F8DECA7CBCE7FCB4A87E47E5C6547A0E12D8C0D95398F078F45E21A
SHA-512:	96D03A2CC4F5584E141ABF4F403BED4739FCBCF7F35500AD420A199E8FBA21134AF72EC254D4586D635BD45CCF2BC18C9B19B5E5687F374458F2B90B669CCB9D
Malicious:	false
Reputation:	low
Preview:	{"aiFilterMode":1,"blockAI":false,"pickerFirstDay":1,"features":{"702":false,"100":false,"750":false,"403":true},"productId_photoStandardDownload":519,"productIds_photoDownload":[515,516,517,518,519],"productIds_slideshow":[520,521,522],"digitalDeliveryProductIds":[],"requireLoginOnActions":false,"blockStoreMyPhotos":false,"skipLoginUI":null,"skipHold":null,"externalTestimonials":null,"blockAccountRecommendation":false,"taxCalcType":100,"blockTieredPromotion":false,"setCollectionDownload":false,"allowProjectDownload":true,"enabledIntro":true,"cartDeliveryCustomMessage":null,"mobileNotSupported":null,"disabledOrderMore":null,"forceFacebookPopup":false,"downloadPolicy":{"freeDownloadsCount":0,"freeDownloadsActive":false,"hiresScope":0,"lowresScope":100,"isDirect":false,"sceneIds":null,"hiresSampling":0,"lowresSampling":0,"boundWidth":2000,"boundHeight":2000},"fulfillers":[[1000,"EUR"],[1100,"EUR"],[1208,"EUR"],[1220,"EUR"],[1300,"EUR"],[3000,"AUD"],[3101,"NZD"],[4000,"CAD"],[4001,"CAD"]]

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	64412
Entropy (8bit):	5.247278812008479
Encrypted:	false
SSDEEP:	1536:X7EvqVh7GsOd77P58oST7h+LPEOjA9wHHaF66ZLWlGLjf07PM+Lj7ROTlBIfpO8n:SpXv
MD5:	631CB749F4114AE8F3345D7C12ED8E5D
SHA1:	0178CFFA82CAA8301157BF314B68F807FBB97C0A
SHA-256:	83C38BEEF2E52B0DDEFFC6284A0E5D33678C290D56DD524BB19B285A2C995D1C
SHA-512:	F5E8F79DD197AEA7D3B509F5A1B3F069C50E31F29E441860BB432B7805A9B46AF0174E6F686252B2663F4131E85B1E13910318F059235A0C562C8A3262389CD6
Malicious:	false
Reputation:	low
URL:	https://pictimecloudaf-e.azureedge.net/pictures/photostore/4/locales/en-us/resources/sprites/client2.svg?r=133644869579416264
Preview:	<svg xmlns="http://www.w3.org/2000/svg"... xmlns:xlink="http://www.w3.org/1999/xlink"... viewBox="0 0 340 320">...<defs>......<g id="svg-icon-group-animations">.......<symbol id="svg-icon-animation-rotate">......<animateTransform attributeName="transform" attributeType="XML" type="rotate" dur="1s" from="0 10 10" to="360 10 10" repeatCount="indefinite"></animateTransform>.....</symbol>......</g>......<g id="svg-icon-group-social">.......<symbol id="svg-icon-email">......<g>.......<rect x="2.715" y="4" width="15" height="12"></rect>.......<polyline points="2.5 5.512 10.158 9.598 17.817 5.512"></polyline>......</g>.....</symbol>.......<symbol id="svg-icon-email-fill">......<g>.......<polygon transform="translate(9.850000, 6.625000) scale(1, -1) translate(-9.850000, -6.625000) " points="9.85 4 17.2 9.25 2.5 9.25"></polygon>.......<polygon points="2.72575 5.46079712 9.85 10.6740112 17.42575 5.12439484 17.42575 16.075 2.72575 16.075"></polygon>......</g>.....</symbol>.......<symbol id="svg-i

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	40038
Entropy (8bit):	5.047184205296709
Encrypted:	false
SSDEEP:	768:O0hf+VuLAoCtr6rL4f4s1CHN7nZizuie+V9cf+E8od8UeqchznFZtcmBZaCsNP6B:O8f+Ybie+V9cf+E8od8UeqchznztcmBn
MD5:	C3320577886E8B97384F55216DB23FCF
SHA1:	6BE41BC7C0EF9E5E410654126FE632247C5737A3
SHA-256:	963F879358B8B476FCDE3C2F39284CE81156DF2327B7D0F8DD58F5200791BD74
SHA-512:	4416F8DF9FCA5C82AF281AAA907992D67EFC042F83745AF3ECAC02A8FCAF5890708F9526112376C4536B94162BD8C8DADF2CEA028E966AD5218D4D856CB46442
Malicious:	false
Reputation:	low
URL:	https://pictimecloudaf-e.azureedge.net/pictures/photostore/4/locales/en-us/header2.css?ts=133644869579416264
Preview:	/.. SCSS Variables //@import 'variables';.. /./ Screen breaks /./ misc. /./ font family /./ font size /./ font style /./ font uppercase /./ font letter-spacing /./ font weights /./ line height /./ colors /./ /Variables /./.. * SCSS Functions //@import 'functions';.. /./ /Functions /./.. * SCSS Mixins //@import 'mixins';.. /./.. * Screen breaks.. /./ /Mixins /./ Placeholders /.#galleryHeader ul li a.search {. display: flex;. align-items: center;. justify-content: center;.}../ /Placeholders /.input:-webkit-autofill,.input:-webkit-autofill:hover,.input:-webkit-autofill:focus {. box-shadow: 0 0 0px 100vw #FFFFFF inset !important;.}...svg-icon:not(.fill-icon) {. stroke: currentColor;. fill: transparent;.}...svg-icon.fill-icon {. fill: currentColor;.}../.. * Migration Class.. /./ font family */..F1 {. font-family: "Gotham Narrow SSm A", "Gotham Narrow SSm B", sans-serif;.}...F2 {. font-family: "Gotham XNarrow SSm A", "Goth

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4653
Entropy (8bit):	5.395523416868547
Encrypted:	false
SSDEEP:	96:cJYgL8MiYgL8MIVc+u9YgL8McNcJOL8KKOL8KHVc+u9OL8KSNcJOxT8QOxT8mVcv:cOk8Ok8t1k8UM8Kv8K/R8KZ+8T8sX8zx
MD5:	B701861896A4CD2716442D29E9DBE69D
SHA1:	471BA4F4D36C453DD28A7020CD06BE7F75F2079B
SHA-256:	4F39D6209A6244DD36BFCE35B5D680B70F1134FCEAFE0AC53824CF5AF25A0378
SHA-512:	5CD4DB23039E12D64AF41F0FD7202C0E838C552476E6D2DA77C4DE1AF8B5BF018DD471E10E91734039162189E6D6F4E5A9AD7B45A9F4B2F358046DCF74059184
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Crimson+Text:400i,400,800,300,600,700"
Preview:	/* vietnamese /.@font-face {. font-family: 'Crimson Text';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/crimsontext/v19/wlpogwHKFkZgtmSR3NB0oRJfajheK_Zt3Q.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./ latin-ext /.@font-face {. font-family: 'Crimson Text';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/crimsontext/v19/wlpogwHKFkZgtmSR3NB0oRJfajhfK_Zt3Q.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {. font-family: 'Crimson Text';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/crimsontext/v19/wlpogwHKFkZgtmSR3NB0oRJfajhRK_Y.woff2) format('woff2');. unicode-range: U+0000-00FF, U+013

