Edit tour

Windows Analysis Report
https://metaioseklcogin.webflow.io/

Overview

General Information

Sample URL:	https://metaioseklcogin.webflow.io/
Analysis ID:	1467874
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2296,i,4188136114675171219,13452510514202242541,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://metaioseklcogin.webflow.io/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://metaioseklcogin.webflow.io/	Avira URL Cloud: detection malicious, Label: malware
Source: https://metaioseklcogin.webflow.io/	SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://flesterwisors.com/a84e76ff-85b6-4efe-95ff-70294deaf642

Avira URL Cloud: Label: malware

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: metaioseklcogin.webflow.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.5.1.min.dc5e7f18c8.js?site=658cec990fe960c2d842cbdb HTTP/1.1Host: d3e54v103j8qbb.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://metaioseklcogin.webflow.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://metaioseklcogin.webflow.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /658cec990fe960c2d842cbdb/css/metaioseklcogin.webflow.5e22c9479.css HTTP/1.1Host: assets-global.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://metaioseklcogin.webflow.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /658cec990fe960c2d842cbdb/js/webflow.235cb1a9b.js HTTP/1.1Host: assets-global.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://metaioseklcogin.webflow.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /658cec990fe960c2d842cbdb/658ced94adc727c27bb15f04_MetaMask_Fox.svg.png HTTP/1.1Host: assets-global.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://metaioseklcogin.webflow.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /658cec990fe960c2d842cbdb/658cecd186303d8f3a24cfe1_metamas-banner_.jpg HTTP/1.1Host: assets-global.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://metaioseklcogin.webflow.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /658cec990fe960c2d842cbdb/658ced94adc727c27bb15f04_MetaMask_Fox.svg.png HTTP/1.1Host: assets-global.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /658cec990fe960c2d842cbdb/658cecd186303d8f3a24cfe1_metamas-banner_.jpg HTTP/1.1Host: assets-global.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: metaioseklcogin.webflow.io
Source: global traffic	DNS traffic detected: DNS query: assets-global.website-files.com
Source: global traffic	DNS traffic detected: DNS query: d3e54v103j8qbb.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: flesterwisors.com
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: chromecache_47.2.dr	String found in binary or memory: https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658cecd186303d8f3a24cfe1_metamas-ba
Source: chromecache_47.2.dr	String found in binary or memory: https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658ced94adc727c27bb15f04_MetaMask_F
Source: chromecache_47.2.dr	String found in binary or memory: https://assets-global.website-files.com/658cec990fe960c2d842cbdb/css/metaioseklcogin.webflow.5e22c94
Source: chromecache_47.2.dr	String found in binary or memory: https://assets-global.website-files.com/img/webclip.png
Source: chromecache_47.2.dr	String found in binary or memory: https://flesterwisors.com/a84e76ff-85b6-4efe-95ff-70294deaf642
Source: chromecache_47.2.dr	String found in binary or memory: https://webflow.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: classification engine

Classification label: mal56.win@21/14@25/8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2296,i,4188136114675171219,13452510514202242541,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://metaioseklcogin.webflow.io/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2296,i,4188136114675171219,13452510514202242541,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://metaioseklcogin.webflow.io/	100%	Avira URL Cloud	malware
https://metaioseklcogin.webflow.io/	100%	SlashNext	Fraudulent Website type: Phishing & Social Engineering

URLs

Source	Detection	Scanner	Label
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/css/metaioseklcogin.webflow.5e22c94	0%	Avira URL Cloud	safe
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658cecd186303d8f3a24cfe1_metamas-banner_.jpg	0%	Avira URL Cloud	safe
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658ced94adc727c27bb15f04_MetaMask_F	0%	Avira URL Cloud	safe
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658cecd186303d8f3a24cfe1_metamas-ba	0%	Avira URL Cloud	safe
https://flesterwisors.com/a84e76ff-85b6-4efe-95ff-70294deaf642	100%	Avira URL Cloud	malware
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658ced94adc727c27bb15f04_MetaMask_Fox.svg.png	0%	Avira URL Cloud	safe
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/css/metaioseklcogin.webflow.5e22c9479.css	0%	Avira URL Cloud	safe
https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=658cec990fe960c2d842cbdb	0%	Avira URL Cloud	safe
https://assets-global.website-files.com/img/webclip.png	0%	Avira URL Cloud	safe
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/js/webflow.235cb1a9b.js	0%	Avira URL Cloud	safe
https://webflow.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d3e54v103j8qbb.cloudfront.net	52.222.232.99	true	false	unknown
webflow-io.map.fastly.net	151.101.2.188	true	false	unknown
google.com	142.250.184.238	true	false	unknown
d3vmvmej3wjbxn.cloudfront.net	18.245.162.13	true	false	unknown
www.google.com	142.250.185.196	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
windowsupdatebg.s.llnwi.net	87.248.205.0	true	false	unknown
assets-global.website-files.com	unknown	unknown	false	unknown
flesterwisors.com	unknown	unknown	false	unknown
metaioseklcogin.webflow.io	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=658cec990fe960c2d842cbdb	false	Avira URL Cloud: safe	unknown
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/js/webflow.235cb1a9b.js	false	Avira URL Cloud: safe	unknown
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/css/metaioseklcogin.webflow.5e22c9479.css	false	Avira URL Cloud: safe	unknown
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658ced94adc727c27bb15f04_MetaMask_Fox.svg.png	false	Avira URL Cloud: safe	unknown
https://metaioseklcogin.webflow.io/	true		unknown
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658cecd186303d8f3a24cfe1_metamas-banner_.jpg	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://assets-global.website-files.com/img/webclip.png	chromecache_47.2.dr	false	Avira URL Cloud: safe	unknown
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658cecd186303d8f3a24cfe1_metamas-ba	chromecache_47.2.dr	false	Avira URL Cloud: safe	unknown
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/css/metaioseklcogin.webflow.5e22c94	chromecache_47.2.dr	false	Avira URL Cloud: safe	unknown
https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658ced94adc727c27bb15f04_MetaMask_F	chromecache_47.2.dr	false	Avira URL Cloud: safe	unknown
https://flesterwisors.com/a84e76ff-85b6-4efe-95ff-70294deaf642	chromecache_47.2.dr	false	Avira URL Cloud: malware	unknown
https://webflow.com	chromecache_47.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.239.69.126	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.2.188	webflow-io.map.fastly.net	United States	54113	FASTLYUS	false
18.245.162.13	d3vmvmej3wjbxn.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
52.222.232.99	d3e54v103j8qbb.cloudfront.net	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.4
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467874
Start date and time:	2024-07-05 00:19:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://metaioseklcogin.webflow.io/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@21/14@25/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://flesterwisors.com/a84e76ff-85b6-4efe-95ff-70294deaf642

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.18.110, 142.250.110.84, 142.250.185.163, 34.104.35.123, 40.127.169.103, 87.248.205.0, 192.229.221.95, 52.165.164.15, 13.95.31.18, 142.250.184.227
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://metaioseklcogin.webflow.io/