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1472), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	21185
Entropy (8bit):	5.5029055409429075
Encrypted:	false
SSDEEP:	384:0TbuRIY3j0G7ec9zIQvpIasIiQnDlIoFI8ItOzKEOn:1R9zB7ecpIQvpIasIiQnDlIoFI8ItOz2
MD5:	1AE5092FB681D4C76F75467A2D3EF346
SHA1:	E1737D73BA3CC1FF092759FC2D5B5760F2B5F40B
SHA-256:	B7D39401AE41182689201B44CCC19AAC9F324658B464163403ED97A5941EEF5D
SHA-512:	48C114483B0A33CBA228091FA96DADF493B3FA7FCFC0182EFB7266CE8DAE3FE75084F0D78385D704FFA5A61220859C7B67A17F21A5BA4E93AA5C9D134397BE64
Malicious:	false
Reputation:	low
URL:	https://pictimecloudaf-e.azureedge.net/pictures/scripts/compiled/pack_login.js?Ts=7/3/2024%201:29:14%20PM
Preview:	/pic-time proprietary code. any use outside of a licensed pic-time site is not allowed/var _pictimeProduction=true;..var $jscomp=$jscomp\|\|{};$jscomp.scope={};$jscomp.ASSUME_ES5=!1;$jscomp.ASSUME_NO_NATIVE_MAP=!1;$jscomp.ASSUME_NO_NATIVE_SET=!1;$jscomp.SIMPLE_FROUND_POLYFILL=!1;$jscomp.ISOLATE_POLYFILLS=!1;$jscomp.FORCE_POLYFILL_PROMISE=!1;$jscomp.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;$jscomp.defineProperty=$jscomp.ASSUME_ES5\|\|"function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,d){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=d.value;return a};.$jscomp.getGlobal=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");};$jscomp.global=$jscomp.getGlobal(this);$jscomp.IS_SYMBOL_NATIVE="function"===typeof Symbol&&"symbol"===typeof Symbol(

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	276599
Entropy (8bit):	5.273606390512767
Encrypted:	false
SSDEEP:	6144:rP2vE/KGu9al5T8+J6fjRUt/a8M6t+2tiJgWH2o+9sOw0y/z2L5cf2D9Nq:j2vE/KGKal5MjRUt/EJgWJf2D9c
MD5:	214952A5FF5287C768DFBE80538176AB
SHA1:	D0441362ADB32B6BF3C4B75331FEFA057FEB6E0A
SHA-256:	50AC6E19B41F2D1CBE99FFF03F265EE7FE9AF15DC0BA523632CDFA65BEAD5F65
SHA-512:	60C0C581BB86DC8CECC0C271494F71617C624D48C7A989C74BA0C82DDA4F9264A8D9FBCA4079AF8FEB9059D003DB6AE4014B6E28A7A3AE8BAE42DC3C55B6C5A8
Malicious:	false
Reputation:	low
Preview:	{"videoClipsQueueTimeLimit":5000,"bcUserSceneName":"Photos pour vous","lowresPhotoDistance":"0,15","personsBannerUnlock":"D.verrouiller la recherche de photos","personsBannerTitle":"Trouvez vos moments pr.f.r.s","personsBannerDescription":"Recherchez rapidement des photos par personnes ou par mots-cl.s","personsBannerEnhance":"Am.liorez votre exp.rience de galerie avec la recherche de photos par personnes ou par mots-cl.s","learnMore":"Apprendre encore plus","personsBannerKBLink":"https://intercom.help/photo-gallery/en/articles/9092218-how-can-i-activate-the-ai-photo-search","personsBannerEnableWarning":"Remarque.: en tant que photographe, vous avez acc.s . la recherche AI. Les visiteurs n.y auront acc.s qu.une fois que le client principal l.aura activ..","personBannerMorePersons":"+.{count}.plus","personsBannerActivateSearch":"Activer la recherche de photos","personsBannerActivateSearchTooltip":"Remarque.:.Seuls les clients principaux verront cette alerte d'insc

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	1.0971265060597182
Encrypted:	false
SSDEEP:	48:j/xW4OTn4uAbC7dL8nJYmnlhki4c/Y0iM:TxHOTnKSL8nTrkFcQ0X
MD5:	4A373BAFC5400FC34D09EB45B885D5A6
SHA1:	EA831ADD10D21C50CB62035CBC32F68C9BEEBA2F
SHA-256:	340F207CCD09B1205507ED74EA5CF96BDE3B88E185560C34334BB13B72C9A5F2
SHA-512:	63018E1DAD387D1259959B2C2C6A7EC7B88029B295EA09B2FA5A6B25F212DAB9B8588C2F938BEB22CBD2B9445B7E5C8A602AD340066E04C137477C95657EF73E
Malicious:	false
Reputation:	low
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... .....@...........................................................................................................................................................................................................................................................................................................;;;.===.................................................&&&.................GGG.....................................................................................................&&&.........................GGG.................................&&&.........................GGG.....................................................................................................&&&.................GGG.........222.222.................................;;;.===.................................................................................222.222...................................................................................

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23881)
Category:	downloaded
Size (bytes):	332381
Entropy (8bit):	5.559860197985056
Encrypted:	false
SSDEEP:	3072:ZjMaiJ9iVnZLNFlhf3A0QjngvLMzU467dblOKfy4PqM0bukMTO2muOWiWrfjKin:Zw+Vn9NFbA8RmWqM0qkMi2muOWiWrLb
MD5:	E75CCD37BF5AC1248214BDB3CD419D64
SHA1:	C8631BE363C39511A3ABA958E3398952968F4E84
SHA-256:	EBB6493F4490065615835E4A159732F1E3A49F45C168499FFF42CDD7D5F778BC
SHA-512:	8009FC8CF62D874AC40415DF420562B64F7C0936D8A335DD7EA65B8762AE6A68976996843B2DF93DA8EF7DB2E589E52267A4393C1874ABDC248C9E157EED6560
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-NNR9KPB
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"78",. . "macros":[{"function":"__e"},{"function":"__v","vtp_name":"gtm.element","vtp_dataLayerVersion":1},{"function":"__v","vtp_name":"gtm.triggers","vtp_dataLayerVersion":2,"vtp_setDefaultValue":true,"vtp_defaultValue":""},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"accountId"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"interface"},{"function":"__gas","vtp_cookieDomain":"auto","vtp_doubleClick":false,"vtp_setTrackerName":false,"vtp_useDebugVersion":false,"vtp_useHashAutoLink":false,"vtp_decorateFormsAutoLink":false,"vtp_enableLinkId":false,"vtp_enableEcommerce":false,"vtp_trackingId":"UA-17275245-1","vtp_enableRecaptchaOption":false,"vtp_enableUaRlsa":false,"vtp_enableUseInternalVersion":false,"vt

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (346), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	172860
Entropy (8bit):	4.980673927869371
Encrypted:	false
SSDEEP:	1536:mpef+v3tKOLUvuVaMUJwFkFp8jdj1GvGEDYcawjS4iW17ce9VJnmg+5H:mN3tKOIEUUu8jdJiJnG
MD5:	E9923DB9CA8E685CCDA5C446ED3C1E69
SHA1:	1C4546801CFFEA590AC78415142E8A51A3E2CF68
SHA-256:	E90D6880F9AA12F1ECD7024C9C6DF1D6BE1DB098FE39483A44995B3D0FC1444B
SHA-512:	329D8926C87E4E7AFD20B94B84D6ECC1B288BB5276DB08F396D7E40DF43E88369F5EDE98429071E2157EA3CA09167F58A8F62951C8BFFAD068BD230AE90C884B
Malicious:	false
Reputation:	low
URL:	https://pictimecloudaf-e.azureedge.net/pictures/photostore/4/locales/en-us/projectarea2.css?ts=133644869579416264
Preview:	@import url(//fonts.googleapis.com/css?family=PT+Sans:400italic,400,800,300,600,700);.@import url(//fonts.googleapis.com/css?family=PT+Sans+Narrow:400italic,400,800,300,600,700);.@import url(//fonts.googleapis.com/css?family=Crimson+Text:400i,400,800,300,600,700);.#pnlProductEditor[data-editorproductid="519"] .pnlDesigner_selectPhotosTab #pnlDesigner_thumbs div.msg font,.#pnlProductEditor .editormode_imageselect #pnlDesigner_thumbs div.msg font {. display: none;.}../.. SCSS Variables //@import 'variables';.. /./ Screen breaks /./ misc. /./ font family /./ font size /./ font style /./ font uppercase /./ font letter-spacing /./ font weights /./ line height /./ colors /./ /Variables /./.. * SCSS Functions //@import 'functions';.. /./ /Functions /./.. * SCSS Mixins //@import 'mixins';.. /./.. * Screen breaks.. /./ /Mixins /./ Placeholders */..project-area .dialogOverlay,..project-area .pictimeDialog.flexPosition, .project-area .userlogin .userloginIn