LLM Input / Output

Input	Output
URL: https://metaioseklcogin.webflow.io/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "urgency": false, "captcha": false, "reasons": [ "The webpage does not contain a login form requesting sensitive information such as passwords, email addresses, usernames, phone numbers or credit card numbers.", "The text does not create a sense of urgency or interest by using phrases like 'Click here to view document', 'To view secured document click here', or 'Open the link to see your invoice'.", "The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism." ]}
Title: Meta % - A Gateway to Secure and User:Meta OCR: Metamas@ Ecin% - A Gateway to Secure and MetaMask is a popular crypturrency wallet and browser extension that allows users to manage their Ethereum-based assets and interact with applications (DApps) on the Ethereum blockchain. In this comprehensive guide, we will walk you through the process of setting up and logging into MetaMask, exploring its key features, and ensuring a secure and smooth user experience. Introduction to MetaMask: MetaMask is a digital wallet that enables users to manage their Ethereum-based assets and access decentralized applications directly from their web browsers. It serves as a bridge between traditional web browsers and the Ethereum blcckchain, providing a seamless and user-friendly interface for interacting with decentralized technologies. Setting Up MetaMask: Before logging into MetaMask, you nd to set up an account. Follow these steps to get startai: 1. Install the MetaMask Extension: 2. MetaMask is available as a browser extension for popular web browsers like Chrome, Firefox, Brave, and Edge. Visit the extension store for your chosen browser and install MetaMask. 3. Create a New Wallet: 4. Once installed, click on the MetaMask icon in your browser tcn)lbar. 5. Chcn)se the option to create a new wallet. 6. Set a strong password for your wallet. Ensure it is unique and not easily guessable. 7. Backup Vour Seed Phrase: 8. After creating your wallet, MetaMask still provide you with a seed phrase. This is a crucial backup that can used to restore your wallet if you forget your password or lose access. 9. Write down the sd phrase on paper and store it in a safe place. Never share it with anyone. 10. Confirm Vour Seed Phrase: 11. MetaMask will ask you to confirm your seed phrase by selecting the nords in the order. This step ensures that you've written down the seed phrase accurately. gging into MetaMask: Now that your MetaMask wallet is set up, let's explore the process of logging in: 1. Open MetaMask: 2. Click on the MetaMask icon in your browser to open the extension. 3. Enter Vour Pass"ord: 4. Input the password you created during the wallet setup process. 5. Accessing Vour Wallet: 6. Upon successful login, you vill be directai to the MetaMask dashboard. Here, you can view your wallet balance, recent transactions, and manage your Ethereum-based assets. Key Features of MetaMask: 1. Wallet Management: 2. MetaMask allows you to send and recei& Ethereum and other supported tokens. 3. You can view your transaction history, including details such as date, amount, and transaction status. 4. Browser Integration: 5. MetaMask seamlessly integrates with your web browser, enabling you to interact with applications (DApps) directly. 6. Token Swapping: 7. MetaMask provides a built-in feature for swapping tokens, allowing you to easily exchange one cryptocurrency for another. 8. Custom Nemorks: 9. You can connect MetaMask to various Ethereum networks, including the mainnet, testnets, and custom networks.

Input

Output

URL: https://metaioseklcogin.webflow.io/ Model: Perplexity: mixtral-8x7b-instruct

{  "loginform": false,  "urgency": false,  "captcha": false,  "reasons": [    "The webpage does not contain a login form requesting sensitive information such as passwords, email addresses, usernames, phone numbers or credit card numbers.",    "The text does not create a sense of urgency or interest by using phrases like 'Click here to view document', 'To view secured document click here', or 'Open the link to see your invoice'.",    "The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."  ]}

Title: Meta % - A Gateway to Secure and User:Meta OCR: Metamas@ Ecin% - A Gateway to Secure and MetaMask is a popular crypturrency wallet and browser extension that allows users to manage their Ethereum-based assets and interact with applications (DApps) on the Ethereum blockchain. In this comprehensive guide, we will walk you through the process of setting up and logging into MetaMask, exploring its key features, and ensuring a secure and smooth user experience. Introduction to MetaMask: MetaMask is a digital wallet that enables users to manage their Ethereum-based assets and access decentralized applications directly from their web browsers. It serves as a bridge between traditional web browsers and the Ethereum blcckchain, providing a seamless and user-friendly interface for interacting with decentralized technologies. Setting Up MetaMask: Before logging into MetaMask, you nd to set up an account. Follow these steps to get startai: 1. Install the MetaMask Extension: 2. MetaMask is available as a browser extension for popular web browsers like Chrome, Firefox, Brave, and Edge. Visit the extension store for your chosen browser and install MetaMask. 3. Create a New Wallet: 4. Once installed, click on the MetaMask icon in your browser tcn)lbar. 5. Chcn)se the option to create a new wallet. 6. Set a strong password for your wallet. Ensure it is unique and not easily guessable. 7. Backup Vour Seed Phrase: 8. After creating your wallet, MetaMask still provide you with a seed phrase. This is a crucial backup that can used to restore your wallet if you forget your password or lose access. 9. Write down the sd phrase on paper and store it in a safe place. Never share it with anyone. 10. Confirm Vour Seed Phrase: 11. MetaMask will ask you to confirm your seed phrase by selecting the nords in the order. This step ensures that you've written down the seed phrase accurately. gging into MetaMask: Now that your MetaMask wallet is set up, let's explore the process of logging in: 1. Open MetaMask: 2. Click on the MetaMask icon in your browser to open the extension. 3. Enter Vour Pass"ord: 4. Input the password you created during the wallet setup process. 5. Accessing Vour Wallet: 6. Upon successful login, you vill be directai to the MetaMask dashboard. Here, you can view your wallet balance, recent transactions, and manage your Ethereum-based assets. Key Features of MetaMask: 1. Wallet Management: 2. MetaMask allows you to send and recei& Ethereum and other supported tokens. 3. You can view your transaction history, including details such as date, amount, and transaction status. 4. Browser Integration: 5. MetaMask seamlessly integrates with your web browser, enabling you to interact with applications (DApps) directly. 6. Token Swapping: 7. MetaMask provides a built-in feature for swapping tokens, allowing you to easily exchange one cryptocurrency for another. 8. Custom Nemorks: 9. You can connect MetaMask to various Ethereum networks, including the mainnet, testnets, and custom networks.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (8861), with no line terminators
Category:	downloaded
Size (bytes):	9025
Entropy (8bit):	5.118402664657652
Encrypted:	false
SSDEEP:	192:ScjZjejvU4c/+qKsRIBmfBSaspVZ7u4IpXlIBmfzdpbu5rrb:SctKGt2BmfBSXpVZapXiBmfz/u5rX
MD5:	B3F5977E57ECBCC11C91B73B3AB3A8F4
SHA1:	E0848AAA025FF89CC8928F9B81AD11EFC2C3F499
SHA-256:	FB027223BA6A6AB3DC7FFA93BA17BFC265380E2F2E0AAE8E6BEA8D657DD2C09C
SHA-512:	62803070BAB79E86272A05DA68A0B15F5496D7263251B5F8B009E1790ECD58D124B38C894A5F113DE4E3B5C94D480DE4A62887394A1851D4074041070ACE04D5
Malicious:	false
Reputation:	low
URL:	https://metaioseklcogin.webflow.io/
Preview:	<!DOCTYPE html> This site was created in Webflow. https://webflow.com --> Last Published: Thu Dec 28 2023 03:38:03 GMT+0000 (Coordinated Universal Time) --><html data-wf-domain="metaioseklcogin.webflow.io" data-wf-page="658cec990fe960c2d842cbdf" data-wf-site="658cec990fe960c2d842cbdb"><head><meta charset="utf-8"/><title>Meta......... ..........% - A Gateway to Secure and User:Meta.........</title><meta content="MetaMask provides a user-friendly gateway to the world of decentralized finance and applications. By following the steps outlined in this guide and adhering to security best" name="description"/><meta content="Meta......... ..........% - A Gateway to Secure and User:Meta........." property="og:title"/><meta content="MetaMask provides a user-friendly gateway to the world of decentralized finance and applications. By following the steps outlined in this guide and adhering to security best" property="og:description"/><