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2788
Entropy (8bit):	5.510701894573914
Encrypted:	false
SSDEEP:	48:AOLIPoQOLIAFZdOLIBTRVc+ujOLI8N0o8OCG0fQOChFZdOCkRVc+ujOCoN0oD:AOL+oQOL7FZdOLI9Vc+ujOLFNAOCLQO7
MD5:	8E1BAFDBF7B938D92C7F93360B761678
SHA1:	DC90FDCBD8C6FE8AB553EB78FAD634D891183A27
SHA-256:	7B3720CB1C9BA24A5A72175E9EA11CDA5BB2EE812A8707C8F5B2DB4DA403421B
SHA-512:	D0DEA1CA29FA5FBB9297597015B003DC877AE93BB18F4A11573F3B5ABEAB38620CF64BCC87FA51B27A543CC1574DF163879354805C0D8C8445295C7D718E4E26
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=PT+Sans+Narrow:400italic,400,800,300,600,700"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'PT Sans Narrow';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/ptsansnarrow/v18/BngRUXNadjH0qYEzV7ab-oWlsbCLwR26eg.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'PT Sans Narrow';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/ptsansnarrow/v18/BngRUXNadjH0qYEzV7ab-oWlsbCCwR26eg.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ latin-ext /.@font-face {. font-family: 'PT Sans Narrow';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/ptsansnarrow/v18/BngRUXNadjH0qYEzV7ab-oWlsbCIwR26eg.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	276599
Entropy (8bit):	5.273606390512767
Encrypted:	false
SSDEEP:	6144:rP2vE/KGu9al5T8+J6fjRUt/a8M6t+2tiJgWH2o+9sOw0y/z2L5cf2D9Nq:j2vE/KGKal5MjRUt/EJgWJf2D9c
MD5:	214952A5FF5287C768DFBE80538176AB
SHA1:	D0441362ADB32B6BF3C4B75331FEFA057FEB6E0A
SHA-256:	50AC6E19B41F2D1CBE99FFF03F265EE7FE9AF15DC0BA523632CDFA65BEAD5F65
SHA-512:	60C0C581BB86DC8CECC0C271494F71617C624D48C7A989C74BA0C82DDA4F9264A8D9FBCA4079AF8FEB9059D003DB6AE4014B6E28A7A3AE8BAE42DC3C55B6C5A8
Malicious:	false
Reputation:	low
URL:	https://pictimecloudaf-e.azureedge.net/pictures/photostore/4/locales/fr-fr/lang.json.txt?ts=133644869579416264
Preview:	{"videoClipsQueueTimeLimit":5000,"bcUserSceneName":"Photos pour vous","lowresPhotoDistance":"0,15","personsBannerUnlock":"D.verrouiller la recherche de photos","personsBannerTitle":"Trouvez vos moments pr.f.r.s","personsBannerDescription":"Recherchez rapidement des photos par personnes ou par mots-cl.s","personsBannerEnhance":"Am.liorez votre exp.rience de galerie avec la recherche de photos par personnes ou par mots-cl.s","learnMore":"Apprendre encore plus","personsBannerKBLink":"https://intercom.help/photo-gallery/en/articles/9092218-how-can-i-activate-the-ai-photo-search","personsBannerEnableWarning":"Remarque.: en tant que photographe, vous avez acc.s . la recherche AI. Les visiteurs n.y auront acc.s qu.une fois que le client principal l.aura activ..","personBannerMorePersons":"+.{count}.plus","personsBannerActivateSearch":"Activer la recherche de photos","personsBannerActivateSearchTooltip":"Remarque.:.Seuls les clients principaux verront cette alerte d'insc

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (621), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	80671
Entropy (8bit):	4.9506634925448925
Encrypted:	false
SSDEEP:	1536:rCszv65zvJSLhibKJ/WIAVrs59EOklDs5WIKkksl2P13+AGvWWIpMWIcsfQprpYL:rbv65zvJSLhibKJ2Vg9EOklDs6kj2P16
MD5:	3FFED010C572FDB14C23BFC1CF8FED08
SHA1:	43E61AC17DC161FD5ABADB70F324799B6064C472
SHA-256:	7C75F5C3EDF8B2686E556519CEA0CBD10D24E7ADD75CF23048BE9341630BB5C4
SHA-512:	73634F83E29740C47ED39C3C90F09C0C8169FBB73B942367FE6CF496B79C6B224CFCBB8A0DDB1EC3502C22782D56F5BBBAFFB663622F638E3095985AE2C6361F
Malicious:	false
Reputation:	low
URL:	https://pictimecloudaf-e.azureedge.net/pictures/photostore/4/locales/en-us/gallerycover.css?ts=133644869579416264
Preview:	h1, h2, h3 {. margin: 0;. padding: 0;.}...FontsNotLoaded {. visibility: hidden;.}../************* New Gallery Home ************************/.#galleryHome {. position: relative;. width: 100%;. z-index: 3;. direction: ltr;.}..#galleryHome .coverPhoto {. position: absolute;. top: 0;. left: 0;. width: 100%;. height: 100%;. overflow: hidden;. background-repeat: no-repeat;. background-size: cover;. background-position: center;. transition: opacity 400ms;.}..#galleryHome .coverPhoto.active {. opacity: 1;.}..#galleryHome.custom-style .arrowDown {. mask-image: url(./resources/sprites/client.svg?r=r154.1);. mask-repeat: no-repeat;. mask-position: -280px -80px;. -webkit-mask-image: url(./resources/sprites/client.svg?r=r154.1);. -webkit-mask-repeat: no-repeat;. -webkit-mask-position: -280px -80px;.}..body.gallery #galleryHome,.body.login #galleryHome {. cursor: pointer;.}../*********** /New Gallery Home ********

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (324)
Category:	downloaded
Size (bytes):	229457
Entropy (8bit):	5.058392693652721
Encrypted:	false
SSDEEP:	6144:NcwxmCJEjgJyHCcmMlFq/W/nEEtJfdKE37gxGfmgQRpI9J6l/Ju5nPrVhDEsRTA7:QEyHCcmMy/W/EEPvQRgPrVhDdREFemH/
MD5:	7618C4BC12B1614B750F4F27617B8707
SHA1:	26A00AFE23048909C7B0C98BDA6DF61C9235830C
SHA-256:	981702D3D509B1E7239D70D2FDD54F7B3A7AE1DDC56973303CD5CB1C40DE6989
SHA-512:	9993DA19EDE9B70FF2F00802210490C3FDFC2A922F52BAB819BF585D32DDAA2C75A6B5762F23F740EF2B32E30D4447129BC18F51BDB484D9402D7D9049EF5731
Malicious:	false
Reputation:	low
URL:	https://pictimecloudaf-e.azureedge.net/pictures/scripts/jquery-ui-1.13.2.modified.js?ts=10/14/2022%209:03:45%20AM
Preview:	/! jQuery UI - v1.13.2 - 2022-10-05. http://jqueryui.com.* Includes: widget.js, position.js, data.js, disable-selection.js, focusable.js, form-reset-mixin.js, jquery-patch.js, keycode.js, labels.js, scroll-parent.js, tabbable.js, unique-id.js, widgets/draggable.js, widgets/droppable.js, widgets/resizable.js, widgets/selectable.js, widgets/sortable.js, widgets/mouse.js, effect.js.* Copyright jQuery Foundation and other contributors; Licensed MIT /..( function( factory ) {.."use strict";....if ( typeof define === "function" && define.amd ) {....// AMD. Register as an anonymous module....define( [ "jquery" ], factory );..} else {....// Browser globals...factory( jQuery );..}.} )( function( $ ) {."use strict";..$.ui = $.ui \|\| {};..var version = $.ui.version = "1.13.2";.../!. * jQuery UI Widget 1.13.2. * http://jqueryui.com. . Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. */..//>>label: Widget.//>>group: Core.//>>d

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64729)
Category:	downloaded
Size (bytes):	556679
Entropy (8bit):	6.010549444698857
Encrypted:	false
SSDEEP:	12288:13MkMnK9YKz9uqexvBiWEtBT3ngEkl0RqziCUz/Onexzng/O:KoNm5iWEtBTXpkiRqzi/3xF
MD5:	41143AE6AC954CD23DFA8A9CD81B2E12
SHA1:	6D06733AC653DFA27B941CA6D12680D003577DA9
SHA-256:	6C37284F01CBB48370038504C88317D305B20EA90BB9F4320BB49FA065FB066E
SHA-512:	053CA836613B6689B5B057E8D674E2F02D35C3B281071148994A35B9F9AB098DB426DC30757A4F99168D6584460AAAF7E9775A46A23C1B6AD9DDB5E8643CBEA1
Malicious:	false
Reputation:	low
URL:	https://pictimecloudaf-e.azureedge.net/pictures/webfonts/701366/550D4A6EF889DED55.css?ts=7/3/2024%2012:37:45%20PM
Preview:	./..Copyright (C) 2011-2018 Hoefler & Co...This software is the property of Hoefler & Co. (H&Co)...Your right to access and use this software is subject to the..applicable License Agreement, or Terms of Service, that exists..between you and H&Co. If no such agreement exists, you may not..access or use this software for any purpose...This software may only be hosted at the locations specified in..the applicable License Agreement or Terms of Service, and only..for the purposes expressly set forth therein. You may not copy,..modify, convert, create derivative works from or distribute this..software in any way, or make it accessible to any third party,..without first obtaining the written permission of H&Co...For more information, please visit us at http://typography.com...272437-99893-20181202./..@font-face{ font-family: "Gotham XNarrow SSm A"; src: url(data:application/x-font-woff2;base64,d09GMgABAAAAAJy4ABIAAAABpsAAAJxRAAJNUAAAAAAAAAAAAAAAAAAAAAAAAAAAGh4bgdNEHIEABmAAjC4INAmCYREMCoPYKI

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	64412
Entropy (8bit):	5.247278812008479
Encrypted:	false
SSDEEP:	1536:X7EvqVh7GsOd77P58oST7h+LPEOjA9wHHaF66ZLWlGLjf07PM+Lj7ROTlBIfpO8n:SpXv
MD5:	631CB749F4114AE8F3345D7C12ED8E5D
SHA1:	0178CFFA82CAA8301157BF314B68F807FBB97C0A
SHA-256:	83C38BEEF2E52B0DDEFFC6284A0E5D33678C290D56DD524BB19B285A2C995D1C
SHA-512:	F5E8F79DD197AEA7D3B509F5A1B3F069C50E31F29E441860BB432B7805A9B46AF0174E6F686252B2663F4131E85B1E13910318F059235A0C562C8A3262389CD6
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg"... xmlns:xlink="http://www.w3.org/1999/xlink"... viewBox="0 0 340 320">...<defs>......<g id="svg-icon-group-animations">.......<symbol id="svg-icon-animation-rotate">......<animateTransform attributeName="transform" attributeType="XML" type="rotate" dur="1s" from="0 10 10" to="360 10 10" repeatCount="indefinite"></animateTransform>.....</symbol>......</g>......<g id="svg-icon-group-social">.......<symbol id="svg-icon-email">......<g>.......<rect x="2.715" y="4" width="15" height="12"></rect>.......<polyline points="2.5 5.512 10.158 9.598 17.817 5.512"></polyline>......</g>.....</symbol>.......<symbol id="svg-icon-email-fill">......<g>.......<polygon transform="translate(9.850000, 6.625000) scale(1, -1) translate(-9.850000, -6.625000) " points="9.85 4 17.2 9.25 2.5 9.25"></polygon>.......<polygon points="2.72575 5.46079712 9.85 10.6740112 17.42575 5.12439484 17.42575 16.075 2.72575 16.075"></polygon>......</g>.....</symbol>.......<symbol id="svg-i

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/ga/rul?tid=G-WFQFFZ86BQ&gacid=1368140035.1720022653&gtm=45je4710v9117459707z8812675860za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=419836533
Preview:	<html></html>

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7973)
Category:	downloaded
Size (bytes):	273939
Entropy (8bit):	5.573249103032444
Encrypted:	false
SSDEEP:	3072:bZauEaiJ9iVVZLQOF2hf3A0OjHgvLMzU4676XDWqM0bukMr/RLm/q1n:4uE+VV9QOFG+E4qqM0qkMr/RLm/qd
MD5:	D84CB5EA137D03231141509C71EE3B93
SHA1:	BB367B7554BBCD19B8DFC10DC637E22CF9003BE6
SHA-256:	4C9BB04037AF6DC589EA5DAADDD71590D62BEEF189865341A70EFC1657801D7B
SHA-512:	91083B6035A4F4540CA0522B6ABD705558A76F600A14250372BAC60FC177BAAA9AE7D0DCF0C53A10CE7567D6C199F0E47FDF89D1CD0E6D360D86CE4A25996C79
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-WFQFFZ86BQ
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_dma","priority":12,"vtp_delegationMode":"ON","vtp_dmaDefault":"DENIED","tag_id":14},{"function":"__ogt_1p_data_v2","priority":12,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3912
Entropy (8bit):	5.438019854578364
Encrypted:	false
SSDEEP:	96:RYgL1hYgLrFZOYgLDVc+ucYgLeNROLohOL9FZOOLyVc+ucOLGNROC6hOCBFZOOCh:Wk1GkvkLwkDoEVoai6JMWD5I
MD5:	9880756908DDFC4E086321CF737E3377
SHA1:	257A48CD6306C3B3AFEB5876B467B9D4B6E54C79
SHA-256:	693B13680DFA2C3FA4A627AE1174D3925F8DD394B22144AA0123D8BD2DF813DB
SHA-512:	96C847E077022C9538B1FF59CD44E8E55A534B65A774C48CE33AAB6AA65B271A1D7CC63B8B6502788BB8E768F0626C3B619F706644CB06E32C256A452F7E33A8
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=PT+Sans:400italic,400,800,300,600,700"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'PT Sans';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/ptsans/v17/jizYRExUiTo99u79D0e0ysmIEDQ.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'PT Sans';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/ptsans/v17/jizYRExUiTo99u79D0e0w8mIEDQ.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ latin-ext /.@font-face {. font-family: 'PT Sans';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/ptsans/v17/jizYRExUiTo99u79D0e0ycmIEDQ.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {. font-family: 'PT Sans';. font-style: italic;. font-weigh

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (9287), with CRLF line terminators
Category:	downloaded
Size (bytes):	15887
Entropy (8bit):	5.329608959738054
Encrypted:	false
SSDEEP:	192:MS3ipIoKE5lEFQ2AvE8LO5y+KSVLp5hqw00tIwQKY:MS3ipIoK9Sh
MD5:	51A9B62330FB292BB8CC70E100B1D14E
SHA1:	6E59E55619224436B3FF9357370FAE632842C333
SHA-256:	EC70EE1F8B26EE32093302EE6504B3CDD408CE08DC6629618CD4DEAAEDCDBF7B
SHA-512:	30D6AE7DE92DC05DD6F51BEB65617F219EBA08C328ECD6FD1114C7C4E0D79EB7E122F05AB23BE0A2120BF3406A5C9E97B3A1F7D9A35E79DCC662E940C07B04C2
Malicious:	false
Reputation:	low
URL:	https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery
Preview:	....<!DOCTYPE html>....<html xmlns="http://www.w3.org/1999/xhtml">..<head><meta name="viewport" content="width=device-width, height=device-height, initial-scale=1.0, maximum-scale=1.0, user-scalable=0" /><title>...GERFLOR Finance Seminar..</title> Google tag (gtag.js) -->..<script async src="https://www.googletagmanager.com/gtag/js?id=G-WFQFFZ86BQ"></script>..<script>.. window.dataLayer = window.dataLayer \|\| [];.. function gtag(){dataLayer.push(arguments);}.. gtag('js', new Date());.... //gtag('config', 'G-WFQFFZ86BQ');..</script>..<script type="text/javascript">...window.dataLayer = window.dataLayer \|\| [];....... Google Tag Manager -->.......(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':.......new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],.......j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=.......'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);.......})(window,document,'script'