Chrome Cache Entry: 48

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
Reputation:	low
URL:	https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=658cec990fe960c2d842cbdb
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

Chrome Cache Entry: 49

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1755
Entropy (8bit):	7.789203921183075
Encrypted:	false
SSDEEP:	48:zJEqY7IB0zOCVpZ+gR2X0THRG8VHD3GtQ15BhD:NYw0CCdWXOzstQ1jhD
MD5:	E0675D3650A072904DA930DC2FC9C729
SHA1:	2EEEAEE36B691A2D82A0BE4C2241D586E9DD1EA1
SHA-256:	C89D9A9EE775399F793D9259AB16B2D8D6776776DFF60C15D2FD203EA378E738
SHA-512:	EDE34114AA7F6B1E64127D7636E7D04FB65FFF87E54311F87904608B6AED05D7C7555CA0CD111C68FAFEE0E7A7F0BE238DE8A68E564B303A0AF7D4BE106A748D
Malicious:	false
Reputation:	low
URL:	https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658ced94adc727c27bb15f04_MetaMask_Fox.svg.png
Preview:	.PNG........IHDR... ... .....szz.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....pHYs..........+......bKGD.............%tEXtdate:create.2022-08-31T12:25:50+00:00.iP>...%tEXtdate:modify.2022-08-31T12:25:50+00:00.4.....IDATXG.V[l.U..fvggw...h....."."..\|.`L4A#....<(Q"Q#F!............/(b....F... ...m.v......l:.V...._s....o...?...."T....G` }.~].qE.b...r...@.O-...n...w..w..^>........b....#T.......9H45CXe<:...).J.cH.....CZ^...I.z..wq..b./:.X...Al.....qB.>...\|...$\........Md..P...z..d....&EUQ....}o..x.u.u.?.....I..ZQP..............;..C.D...fU...R.._..ulX."............%..{.-dr..FI(9..kn..=......p,S.\|........&.(D`.`G.$.."Y.t..y.l..}....e.c.....".I....*...=.....~....K%A..F..>.....Dp..%. ...X.r...a....../.a!NI....Iv....T..].V......w."&C.C{.OW..#...{2.._.c[..\...HM.NE.#.p.y...I...]CW..3.x~...M.l.v...u..Z..G....AC.,.v..pB:..@.$.h(xae.)z..J....e..o.P<......u...D.r..".h..l.$gz..../.b....^N........:g..<s.......cq..N.0.)..cO.0..."S@....%

Chrome Cache Entry: 50

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 37646
Category:	downloaded
Size (bytes):	13749
Entropy (8bit):	7.983324348564223
Encrypted:	false
SSDEEP:	384:bxhwOLdEQrZqSNhzfiPSWl/Io2hOgCSE8qMNmE:bPwOLdEGNzfAIo2MlSE8tN3
MD5:	5E0038FA5C16DD501AA22BFDE680E147
SHA1:	C7B3866047CA4D49CFB79EE7749FD886A8B1A262
SHA-256:	BC420AD02FD4B41E8216904C37E8EA7652F2A512593F60ECF0A6F27A38F9C696
SHA-512:	AFCFFEDCF9AD5A1EDDBC6632392DB034380FEA2962084509244EBF457D06A3BB53BE008841C952CEC44D5D55F851F336238580AE6868C695B7D8D502A2786159
Malicious:	false
Reputation:	low
URL:	https://assets-global.website-files.com/658cec990fe960c2d842cbdb/js/webflow.235cb1a9b.js
Preview:	...........}.[..........Md.`..)....j..E.;....`2.(.....\......y...2.Y.f..%...6..m..X.;.'..~....N..9...V.ES,.?......N1~......v.x..z..n.8..>.y#?7......O.v.......X9...".k.&..,.h.d....q....6......?..m.......L!.I.t6c.=.w.f.F<...."P.Lu.a....l....c..mn.&~...x..iWun3.N.sS.... .4`.......Z..8.r...>.e.I...;U......6.K....f.G.~.].Z....a8a..3....`{.A@G^....ztc.....3..l._W..>%.._.`L.o>P.6\|....6....?.._V...z..d._..<...^....@.....l..7m.g;wi.Pb.m.NG,7...Vs{7#..S.5../X.............F...@h.+ :.u.\.r F...X.`....'.....J.C..+..6 .!...G.....zr'..,.\;...w.#...R);.4.Z.h.=..%......)..DV..4.GU?...N0.n...\|^...u.a...."&.`Z.+V.-i.X.2.u..X...j....V(....$...F...\|$W]...`..X'.*P.Kz.....Pj.._0.V.U....7J.....7.._.0....TOJl..k.P-..7..../.E........S..#....Ho..=. ;.-.2=..~K~...........i...?..w......<.h.Z..7~.".W2.....&..l.=...e+....9..9.[..m{....r..S. .F.y@B....?.9?..:..sKN..vy..:..N.<._`o6.Az.@......mk..<.I.....{..$..A............"Y.!..9..h.lq..x.kX...e....O...

Chrome Cache Entry: 51

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1264x764, components 3
Category:	dropped
Size (bytes):	67389
Entropy (8bit):	7.777021849482456
Encrypted:	false
SSDEEP:	1536:pRWUhS2mulJr0O9YQKPWGNXgj+aditexinqix2kbTWbT+VKP1XNfl7:rD+ulJvFKPRwHdit4u2kbSbKVKdD7
MD5:	789EE2A125E78F503ED9ADE1C0D8C922
SHA1:	F31414CB7AB911D8964D48F04F4671BCBB3A43EE
SHA-256:	4B67D6591415151BBF3B02E5BA3A11B2C40A9FC3F0963A3A9CF8C5A052BD67A0
SHA-512:	3384DE4869B4D830EDCF2D709A5FE3E0A7F8E8889178B91581A2740055D74F126440F30B11C61F326266F069DFB517AFEA39A8C3AD37F5E9FE160EAA158E4846
Malicious:	false
Reputation:	low
Preview:	......JFIF.....................................................................&""&0-0>>T............................................) .. )/'%'/9339GDG]]}......................6...................................................................L...............................................................................................................................L...H....................................\|.&.....(, }$............. A.f[p'..}...I.z.....I=.........................................>..ts....>.vG.....?.m.3...............B...-.b...w.D....O.\|._....\|.,.....,.M.6u....k.O..P....s.NT/.J...........!$Jb10..H.-..^.H!2..F% .*.JD..!2.A(..C.3c......HA14W.....g.......?=1..0.l..q..d....V......=n....................!E..3..jp..x:p..M....z....L..u.u6......y.g...C..$I;(.....q.........!.T./.3.o...Iw._..7T[...[5...#\-.o\...F7LoK..Y..s.$Z:.k...5}-.....v.4.......x.!.Y.[...".zUV...I.>....e.......q.&..}....v.}#].\......Y../..>..a\|.ko\.#..3.................s...

Chrome Cache Entry: 52

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 37279
Category:	downloaded
Size (bytes):	8349
Entropy (8bit):	7.9771159369913365
Encrypted:	false
SSDEEP:	192:Jb2IvLuJ+4qVQMVv44oH4P2qj5v4gw7GbyjuIx9MTcmjkZNozl5:JbiNMVvH1PTNX7byeyAl5
MD5:	5FCCA36659EC716141950A9B3718EE2F
SHA1:	749789BA14A97B0488B9004E78937B8B00F479BD
SHA-256:	D52FA291EF9541F7E821AF017E5B43C5A251AB792DE2580E3A8D32C447A8C73E
SHA-512:	16A1FB173CDD048AD10A8E274988093270AFA0EA301D96659E8F148A28F4DF6ED7FCDA27698AA09618D4C10CA9FA9484B87340562637CF65336010E07B18A2D6
Malicious:	false
Reputation:	low
URL:	https://assets-global.website-files.com/658cec990fe960c2d842cbdb/css/metaioseklcogin.webflow.5e22c9479.css
Preview:	...........=.r.8....\wLDU.eS.%Wt.P.m.,..[....H...C#R.'&bv.'......6...@..\..[".H$...D".......$........[oFI._.~p.e./...1y..........X..T.U./...~.....2..-n.Q...J2.V................JS...y`y...\......P....?.....J....].J..:.\|C#5....u..P6.=...-.P.Tw.B..g.........Z..B....e....7l.5>..-...8...\|...S................C.......P......K{....."&.zI.loq-..A>........Y!6..<....-.Dv<....[`.............A.o$...:.O`...51,..u..g..}.&w.`kC[V.....Y.......... b.R.p00@.b...2.M8.e.)..M5.15....KD.r.sx..'u,.x....{..D..o.h...6.....J..z..h:d-.i......z4&...Rt...'...oj{.S....#........a."D.A..\.TBri@...3+..?..%.....4....DG...\|.'.....\.....r....8..j..ep(y. .e`?(/..M.....s..=.".L.kV.z..+.&...O.#c..Z...5....j....IL.`;7~? 7...2.`A....Pd3...P..., ....r.~.=..bA5...^.Z..L.q).JX]7......%.{+M=m.,.E..cH....DZ.u,!.....b.....v..v^...+.T.)*...))...&.....t&...;. .)&...-..HSf..wl.. ..N#.a.Y.`.B"..4MJJ..d.......P...M..2l....Td.}.t....3J[....Q.,.....8..m......Fk..#..I#@.NO@...:..d..

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1264x764, components 3
Category:	downloaded
Size (bytes):	67389
Entropy (8bit):	7.777021849482456
Encrypted:	false
SSDEEP:	1536:pRWUhS2mulJr0O9YQKPWGNXgj+aditexinqix2kbTWbT+VKP1XNfl7:rD+ulJvFKPRwHdit4u2kbSbKVKdD7
MD5:	789EE2A125E78F503ED9ADE1C0D8C922
SHA1:	F31414CB7AB911D8964D48F04F4671BCBB3A43EE
SHA-256:	4B67D6591415151BBF3B02E5BA3A11B2C40A9FC3F0963A3A9CF8C5A052BD67A0
SHA-512:	3384DE4869B4D830EDCF2D709A5FE3E0A7F8E8889178B91581A2740055D74F126440F30B11C61F326266F069DFB517AFEA39A8C3AD37F5E9FE160EAA158E4846
Malicious:	false
Reputation:	low
URL:	https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658cecd186303d8f3a24cfe1_metamas-banner_.jpg
Preview:	......JFIF.....................................................................&""&0-0>>T............................................) .. )/'%'/9339GDG]]}......................6...................................................................L...............................................................................................................................L...H....................................\|.&.....(, }$............. A.f[p'..}...I.z.....I=.........................................>..ts....>.vG.....?.m.3...............B...-.b...w.D....O.\|._....\|.,.....,.M.6u....k.O..P....s.NT/.J...........!$Jb10..H.-..^.H!2..F% .*.JD..!2.A(..C.3c......HA14W.....g.......?=1..0.l..q..d....V......=n....................!E..3..jp..x:p..M....z....L..u.u6......y.g...C..$I;(.....q.........!.T./.3.o...Iw._..7T[...[5...#\-.o\...F7LoK..Y..s.$Z:.k...5}-.....v.4.......x.!.Y.[...".zUV...I.>....e.......q.&..}....v.}#].\......Y../..>..a\|.ko\.#..3.................s...

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1755
Entropy (8bit):	7.789203921183075
Encrypted:	false
SSDEEP:	48:zJEqY7IB0zOCVpZ+gR2X0THRG8VHD3GtQ15BhD:NYw0CCdWXOzstQ1jhD
MD5:	E0675D3650A072904DA930DC2FC9C729
SHA1:	2EEEAEE36B691A2D82A0BE4C2241D586E9DD1EA1
SHA-256:	C89D9A9EE775399F793D9259AB16B2D8D6776776DFF60C15D2FD203EA378E738
SHA-512:	EDE34114AA7F6B1E64127D7636E7D04FB65FFF87E54311F87904608B6AED05D7C7555CA0CD111C68FAFEE0E7A7F0BE238DE8A68E564B303A0AF7D4BE106A748D
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....pHYs..........+......bKGD.............%tEXtdate:create.2022-08-31T12:25:50+00:00.iP>...%tEXtdate:modify.2022-08-31T12:25:50+00:00.4.....IDATXG.V[l.U..fvggw...h....."."..\|.`L4A#....<(Q"Q#F!............/(b....F... ...m.v......l:.V...._s....o...?...."T....G` }.~].qE.b...r...@.O-...n...w..w..^>........b....#T.......9H45CXe<:...).J.cH.....CZ^...I.z..wq..b./:.X...Al.....qB.>...\|...$\........Md..P...z..d....&EUQ....}o..x.u.u.?.....I..ZQP..............;..C.D...fU...R.._..ulX."............%..{.-dr..FI(9..kn..=......p,S.\|........&.(D`.`G.$.."Y.t..y.l..}....e.c.....".I....*...=.....~....K%A..F..>.....Dp..%. ...X.r...a....../.a!NI....Iv....T..].V......w."&C.C{.OW..#...{2.._.c[..\...HM.NE.#.p.y...I...]CW..3.x~...M.l.v...u..Z..G....AC.,.v..pB:..@.$.h(xae.)z..J....e..o.P<......u...D.r..".h..l.$gz..../.b....^N........:g..<s.......cq..N.0.)..cO.0..."S@....%