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	293409
Entropy (8bit):	5.0835586299317175
Encrypted:	false
SSDEEP:	6144:pMLfh6nicf8Z5wPTdpM4mDoz1EsnFyyyHh3zOxPnS8kVLkIVfzYAK6k1PC:pNw4mDiTFyA6TVfMAKNZC
MD5:	91B2F639B60598E64C3FE350ACEAAACD
SHA1:	B44C579CF3B5D7F05945B4FC79D2C034183E5F90
SHA-256:	F840A77B628BD61D5C2EE14369F47BD70F7DF23929D8A92DFF02A0938E992A92
SHA-512:	2ABF639FB3BB4ACB6C4AC592A68CB51D57E141039136E542B838E7187C1D393B03E99EA8C5DA3FC80709AB38C96D7EBA157054EF3B4BD60CAF8B9D59B1E1E316
Malicious:	false
Reputation:	low
URL:	https://pictimecloudaf-e.azureedge.net/pictures/scripts/jquery-1.12.4.modified.js?ts=10/17/2022%209:32:47%20AM
Preview:	/!. jQuery JavaScript Library v1.12.4. * http://jquery.com/. . Includes Sizzle.js. * http://sizzlejs.com/. . Copyright jQuery Foundation and other contributors. * Released under the MIT license. * http://jquery.org/license. . Date: 2016-05-20T17:17Z. */..(function( global, factory ) {...if ( typeof module === "object" && typeof module.exports === "object" ) {...// For CommonJS and CommonJS-like environments where a proper `window`...// is present, execute the factory and get jQuery....// For environments that do not have a `window` with a `document`...// (such as Node.js), expose a factory as module.exports....// This accentuates the need for the creation of a real `window`....// e.g. var jQuery = require("jquery")(window);...// See ticket #14549 for more info....module.exports = global.document ?....factory( global, true ) :....function( w ) {.....if ( !w.document ) {......throw new Error( "jQuery requires a window with a document" );.....}.....return factory( w );....};..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 18:04:02.007610083 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 3, 2024 18:04:11.210710049 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.210752964 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.210829973 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.211136103 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.211148977 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.211487055 CEST	49736	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.211498976 CEST	443	49736	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.211555958 CEST	49736	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.211771965 CEST	49736	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.211780071 CEST	443	49736	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.615947008 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 3, 2024 18:04:11.820683002 CEST	443	49736	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.820965052 CEST	49736	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.820981026 CEST	443	49736	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.822078943 CEST	443	49736	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.822158098 CEST	49736	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.823206902 CEST	49736	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.823283911 CEST	443	49736	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.823384047 CEST	49736	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.824498892 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.824676037 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.824683905 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.825555086 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.825609922 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.825928926 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.825982094 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.864501953 CEST	443	49736	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.870723963 CEST	49736	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.870738983 CEST	443	49736	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.870771885 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.870778084 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:11.917217970 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:11.917217970 CEST	49736	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:12.037992954 CEST	443	49736	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.038088083 CEST	443	49736	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.038147926 CEST	49736	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:12.038558006 CEST	49736	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:12.038574934 CEST	443	49736	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.041995049 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:12.088500023 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.442781925 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.442805052 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.442812920 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.442825079 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.442831993 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.442837954 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.442858934 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:12.442890882 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.442907095 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:12.442930937 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:12.442935944 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.442975998 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:12.443011045 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:12.457649946 CEST	49735	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:12.457665920 CEST	443	49735	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:13.836271048 CEST	49747	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:04:13.836302996 CEST	443	49747	142.250.185.196	192.168.2.4
Jul 3, 2024 18:04:13.836508989 CEST	49747	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:04:13.837826967 CEST	49747	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:04:13.837836981 CEST	443	49747	142.250.185.196	192.168.2.4
Jul 3, 2024 18:04:14.131714106 CEST	49748	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:14.131746054 CEST	443	49748	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:14.132117033 CEST	49748	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:14.133629084 CEST	49748	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:14.133644104 CEST	443	49748	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:14.476066113 CEST	443	49747	142.250.185.196	192.168.2.4
Jul 3, 2024 18:04:14.476814032 CEST	49747	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:04:14.476829052 CEST	443	49747	142.250.185.196	192.168.2.4
Jul 3, 2024 18:04:14.478039026 CEST	443	49747	142.250.185.196	192.168.2.4
Jul 3, 2024 18:04:14.478100061 CEST	49747	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:04:14.480536938 CEST	49747	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:04:14.480632067 CEST	443	49747	142.250.185.196	192.168.2.4
Jul 3, 2024 18:04:14.522828102 CEST	49747	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:04:14.522842884 CEST	443	49747	142.250.185.196	192.168.2.4
Jul 3, 2024 18:04:14.558765888 CEST	49749	443	192.168.2.4	142.250.184.206
Jul 3, 2024 18:04:14.558810949 CEST	443	49749	142.250.184.206	192.168.2.4
Jul 3, 2024 18:04:14.558984041 CEST	49749	443	192.168.2.4	142.250.184.206
Jul 3, 2024 18:04:14.559637070 CEST	49750	443	192.168.2.4	142.251.173.156
Jul 3, 2024 18:04:14.559648037 CEST	443	49750	142.251.173.156	192.168.2.4
Jul 3, 2024 18:04:14.559705019 CEST	49750	443	192.168.2.4	142.251.173.156
Jul 3, 2024 18:04:14.560233116 CEST	49749	443	192.168.2.4	142.250.184.206
Jul 3, 2024 18:04:14.560246944 CEST	443	49749	142.250.184.206	192.168.2.4
Jul 3, 2024 18:04:14.560543060 CEST	49750	443	192.168.2.4	142.251.173.156
Jul 3, 2024 18:04:14.560554981 CEST	443	49750	142.251.173.156	192.168.2.4
Jul 3, 2024 18:04:14.569724083 CEST	49747	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:04:14.618640900 CEST	49755	443	192.168.2.4	216.58.206.34
Jul 3, 2024 18:04:14.618681908 CEST	443	49755	216.58.206.34	192.168.2.4
Jul 3, 2024 18:04:14.618765116 CEST	49755	443	192.168.2.4	216.58.206.34
Jul 3, 2024 18:04:14.619251013 CEST	49755	443	192.168.2.4	216.58.206.34
Jul 3, 2024 18:04:14.619262934 CEST	443	49755	216.58.206.34	192.168.2.4