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 00:20:05.502357006 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 5, 2024 00:20:15.113254070 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 5, 2024 00:20:15.427501917 CEST	49735	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.427541018 CEST	443	49735	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:15.427598953 CEST	49735	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.428010941 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.428021908 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:15.428198099 CEST	49735	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.428210974 CEST	443	49735	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:15.428221941 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.428455114 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.428467989 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:15.965554953 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:15.971009970 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.971029043 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:15.972126007 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:15.972197056 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.973413944 CEST	443	49735	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:15.974297047 CEST	49735	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.974308968 CEST	443	49735	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:15.975836039 CEST	443	49735	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:15.975841045 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.975903988 CEST	49735	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.975927114 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:15.976867914 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.976876020 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:15.979284048 CEST	49735	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:15.979393959 CEST	443	49735	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:16.016763926 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:16.033571959 CEST	49735	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:16.033580065 CEST	443	49735	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:16.080115080 CEST	49735	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:16.082988024 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:16.083051920 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:16.083080053 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:16.083092928 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:16.083105087 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:16.083134890 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:16.083142042 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:16.083149910 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:16.083189011 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:16.084745884 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:16.089126110 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:16.089184046 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:16.127367973 CEST	49736	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:20:16.127401114 CEST	443	49736	151.101.2.188	192.168.2.4
Jul 5, 2024 00:20:16.143038034 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:16.143090010 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:16.143155098 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:16.143208981 CEST	49740	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:16.143238068 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:16.143281937 CEST	49740	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:16.143728971 CEST	49740	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:16.143749952 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:16.144093990 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:16.144105911 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:16.144850016 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:16.144886971 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:16.144942999 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:16.145518064 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:16.145534992 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.004723072 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.004832983 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.005309105 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.005317926 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.005378008 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.005613089 CEST	49740	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.005637884 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.006036997 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.006051064 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.006396055 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.006453991 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.006690025 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.006742954 CEST	49740	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.007153034 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.007225990 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.008532047 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.008622885 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.008935928 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.008941889 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.009366989 CEST	49740	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.009438038 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.009533882 CEST	49740	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.009545088 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.015948057 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.016014099 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.016355991 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.016362906 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.062686920 CEST	49740	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.062794924 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.062796116 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.289633036 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.289660931 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.289669037 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.289684057 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.289691925 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.289699078 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.289705038 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.289714098 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.289748907 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.289777994 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.373058081 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.373086929 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.373141050 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.373150110 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.373189926 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.379964113 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.379987001 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.380057096 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.380067110 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.380153894 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.463551044 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.463579893 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.463655949 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.463664055 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.463709116 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.463906050 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.463921070 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.463979959 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.463984966 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.464024067 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.464764118 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.464837074 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.464843035 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.464855909 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.464900017 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.465667963 CEST	49741	443	192.168.2.4	52.222.232.99
Jul 5, 2024 00:20:17.465683937 CEST	443	49741	52.222.232.99	192.168.2.4
Jul 5, 2024 00:20:17.487776041 CEST	49742	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:20:17.487816095 CEST	443	49742	142.250.185.196	192.168.2.4
Jul 5, 2024 00:20:17.488048077 CEST	49742	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:20:17.489006042 CEST	49742	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:20:17.489025116 CEST	443	49742	142.250.185.196	192.168.2.4
Jul 5, 2024 00:20:17.592478037 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.592518091 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.592525959 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.592556000 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.592571020 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.592581987 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.592597961 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.592600107 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.592622042 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.592660904 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.592699051 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.617871046 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.617899895 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.617913008 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.617929935 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.617949963 CEST	49740	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.617979050 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.618005991 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.618009090 CEST	49740	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.618040085 CEST	49740	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.786309004 CEST	49739	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.786353111 CEST	443	49739	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:17.790558100 CEST	49740	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:17.790592909 CEST	443	49740	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.138622046 CEST	443	49742	142.250.185.196	192.168.2.4
Jul 5, 2024 00:20:18.186176062 CEST	49742	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:20:18.186204910 CEST	443	49742	142.250.185.196	192.168.2.4
Jul 5, 2024 00:20:18.187448025 CEST	443	49742	142.250.185.196	192.168.2.4
Jul 5, 2024 00:20:18.187529087 CEST	49742	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:20:18.188133001 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:18.188169003 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.188265085 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:18.189253092 CEST	49744	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:18.189291000 CEST	443	49744	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.189671040 CEST	49744	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:18.192605972 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:18.192647934 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.193131924 CEST	49744	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:18.193145037 CEST	443	49744	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.194017887 CEST	49742	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:20:18.194122076 CEST	443	49742	142.250.185.196	192.168.2.4
Jul 5, 2024 00:20:18.235852003 CEST	49742	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:20:18.235877037 CEST	443	49742	142.250.185.196	192.168.2.4
Jul 5, 2024 00:20:18.284153938 CEST	49742	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:20:18.618381023 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:18.618418932 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:18.618498087 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:18.622795105 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:18.622811079 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:18.889749050 CEST	443	49744	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.890023947 CEST	49744	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:18.890032053 CEST	443	49744	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.890429020 CEST	443	49744	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.890796900 CEST	49744	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:18.890863895 CEST	443	49744	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.890940905 CEST	49744	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:18.921632051 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.921885014 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:18.921914101 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.922278881 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.922584057 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:18.922643900 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.922996998 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:18.936487913 CEST	443	49744	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:18.968489885 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.070185900 CEST	443	49744	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.070211887 CEST	443	49744	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.070259094 CEST	49744	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.070271015 CEST	443	49744	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.070321083 CEST	443	49744	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.070473909 CEST	49744	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.071270943 CEST	49744	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.071280956 CEST	443	49744	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.071291924 CEST	49744	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.071315050 CEST	49744	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.154243946 CEST	49746	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:19.154284000 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:19.154356956 CEST	49746	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:19.155055046 CEST	49746	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:19.155077934 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:19.172389984 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.172416925 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.172432899 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.172489882 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.172509909 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.172550917 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.263199091 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.263226986 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.263282061 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.263298988 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.263319016 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.263339043 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.267482996 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.267502069 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.267566919 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.267574072 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.267615080 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.286047935 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:19.286143064 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:19.309122086 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:19.309139967 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:19.309417009 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:19.358370066 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.358429909 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.358464956 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.358480930 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.358515024 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.358527899 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.358555079 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.365143061 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:19.889760971 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:19.900158882 CEST	49746	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:19.900170088 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:19.900629997 CEST	49743	443	192.168.2.4	18.245.162.13
Jul 5, 2024 00:20:19.900640965 CEST	443	49743	18.245.162.13	192.168.2.4
Jul 5, 2024 00:20:19.901279926 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:19.901349068 CEST	49746	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:19.901870966 CEST	49746	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:19.901943922 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:19.942758083 CEST	49746	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:19.942765951 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:19.943248987 CEST	49746	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:19.975975990 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:19.984489918 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:20.020498991 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:20.158440113 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:20.158476114 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:20.158515930 CEST	49746	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:20.158534050 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:20.158555031 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:20.158629894 CEST	49746	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:20.164649963 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:20.164705038 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:20.164804935 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:20.168843985 CEST	49746	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:20.168854952 CEST	443	49746	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:20.170187950 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:20.170192003 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:20.323271036 CEST	49747	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:20.323318005 CEST	443	49747	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:20.323460102 CEST	49747	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:20.340584993 CEST	49747	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:20.340609074 CEST	443	49747	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:20.870912075 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:20.870970011 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:20.871023893 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:20.872016907 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:20.872031927 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.016803980 CEST	443	49747	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:21.016868114 CEST	49747	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:21.035413027 CEST	49747	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:21.035423994 CEST	443	49747	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:21.035696983 CEST	443	49747	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:21.036935091 CEST	49747	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:21.084496975 CEST	443	49747	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:21.301901102 CEST	443	49747	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:21.301963091 CEST	443	49747	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:21.302016973 CEST	49747	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:21.417212963 CEST	49747	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:21.417259932 CEST	443	49747	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:21.417284966 CEST	49747	443	192.168.2.4	184.28.90.27
Jul 5, 2024 00:20:21.417293072 CEST	443	49747	184.28.90.27	192.168.2.4
Jul 5, 2024 00:20:21.605823040 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.609297037 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:21.609308958 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.609683037 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.610070944 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:21.610140085 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.610343933 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:21.656514883 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.873749971 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.878674030 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.878693104 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.878743887 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:21.878772020 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.878793955 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:21.878814936 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:21.960388899 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.960416079 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.960496902 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:21.960515022 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.960537910 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:21.960555077 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:21.964971066 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.964987993 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.965054035 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:21.965061903 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:21.965101004 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:22.052104950 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:22.052130938 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:22.052169085 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:22.052181959 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:22.052198887 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:22.052232981 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:22.052238941 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:22.052274942 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:22.052922010 CEST	49749	443	192.168.2.4	18.239.69.126
Jul 5, 2024 00:20:22.052934885 CEST	443	49749	18.239.69.126	192.168.2.4
Jul 5, 2024 00:20:28.047544003 CEST	443	49742	142.250.185.196	192.168.2.4
Jul 5, 2024 00:20:28.047610044 CEST	443	49742	142.250.185.196	192.168.2.4
Jul 5, 2024 00:20:28.047652960 CEST	49742	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:20:28.202394009 CEST	49742	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:20:28.202411890 CEST	443	49742	142.250.185.196	192.168.2.4
Jul 5, 2024 00:20:32.643188953 CEST	49723	80	192.168.2.4	93.184.221.240
Jul 5, 2024 00:20:32.650182962 CEST	80	49723	93.184.221.240	192.168.2.4
Jul 5, 2024 00:20:32.650485039 CEST	49723	80	192.168.2.4	93.184.221.240
Jul 5, 2024 00:21:01.048715115 CEST	49735	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:21:01.048729897 CEST	443	49735	151.101.2.188	192.168.2.4
Jul 5, 2024 00:21:17.534075022 CEST	49735	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:21:17.534185886 CEST	443	49735	151.101.2.188	192.168.2.4
Jul 5, 2024 00:21:17.534251928 CEST	49735	443	192.168.2.4	151.101.2.188
Jul 5, 2024 00:21:17.534430027 CEST	49758	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:21:17.534482002 CEST	443	49758	142.250.185.196	192.168.2.4
Jul 5, 2024 00:21:17.534533978 CEST	49758	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:21:17.535156965 CEST	49758	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:21:17.535176039 CEST	443	49758	142.250.185.196	192.168.2.4
Jul 5, 2024 00:21:18.190083027 CEST	443	49758	142.250.185.196	192.168.2.4
Jul 5, 2024 00:21:18.190418005 CEST	49758	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:21:18.190452099 CEST	443	49758	142.250.185.196	192.168.2.4
Jul 5, 2024 00:21:18.190741062 CEST	443	49758	142.250.185.196	192.168.2.4
Jul 5, 2024 00:21:18.191274881 CEST	49758	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:21:18.191334009 CEST	443	49758	142.250.185.196	192.168.2.4
Jul 5, 2024 00:21:18.235707998 CEST	49758	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:21:21.454781055 CEST	49724	80	192.168.2.4	93.184.221.240
Jul 5, 2024 00:21:21.573780060 CEST	80	49724	93.184.221.240	192.168.2.4