Jul 3, 2024 18:04:14.792954922 CEST	443	49748	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:14.793045044 CEST	49748	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:14.824028015 CEST	49748	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:14.824048042 CEST	443	49748	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:14.824520111 CEST	443	49748	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:14.865712881 CEST	49748	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:14.906873941 CEST	49748	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:14.952502012 CEST	443	49748	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:15.092607021 CEST	443	49748	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:15.092675924 CEST	443	49748	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:15.092742920 CEST	49748	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:15.092783928 CEST	49748	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:15.092799902 CEST	443	49748	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:15.092812061 CEST	49748	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:15.092817068 CEST	443	49748	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:15.158525944 CEST	49758	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:15.158555984 CEST	443	49758	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:15.158617020 CEST	49758	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:15.159364939 CEST	49758	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:15.159377098 CEST	443	49758	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:15.187448978 CEST	443	49750	142.251.173.156	192.168.2.4
Jul 3, 2024 18:04:15.188148975 CEST	49750	443	192.168.2.4	142.251.173.156
Jul 3, 2024 18:04:15.188182116 CEST	443	49750	142.251.173.156	192.168.2.4
Jul 3, 2024 18:04:15.189235926 CEST	443	49750	142.251.173.156	192.168.2.4
Jul 3, 2024 18:04:15.189297915 CEST	49750	443	192.168.2.4	142.251.173.156
Jul 3, 2024 18:04:15.191267014 CEST	443	49749	142.250.184.206	192.168.2.4
Jul 3, 2024 18:04:15.198179007 CEST	49749	443	192.168.2.4	142.250.184.206
Jul 3, 2024 18:04:15.198188066 CEST	443	49749	142.250.184.206	192.168.2.4
Jul 3, 2024 18:04:15.198416948 CEST	49750	443	192.168.2.4	142.251.173.156
Jul 3, 2024 18:04:15.198533058 CEST	443	49750	142.251.173.156	192.168.2.4
Jul 3, 2024 18:04:15.198632956 CEST	443	49749	142.250.184.206	192.168.2.4
Jul 3, 2024 18:04:15.198693037 CEST	49749	443	192.168.2.4	142.250.184.206
Jul 3, 2024 18:04:15.199358940 CEST	443	49749	142.250.184.206	192.168.2.4
Jul 3, 2024 18:04:15.199410915 CEST	49749	443	192.168.2.4	142.250.184.206
Jul 3, 2024 18:04:15.199497938 CEST	49750	443	192.168.2.4	142.251.173.156
Jul 3, 2024 18:04:15.199512959 CEST	443	49750	142.251.173.156	192.168.2.4
Jul 3, 2024 18:04:15.201451063 CEST	49749	443	192.168.2.4	142.250.184.206
Jul 3, 2024 18:04:15.201545000 CEST	443	49749	142.250.184.206	192.168.2.4
Jul 3, 2024 18:04:15.201931953 CEST	49749	443	192.168.2.4	142.250.184.206
Jul 3, 2024 18:04:15.201941013 CEST	443	49749	142.250.184.206	192.168.2.4
Jul 3, 2024 18:04:15.240394115 CEST	49750	443	192.168.2.4	142.251.173.156
Jul 3, 2024 18:04:15.242460012 CEST	49749	443	192.168.2.4	142.250.184.206
Jul 3, 2024 18:04:15.256380081 CEST	443	49755	216.58.206.34	192.168.2.4
Jul 3, 2024 18:04:15.257122993 CEST	49755	443	192.168.2.4	216.58.206.34
Jul 3, 2024 18:04:15.257131100 CEST	443	49755	216.58.206.34	192.168.2.4
Jul 3, 2024 18:04:15.258218050 CEST	443	49755	216.58.206.34	192.168.2.4
Jul 3, 2024 18:04:15.258272886 CEST	49755	443	192.168.2.4	216.58.206.34
Jul 3, 2024 18:04:15.260684967 CEST	49755	443	192.168.2.4	216.58.206.34
Jul 3, 2024 18:04:15.260792017 CEST	443	49755	216.58.206.34	192.168.2.4
Jul 3, 2024 18:04:15.261329889 CEST	49755	443	192.168.2.4	216.58.206.34
Jul 3, 2024 18:04:15.261337042 CEST	443	49755	216.58.206.34	192.168.2.4
Jul 3, 2024 18:04:15.304151058 CEST	49755	443	192.168.2.4	216.58.206.34
Jul 3, 2024 18:04:15.444797039 CEST	443	49750	142.251.173.156	192.168.2.4
Jul 3, 2024 18:04:15.444988966 CEST	443	49750	142.251.173.156	192.168.2.4
Jul 3, 2024 18:04:15.445038080 CEST	49750	443	192.168.2.4	142.251.173.156
Jul 3, 2024 18:04:15.458127022 CEST	49750	443	192.168.2.4	142.251.173.156
Jul 3, 2024 18:04:15.458147049 CEST	443	49750	142.251.173.156	192.168.2.4
Jul 3, 2024 18:04:15.468101025 CEST	443	49749	142.250.184.206	192.168.2.4
Jul 3, 2024 18:04:15.469213963 CEST	443	49749	142.250.184.206	192.168.2.4
Jul 3, 2024 18:04:15.469260931 CEST	49749	443	192.168.2.4	142.250.184.206
Jul 3, 2024 18:04:15.474831104 CEST	49749	443	192.168.2.4	142.250.184.206
Jul 3, 2024 18:04:15.474839926 CEST	443	49749	142.250.184.206	192.168.2.4
Jul 3, 2024 18:04:15.536911011 CEST	443	49755	216.58.206.34	192.168.2.4
Jul 3, 2024 18:04:15.537053108 CEST	443	49755	216.58.206.34	192.168.2.4
Jul 3, 2024 18:04:15.537100077 CEST	49755	443	192.168.2.4	216.58.206.34
Jul 3, 2024 18:04:15.538096905 CEST	49755	443	192.168.2.4	216.58.206.34
Jul 3, 2024 18:04:15.538106918 CEST	443	49755	216.58.206.34	192.168.2.4
Jul 3, 2024 18:04:15.824774981 CEST	443	49758	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:15.824841976 CEST	49758	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:15.826370001 CEST	49758	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:15.826376915 CEST	443	49758	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:15.826679945 CEST	443	49758	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:15.827927113 CEST	49758	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:15.868495941 CEST	443	49758	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:16.120073080 CEST	443	49758	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:16.120146036 CEST	443	49758	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:16.120244026 CEST	49758	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:16.122725010 CEST	49758	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:16.122739077 CEST	443	49758	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:16.122786999 CEST	49758	443	192.168.2.4	184.28.90.27
Jul 3, 2024 18:04:16.122792959 CEST	443	49758	184.28.90.27	192.168.2.4
Jul 3, 2024 18:04:17.925896883 CEST	49766	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:17.925945044 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:17.926012039 CEST	49766	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:17.926292896 CEST	49766	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:17.926302910 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.581929922 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.625134945 CEST	49766	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:18.781411886 CEST	49766	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:18.781452894 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.781945944 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.782849073 CEST	49766	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:18.782927990 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.813456059 CEST	49766	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:18.860498905 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.920003891 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.920032024 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.920042038 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.920059919 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.920068979 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.920073032 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.920097113 CEST	49766	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:18.920118093 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.920139074 CEST	49766	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:18.920161963 CEST	49766	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:18.920593023 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.920663118 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:18.920706987 CEST	49766	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:18.925374031 CEST	49766	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:18.925394058 CEST	443	49766	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.077405930 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.077450991 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.077516079 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.077794075 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.077804089 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.648834944 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.649224043 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.649238110 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.650333881 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.650394917 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.650857925 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.650933027 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.651040077 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.651046991 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.698213100 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.761694908 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.761714935 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.761723042 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.761758089 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.761782885 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.761816978 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.761816978 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.761832952 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:19.761862040 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.761919975 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.763411999 CEST	49769	443	192.168.2.4	52.191.249.70