Jul 5, 2024 00:21:21.573831081 CEST	49724	80	192.168.2.4	93.184.221.240
Jul 5, 2024 00:21:28.108818054 CEST	443	49758	142.250.185.196	192.168.2.4
Jul 5, 2024 00:21:28.108885050 CEST	443	49758	142.250.185.196	192.168.2.4
Jul 5, 2024 00:21:28.109051943 CEST	49758	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:21:29.568728924 CEST	49758	443	192.168.2.4	142.250.185.196
Jul 5, 2024 00:21:29.568809986 CEST	443	49758	142.250.185.196	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 00:20:13.495783091 CEST	53	54299	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:13.495794058 CEST	53	59131	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:14.795722008 CEST	57770	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:14.795855045 CEST	54072	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:15.413671970 CEST	53	54072	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:15.426882982 CEST	53	57770	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:15.479770899 CEST	53	64182	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:16.129672050 CEST	58622	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:16.130304098 CEST	55547	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:16.134111881 CEST	53821	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:16.134665012 CEST	64426	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:16.139767885 CEST	53	58622	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:16.139781952 CEST	53	55547	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:16.142365932 CEST	53	64426	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:16.142556906 CEST	53	53821	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:17.474411964 CEST	60307	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:17.477762938 CEST	56181	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:17.481285095 CEST	53	60307	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:17.486321926 CEST	53	56181	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:19.118943930 CEST	50597	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:19.119340897 CEST	49297	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:19.128747940 CEST	53	49297	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:19.132142067 CEST	53	50597	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:27.626044035 CEST	54314	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:27.626277924 CEST	54437	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:27.958203077 CEST	53	54437	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:27.958565950 CEST	53	54314	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:27.959429979 CEST	54974	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:28.134838104 CEST	53	54974	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:28.163280964 CEST	54008	53	192.168.2.4	8.8.8.8
Jul 5, 2024 00:20:28.163597107 CEST	54826	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:28.170686007 CEST	53	54826	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:28.172308922 CEST	53	54008	8.8.8.8	192.168.2.4
Jul 5, 2024 00:20:29.166239023 CEST	62310	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:29.166461945 CEST	51630	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:29.206245899 CEST	53	51630	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:29.364725113 CEST	53	62310	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:33.024919033 CEST	138	138	192.168.2.4	192.168.2.255
Jul 5, 2024 00:20:33.097210884 CEST	53	60255	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:34.397281885 CEST	60893	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:34.397633076 CEST	53718	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:34.405325890 CEST	53	60893	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:34.426153898 CEST	53	53718	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:34.426815033 CEST	56005	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:34.457942963 CEST	53	56005	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:48.192790985 CEST	53990	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:20:48.200294971 CEST	53	53990	1.1.1.1	192.168.2.4
Jul 5, 2024 00:20:52.012022972 CEST	53	50458	1.1.1.1	192.168.2.4
Jul 5, 2024 00:21:04.489387989 CEST	63204	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:21:04.489856958 CEST	54660	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:21:04.543433905 CEST	53	63204	1.1.1.1	192.168.2.4
Jul 5, 2024 00:21:04.556153059 CEST	53	54660	1.1.1.1	192.168.2.4
Jul 5, 2024 00:21:04.563179016 CEST	56116	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:21:04.585174084 CEST	53	56116	1.1.1.1	192.168.2.4
Jul 5, 2024 00:21:12.994462967 CEST	53	60772	1.1.1.1	192.168.2.4
Jul 5, 2024 00:21:14.843950987 CEST	53	57282	1.1.1.1	192.168.2.4
Jul 5, 2024 00:21:26.064425945 CEST	52919	53	192.168.2.4	1.1.1.1
Jul 5, 2024 00:21:26.089010954 CEST	53	52919	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 5, 2024 00:20:14.795722008 CEST	192.168.2.4	1.1.1.1	0xa45e	Standard query (0)	metaioseklcogin.webflow.io	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:14.795855045 CEST	192.168.2.4	1.1.1.1	0x82cf	Standard query (0)	metaioseklcogin.webflow.io	65	IN (0x0001)	false
Jul 5, 2024 00:20:16.129672050 CEST	192.168.2.4	1.1.1.1	0x95f1	Standard query (0)	assets-global.website-files.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:16.130304098 CEST	192.168.2.4	1.1.1.1	0xd73b	Standard query (0)	assets-global.website-files.com	65	IN (0x0001)	false
Jul 5, 2024 00:20:16.134111881 CEST	192.168.2.4	1.1.1.1	0x6dab	Standard query (0)	d3e54v103j8qbb.cloudfront.net	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:16.134665012 CEST	192.168.2.4	1.1.1.1	0x4c83	Standard query (0)	d3e54v103j8qbb.cloudfront.net	65	IN (0x0001)	false
Jul 5, 2024 00:20:17.474411964 CEST	192.168.2.4	1.1.1.1	0xac17	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:17.477762938 CEST	192.168.2.4	1.1.1.1	0x2638	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 5, 2024 00:20:19.118943930 CEST	192.168.2.4	1.1.1.1	0xdceb	Standard query (0)	assets-global.website-files.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:19.119340897 CEST	192.168.2.4	1.1.1.1	0xeeaf	Standard query (0)	assets-global.website-files.com	65	IN (0x0001)	false
Jul 5, 2024 00:20:27.626044035 CEST	192.168.2.4	1.1.1.1	0x4dcf	Standard query (0)	flesterwisors.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:27.626277924 CEST	192.168.2.4	1.1.1.1	0xc9c5	Standard query (0)	flesterwisors.com	65	IN (0x0001)	false
Jul 5, 2024 00:20:27.959429979 CEST	192.168.2.4	1.1.1.1	0x4d67	Standard query (0)	flesterwisors.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:28.163280964 CEST	192.168.2.4	8.8.8.8	0xc0ed	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:28.163597107 CEST	192.168.2.4	1.1.1.1	0x6ba5	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:29.166239023 CEST	192.168.2.4	1.1.1.1	0x72ab	Standard query (0)	flesterwisors.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:29.166461945 CEST	192.168.2.4	1.1.1.1	0x4db7	Standard query (0)	flesterwisors.com	65	IN (0x0001)	false
Jul 5, 2024 00:20:34.397281885 CEST	192.168.2.4	1.1.1.1	0x2dfb	Standard query (0)	flesterwisors.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:34.397633076 CEST	192.168.2.4	1.1.1.1	0x47ab	Standard query (0)	flesterwisors.com	65	IN (0x0001)	false
Jul 5, 2024 00:20:34.426815033 CEST	192.168.2.4	1.1.1.1	0xbaac	Standard query (0)	flesterwisors.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:48.192790985 CEST	192.168.2.4	1.1.1.1	0x53bc	Standard query (0)	flesterwisors.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:21:04.489387989 CEST	192.168.2.4	1.1.1.1	0xf14c	Standard query (0)	flesterwisors.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:21:04.489856958 CEST	192.168.2.4	1.1.1.1	0xea3f	Standard query (0)	flesterwisors.com	65	IN (0x0001)	false
Jul 5, 2024 00:21:04.563179016 CEST	192.168.2.4	1.1.1.1	0x844c	Standard query (0)	flesterwisors.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:21:26.064425945 CEST	192.168.2.4	1.1.1.1	0x8f79	Standard query (0)	flesterwisors.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 5, 2024 00:20:15.413671970 CEST	1.1.1.1	192.168.2.4	0x82cf	No error (0)	metaioseklcogin.webflow.io	webflow-io.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 5, 2024 00:20:15.426882982 CEST	1.1.1.1	192.168.2.4	0xa45e	No error (0)	metaioseklcogin.webflow.io	webflow-io.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 5, 2024 00:20:15.426882982 CEST	1.1.1.1	192.168.2.4	0xa45e	No error (0)	webflow-io.map.fastly.net		151.101.2.188	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:15.426882982 CEST	1.1.1.1	192.168.2.4	0xa45e	No error (0)	webflow-io.map.fastly.net		151.101.66.188	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:15.426882982 CEST	1.1.1.1	192.168.2.4	0xa45e	No error (0)	webflow-io.map.fastly.net		151.101.130.188	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:15.426882982 CEST	1.1.1.1	192.168.2.4	0xa45e	No error (0)	webflow-io.map.fastly.net		151.101.194.188	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:16.139767885 CEST	1.1.1.1	192.168.2.4	0x95f1	No error (0)	assets-global.website-files.com	d3vmvmej3wjbxn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 5, 2024 00:20:16.139767885 CEST	1.1.1.1	192.168.2.4	0x95f1	No error (0)	d3vmvmej3wjbxn.cloudfront.net		18.245.162.13	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:16.139767885 CEST	1.1.1.1	192.168.2.4	0x95f1	No error (0)	d3vmvmej3wjbxn.cloudfront.net		18.245.162.61	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:16.139767885 CEST	1.1.1.1	192.168.2.4	0x95f1	No error (0)	d3vmvmej3wjbxn.cloudfront.net		18.245.162.120	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:16.139767885 CEST	1.1.1.1	192.168.2.4	0x95f1	No error (0)	d3vmvmej3wjbxn.cloudfront.net		18.245.162.113	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:16.139781952 CEST	1.1.1.1	192.168.2.4	0xd73b	No error (0)	assets-global.website-files.com	d3vmvmej3wjbxn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 5, 2024 00:20:16.142556906 CEST	1.1.1.1	192.168.2.4	0x6dab	No error (0)	d3e54v103j8qbb.cloudfront.net		52.222.232.99	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:16.142556906 CEST	1.1.1.1	192.168.2.4	0x6dab	No error (0)	d3e54v103j8qbb.cloudfront.net		52.222.232.144	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:16.142556906 CEST	1.1.1.1	192.168.2.4	0x6dab	No error (0)	d3e54v103j8qbb.cloudfront.net		52.222.232.39	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:16.142556906 CEST	1.1.1.1	192.168.2.4	0x6dab	No error (0)	d3e54v103j8qbb.cloudfront.net		52.222.232.47	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:17.481285095 CEST	1.1.1.1	192.168.2.4	0xac17	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:17.486321926 CEST	1.1.1.1	192.168.2.4	0x2638	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 5, 2024 00:20:19.128747940 CEST	1.1.1.1	192.168.2.4	0xeeaf	No error (0)	assets-global.website-files.com	d3vmvmej3wjbxn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 5, 2024 00:20:19.132142067 CEST	1.1.1.1	192.168.2.4	0xdceb	No error (0)	assets-global.website-files.com	d3vmvmej3wjbxn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 5, 2024 00:20:19.132142067 CEST	1.1.1.1	192.168.2.4	0xdceb	No error (0)	d3vmvmej3wjbxn.cloudfront.net		18.239.69.126	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:19.132142067 CEST	1.1.1.1	192.168.2.4	0xdceb	No error (0)	d3vmvmej3wjbxn.cloudfront.net		18.239.69.66	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:19.132142067 CEST	1.1.1.1	192.168.2.4	0xdceb	No error (0)	d3vmvmej3wjbxn.cloudfront.net		18.239.69.74	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:19.132142067 CEST	1.1.1.1	192.168.2.4	0xdceb	No error (0)	d3vmvmej3wjbxn.cloudfront.net		18.239.69.90	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:28.170686007 CEST	1.1.1.1	192.168.2.4	0x6ba5	No error (0)	google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:28.172308922 CEST	8.8.8.8	192.168.2.4	0xc0ed	No error (0)	google.com		172.217.168.14	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:28.810297012 CEST	1.1.1.1	192.168.2.4	0x63e6	No error (0)	windowsupdatebg.s.llnwi.net		87.248.205.0	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:20:30.749593973 CEST	1.1.1.1	192.168.2.4	0x9842	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 5, 2024 00:20:30.749593973 CEST	1.1.1.1	192.168.2.4	0x9842	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