Jul 3, 2024 18:04:19.763427019 CEST	443	49769	52.191.249.70	192.168.2.4
Jul 3, 2024 18:04:24.377677917 CEST	443	49747	142.250.185.196	192.168.2.4
Jul 3, 2024 18:04:24.377737045 CEST	443	49747	142.250.185.196	192.168.2.4
Jul 3, 2024 18:04:24.377933025 CEST	49747	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:04:26.317038059 CEST	49747	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:04:26.317084074 CEST	443	49747	142.250.185.196	192.168.2.4
Jul 3, 2024 18:04:29.330766916 CEST	49723	80	192.168.2.4	199.232.214.172
Jul 3, 2024 18:04:29.335999966 CEST	80	49723	199.232.214.172	192.168.2.4
Jul 3, 2024 18:04:29.336169004 CEST	49723	80	192.168.2.4	199.232.214.172
Jul 3, 2024 18:05:13.976445913 CEST	49781	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:05:13.976516962 CEST	443	49781	142.250.185.196	192.168.2.4
Jul 3, 2024 18:05:13.976783991 CEST	49781	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:05:13.978032112 CEST	49781	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:05:13.978049994 CEST	443	49781	142.250.185.196	192.168.2.4
Jul 3, 2024 18:05:14.663945913 CEST	443	49781	142.250.185.196	192.168.2.4
Jul 3, 2024 18:05:14.665761948 CEST	49781	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:05:14.665807009 CEST	443	49781	142.250.185.196	192.168.2.4
Jul 3, 2024 18:05:14.666181087 CEST	443	49781	142.250.185.196	192.168.2.4
Jul 3, 2024 18:05:14.667501926 CEST	49781	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:05:14.667573929 CEST	443	49781	142.250.185.196	192.168.2.4
Jul 3, 2024 18:05:14.711253881 CEST	49781	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:05:17.976843119 CEST	49724	80	192.168.2.4	199.232.214.172
Jul 3, 2024 18:05:17.984124899 CEST	80	49724	199.232.214.172	192.168.2.4
Jul 3, 2024 18:05:17.984299898 CEST	49724	80	192.168.2.4	199.232.214.172
Jul 3, 2024 18:05:24.564982891 CEST	443	49781	142.250.185.196	192.168.2.4
Jul 3, 2024 18:05:24.565058947 CEST	443	49781	142.250.185.196	192.168.2.4
Jul 3, 2024 18:05:24.565104008 CEST	49781	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:05:25.885426998 CEST	49781	443	192.168.2.4	142.250.185.196
Jul 3, 2024 18:05:25.885469913 CEST	443	49781	142.250.185.196	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 18:04:09.978539944 CEST	53	52621	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:09.979598999 CEST	53	55745	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:10.982187986 CEST	53	53603	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:11.184753895 CEST	49825	53	192.168.2.4	1.1.1.1
Jul 3, 2024 18:04:11.184912920 CEST	57740	53	192.168.2.4	1.1.1.1
Jul 3, 2024 18:04:11.205075026 CEST	53	49825	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:11.206490040 CEST	53	57740	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:12.490587950 CEST	53	61395	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:13.771174908 CEST	49295	53	192.168.2.4	1.1.1.1
Jul 3, 2024 18:04:13.771797895 CEST	60780	53	192.168.2.4	1.1.1.1
Jul 3, 2024 18:04:13.781090975 CEST	53	49295	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:13.781882048 CEST	53	60780	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:14.543575048 CEST	63322	53	192.168.2.4	1.1.1.1
Jul 3, 2024 18:04:14.548708916 CEST	54906	53	192.168.2.4	1.1.1.1
Jul 3, 2024 18:04:14.550421000 CEST	63208	53	192.168.2.4	1.1.1.1
Jul 3, 2024 18:04:14.550811052 CEST	51759	53	192.168.2.4	1.1.1.1
Jul 3, 2024 18:04:14.555219889 CEST	53	63322	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:14.557822943 CEST	53	54906	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:14.558038950 CEST	53	51759	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:14.558444977 CEST	53	63208	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:14.607342958 CEST	64104	53	192.168.2.4	1.1.1.1
Jul 3, 2024 18:04:14.607676983 CEST	50957	53	192.168.2.4	1.1.1.1
Jul 3, 2024 18:04:14.614442110 CEST	53	64104	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:14.615273952 CEST	53	50957	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:16.034025908 CEST	53	53952	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:17.398704052 CEST	53	54978	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:19.017998934 CEST	56680	53	192.168.2.4	1.1.1.1
Jul 3, 2024 18:04:19.018254042 CEST	53991	53	192.168.2.4	1.1.1.1
Jul 3, 2024 18:04:19.038156986 CEST	53	53991	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:19.039407969 CEST	53	56680	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:28.792651892 CEST	53	55724	1.1.1.1	192.168.2.4
Jul 3, 2024 18:04:29.549653053 CEST	138	138	192.168.2.4	192.168.2.255
Jul 3, 2024 18:04:47.759190083 CEST	53	57897	1.1.1.1	192.168.2.4
Jul 3, 2024 18:05:09.313065052 CEST	53	53286	1.1.1.1	192.168.2.4
Jul 3, 2024 18:05:10.300401926 CEST	53	63701	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 3, 2024 18:04:14.635844946 CEST	192.168.2.4	1.1.1.1	c274	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 18:04:11.184753895 CEST	192.168.2.4	1.1.1.1	0x5e5b	Standard query (0)	fannyvanphoto.pic-time.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:11.184912920 CEST	192.168.2.4	1.1.1.1	0xf413	Standard query (0)	fannyvanphoto.pic-time.com	65	IN (0x0001)	false
Jul 3, 2024 18:04:13.771174908 CEST	192.168.2.4	1.1.1.1	0x6eea	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:13.771797895 CEST	192.168.2.4	1.1.1.1	0x9255	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 3, 2024 18:04:14.543575048 CEST	192.168.2.4	1.1.1.1	0x93a6	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:14.548708916 CEST	192.168.2.4	1.1.1.1	0xe44e	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Jul 3, 2024 18:04:14.550421000 CEST	192.168.2.4	1.1.1.1	0x2f4b	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:14.550811052 CEST	192.168.2.4	1.1.1.1	0x32f3	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Jul 3, 2024 18:04:14.607342958 CEST	192.168.2.4	1.1.1.1	0x9868	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:14.607676983 CEST	192.168.2.4	1.1.1.1	0xa352	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Jul 3, 2024 18:04:19.017998934 CEST	192.168.2.4	1.1.1.1	0xb4b	Standard query (0)	fannyvanphoto.pic-time.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:19.018254042 CEST	192.168.2.4	1.1.1.1	0x6175	Standard query (0)	fannyvanphoto.pic-time.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 18:04:11.205075026 CEST	1.1.1.1	192.168.2.4	0x5e5b	No error (0)	fannyvanphoto.pic-time.com		52.191.249.70	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:13.781090975 CEST	1.1.1.1	192.168.2.4	0x6eea	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:13.781882048 CEST	1.1.1.1	192.168.2.4	0x9255	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 3, 2024 18:04:14.555219889 CEST	1.1.1.1	192.168.2.4	0x93a6	No error (0)	analytics.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:14.557822943 CEST	1.1.1.1	192.168.2.4	0xe44e	No error (0)	analytics.google.com	analytics-alv.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 18:04:14.558444977 CEST	1.1.1.1	192.168.2.4	0x2f4b	No error (0)	stats.g.doubleclick.net		142.251.173.156	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:14.558444977 CEST	1.1.1.1	192.168.2.4	0x2f4b	No error (0)	stats.g.doubleclick.net		142.251.173.155	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:14.558444977 CEST	1.1.1.1	192.168.2.4	0x2f4b	No error (0)	stats.g.doubleclick.net		142.251.173.157	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:14.558444977 CEST	1.1.1.1	192.168.2.4	0x2f4b	No error (0)	stats.g.doubleclick.net		142.251.173.154	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:14.614442110 CEST	1.1.1.1	192.168.2.4	0x9868	No error (0)	td.doubleclick.net		216.58.206.34	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:19.039407969 CEST	1.1.1.1	192.168.2.4	0xb4b	No error (0)	fannyvanphoto.pic-time.com		52.191.249.70	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:27.478307962 CEST	1.1.1.1	192.168.2.4	0x76	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 18:04:27.478307962 CEST	1.1.1.1	192.168.2.4	0x76	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:04:43.893770933 CEST	1.1.1.1	192.168.2.4	0x428a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 18:04:43.893770933 CEST	1.1.1.1	192.168.2.4	0x428a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:05:02.881547928 CEST	1.1.1.1	192.168.2.4	0xb931	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 18:05:02.881547928 CEST	1.1.1.1	192.168.2.4	0xb931	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:05:22.472924948 CEST	1.1.1.1	192.168.2.4	0x435b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 18:05:22.472924948 CEST	1.1.1.1	192.168.2.4	0x435b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fannyvanphoto.pic-time.com

https:

stats.g.doubleclick.net

analytics.google.com

td.doubleclick.net

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	52.191.249.70	443	4828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 16:04:11 UTC	699	OUT	GET /-gerflorfinanceseminar/gallery HTTP/1.1 Host: fannyvanphoto.pic-time.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 16:04:12 UTC	638	IN	HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: /-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery Origin-Agent-Cluster: ?0 Content-Security-Policy: frame-ancestors .pic-time.com .facebook.com X-Content-Security-Policy: frame-ancestors .pic-time.com .facebook.com X-WebKit-CSP: frame-ancestors .pic-time.com .facebook.com Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Strict-Transport-Security: max-age=31536000 Date: Wed, 03 Jul 2024 16:04:11 GMT Connection: close Content-Length: 201
2024-07-03 16:04:12 UTC	201	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 2d 67 65 72 66 6c 6f 72 66 69 6e 61 6e 63 65 73 65 6d 69 6e 61 72 2f 6c 6f 67 69 6e 3f 26 61 6d 70 3b 72 65 64 69 72 65 63 74 5f 62 61 63 6b 3d 25 32 66 2d 67 65 72 66 6c 6f 72 66 69 6e 61 6e 63 65 73 65 6d 69 6e 61 72 25 32 66 67 61 6c 6c 65 72 79 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	52.191.249.70	443	4828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 16:04:12 UTC	748	OUT	GET /-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery HTTP/1.1 Host: fannyvanphoto.pic-time.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 16:04:12 UTC	545	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Origin-Agent-Cluster: ?0 Content-Security-Policy: frame-ancestors .pic-time.com .facebook.com X-Content-Security-Policy: frame-ancestors .pic-time.com .facebook.com X-WebKit-CSP: frame-ancestors .pic-time.com .facebook.com Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Strict-Transport-Security: max-age=31536000 Date: Wed, 03 Jul 2024 16:04:12 GMT Connection: close Content-Length: 15887
2024-07-03 16:04:12 UTC	15839	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 68 65 69 67 68 74 3d 64 65 76 69 63 65 2d 68 65 69 67 68 74 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 20 2f 3e 3c 74 69 74 6c 65 3e 0d 0a 09 47 45 52 46 4c 4f 52 20 46 69 6e 61 6e 63 65 20 53 65 6d 69 6e 61 72 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 21 2d 2d 20 47 6f 6f Data Ascii: <!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"><head><meta name="viewport" content="width=device-width, height=device-height, initial-scale=1.0, maximum-scale=1.0, user-scalable=0" /><title>GERFLOR Finance Seminar</title>... Goo
2024-07-03 16:04:12 UTC	48	IN	Data Raw: 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 2f 66 6f 72 6d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: </script> </form></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49748	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 16:04:14 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-03 16:04:15 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=86690 Date: Wed, 03 Jul 2024 16:04:14 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49750	142.251.173.156	443	4828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 16:04:15 UTC	828	OUT	POST /g/collect?v=2&tid=G-WFQFFZ86BQ&cid=1368140035.1720022653&gtm=45je4710v9117459707z8812675860za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&frm=0 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://fannyvanphoto.pic-time.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://fannyvanphoto.pic-time.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 16:04:15 UTC	460	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://fannyvanphoto.pic-time.com Date: Wed, 03 Jul 2024 16:04:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49749	142.250.184.206	443	4828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 16:04:15 UTC	1308	OUT	POST /g/collect?v=2&tid=G-WFQFFZ86BQ&gtm=45je4710v9117459707z8812675860za200&_p=1720022651366&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1368140035.1720022653&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1720022653&sct=1&seg=0&dl=https%3A%2F%2Ffannyvanphoto.pic-time.com%2F-gerflorfinanceseminar%2Flogin%3F%26redirect_back%3D%252f-gerflorfinanceseminar%252fgallery&dt=GERFLOR%20Finance%20Seminar&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=3351&_z=fetch HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://fannyvanphoto.pic-time.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://fannyvanphoto.pic-time.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 16:04:15 UTC	460	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://fannyvanphoto.pic-time.com Date: Wed, 03 Jul 2024 16:04:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49755	216.58.206.34	443	4828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 16:04:15 UTC	954	OUT	GET /td/ga/rul?tid=G-WFQFFZ86BQ&gacid=1368140035.1720022653&gtm=45je4710v9117459707z8812675860za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=419836533 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://fannyvanphoto.pic-time.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 16:04:15 UTC	785	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Wed, 03 Jul 2024 16:04:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Wed, 03-Jul-2024 16:19:15 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-03 16:04:15 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-07-03 16:04:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49758	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 16:04:15 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-03 16:04:16 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=86698 Date: Wed, 03 Jul 2024 16:04:16 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-03 16:04:16 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49766	52.191.249.70	443	4828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 16:04:18 UTC	818	OUT	GET /favicon.ico HTTP/1.1 Host: fannyvanphoto.pic-time.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _gcl_au=1.1.2102428525.1720022653; _ga_WFQFFZ86BQ=GS1.1.1720022653.1.0.1720022653.60.0.0; _ga=GA1.1.1368140035.1720022653
2024-07-03 16:04:18 UTC	369	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Last-Modified: Thu, 18 Apr 2024 08:19:25 GMT Accept-Ranges: bytes ETag: "c667206991da1:0" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Strict-Transport-Security: max-age=31536000 Date: Wed, 03 Jul 2024 16:04:18 GMT Connection: close Content-Length: 15086
2024-07-03 16:04:18 UTC	15086	IN	Data Raw: 00 00 01 00 03 00 10 10 00 00 01 00 20 00 68 04 00 00 36 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 9e 04 00 00 30 30 00 00 01 00 20 00 a8 25 00 00 46 15 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: h6 00 %F( @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49769	52.191.249.70	443	4828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 16:04:19 UTC	492	OUT	GET /favicon.ico HTTP/1.1 Host: fannyvanphoto.pic-time.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _gcl_au=1.1.2102428525.1720022653; _ga_WFQFFZ86BQ=GS1.1.1720022653.1.0.1720022653.60.0.0; _ga=GA1.1.1368140035.1720022653
2024-07-03 16:04:19 UTC	369	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Last-Modified: Thu, 18 Apr 2024 08:19:25 GMT Accept-Ranges: bytes ETag: "c667206991da1:0" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Strict-Transport-Security: max-age=31536000 Date: Wed, 03 Jul 2024 16:04:19 GMT Connection: close Content-Length: 15086
2024-07-03 16:04:19 UTC	15086	IN	Data Raw: 00 00 01 00 03 00 10 10 00 00 01 00 20 00 68 04 00 00 36 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 9e 04 00 00 30 30 00 00 01 00 20 00 a8 25 00 00 46 15 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: h6 00 %F( @

Target ID:	0
Start time:	12:04:04
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	12:04:07
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=1888,i,7521391653640884176,2490811317560230940,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	12:04:10
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/gallery"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-WFQFFZ86BQ&gacid=1368140035.1720022653&gtm=45je4710v9117459707z8812675860za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=419836533
Source: https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-WFQFFZ86BQ&gacid=1368140035.1720022653&gtm=45je4710v9117459707z8812675860za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=419836533
Source: https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-WFQFFZ86BQ&gacid=1368140035.1720022653&gtm=45je4710v9117459707z8812675860za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=419836533

Source: https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery	HTTP Parser: No favicon
Source: https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery	HTTP Parser: No favicon
Source: https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery	HTTP Parser: No favicon

Source: https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery	HTTP Parser: No <meta name="copyright".. found
Source: https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery	HTTP Parser: No <meta name="copyright".. found
Source: https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery	HTTP Parser: No <meta name="copyright".. found

Source: global traffic	HTTP traffic detected: GET /-gerflorfinanceseminar/gallery HTTP/1.1Host: fannyvanphoto.pic-time.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgallery HTTP/1.1Host: fannyvanphoto.pic-time.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/ga/rul?tid=G-WFQFFZ86BQ&gacid=1368140035.1720022653&gtm=45je4710v9117459707z8812675860za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=419836533 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://fannyvanphoto.pic-time.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: fannyvanphoto.pic-time.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/login?&redirect_back=%2f-gerflorfinanceseminar%2fgalleryAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.2102428525.1720022653; _ga_WFQFFZ86BQ=GS1.1.1720022653.1.0.1720022653.60.0.0; _ga=GA1.1.1368140035.1720022653
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: fannyvanphoto.pic-time.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.2102428525.1720022653; _ga_WFQFFZ86BQ=GS1.1.1720022653.1.0.1720022653.60.0.0; _ga=GA1.1.1368140035.1720022653

Source: global traffic	DNS traffic detected: DNS query: fannyvanphoto.pic-time.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_73.2.dr, chromecache_78.2.dr	String found in binary or memory: os","youTube":"Youtube","vimeo":"Vimeo","noTranslation":{"youtubeVideoTemplate":"https://www.youtube.com/embed/{0}","vimeoVideoTemplate":"https://player.vimeo.com/video/{0}?h={1}&autoplay=0&badge=0&byline=0","animotoVideoTemplate":"https://s3.amazonaws.com/embed.animoto.com/play.html?f={0}&start_res=720p"},"uploadFrom":"De","finish":"Terminer","copyYouTube":"Copiez le lien \"Partager cette vid equals www.youtube.com (Youtube)
Source: chromecache_66.2.dr	String found in binary or memory: paymentRegisterUrl:"/!payform?userName={username}&addressLine1={addressLine1}&addressLine2={addressLine2}&city={city}&zip={zip}&state={state}&country={country}&phone={phone}",payment2RegisterUrl:"/!payform2?userName={username}&addressLine1={addressLine1}&addressLine2={addressLine2}&city={city}&zip={zip}&state={state}&country={country}&phone={phone}",youtubeThumb:"//img.youtube.com/vi/[youtubeId]/0.jpg",youtubeEmbed:"//www.youtube.com/embed/[youtubeId]?autoplay=1",vimeoEmbed:"//player.vimeo.com/video/[vimeoId]?h=[vimeoSecurity]&autoplay=1&badge=0&byline=0", equals www.youtube.com (Youtube)
Source: chromecache_84.2.dr, chromecache_75.2.dr	String found in binary or memory: return b}BC.J="internal.enableAutoEventOnTimer";var jc=ka(["data-gtm-yt-inspected-"]),DC=["www.youtube.com","www.youtube-nocookie.com"],EC,FC=!1; equals www.youtube.com (Youtube)

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/gallery

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
https://fannyvanphoto.pic-time.com/-gerflorfinanceseminar/gallery