metaioseklcogin.webflow.io

https:

d3e54v103j8qbb.cloudfront.net

assets-global.website-files.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	151.101.2.188	443	3720	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:20:15 UTC	669	OUT	GET / HTTP/1.1 Host: metaioseklcogin.webflow.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:20:16 UTC	505	IN	HTTP/1.1 200 OK Connection: close Content-Length: 9025 Content-Type: text/html Content-Security-Policy: frame-ancestors 'self' https://.webflow.com http://.webflow.com http://*.webflow.io http://webflow.com https://webflow.com x-lambda-id: 9d0b44b1-fa57-416b-bd2b-e15f3a167cd1 Accept-Ranges: bytes Date: Thu, 04 Jul 2024 22:20:16 GMT Age: 172673 X-Served-By: cache-ewr18158-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1720131616.032929,VS0,VE1 Vary: x-wf-forwarded-proto, Accept-Encoding
2024-07-04 22:20:16 UTC	1378	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 77 61 73 20 63 72 65 61 74 65 64 20 69 6e 20 57 65 62 66 6c 6f 77 2e 20 68 74 74 70 73 3a 2f 2f 77 65 62 66 6c 6f 77 2e 63 6f 6d 20 2d 2d 3e 3c 21 2d 2d 20 4c 61 73 74 20 50 75 62 6c 69 73 68 65 64 3a 20 54 68 75 20 44 65 63 20 32 38 20 32 30 32 33 20 30 33 3a 33 38 3a 30 33 20 47 4d 54 2b 30 30 30 30 20 28 43 6f 6f 72 64 69 6e 61 74 65 64 20 55 6e 69 76 65 72 73 61 6c 20 54 69 6d 65 29 20 2d 2d 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 77 66 2d 64 6f 6d 61 69 6e 3d 22 6d 65 74 61 69 6f 73 65 6b 6c 63 6f 67 69 6e 2e 77 65 62 66 6c 6f 77 2e 69 6f 22 20 64 61 74 61 2d 77 66 2d 70 61 67 65 3d 22 36 35 38 63 65 63 39 39 30 66 65 39 36 30 63 32 64 38 34 32 63 62 64 66 22 20 64 Data Ascii: <!DOCTYPE html>... This site was created in Webflow. https://webflow.com -->... Last Published: Thu Dec 28 2023 03:38:03 GMT+0000 (Coordinated Universal Time) --><html data-wf-domain="metaioseklcogin.webflow.io" data-wf-page="658cec990fe960c2d842cbdf" d
2024-07-04 22:20:16 UTC	1378	IN	Data Raw: 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 2f 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 2f 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 2f 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 57 65 62 66 6c 6f 77 22 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2d 67 6c 6f 62 61 6c 2e 77 65 62 73 69 74 65 2d 66 69 6c 65 73 2e 63 6f 6d 2f 36 35 38 63 65 63 39 Data Ascii: og:type" content="website"/><meta content="summary_large_image" name="twitter:card"/><meta content="width=device-width, initial-scale=1" name="viewport"/><meta content="Webflow" name="generator"/><link href="https://assets-global.website-files.com/658cec9
2024-07-04 22:20:16 UTC	1378	IN	Data Raw: 73 65 74 73 2d 67 6c 6f 62 61 6c 2e 77 65 62 73 69 74 65 2d 66 69 6c 65 73 2e 63 6f 6d 2f 36 35 38 63 65 63 39 39 30 66 65 39 36 30 63 32 64 38 34 32 63 62 64 62 2f 36 35 38 63 65 63 64 31 38 36 33 30 33 64 38 66 33 61 32 34 63 66 65 31 5f 6d 65 74 61 6d 61 73 2d 62 61 6e 6e 65 72 5f 2d 70 2d 31 30 38 30 2e 6a 70 67 20 31 30 38 30 77 2c 20 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2d 67 6c 6f 62 61 6c 2e 77 65 62 73 69 74 65 2d 66 69 6c 65 73 2e 63 6f 6d 2f 36 35 38 63 65 63 39 39 30 66 65 39 36 30 63 32 64 38 34 32 63 62 64 62 2f 36 35 38 63 65 63 64 31 38 36 33 30 33 64 38 66 33 61 32 34 63 66 65 31 5f 6d 65 74 61 6d 61 73 2d 62 61 6e 6e 65 72 5f 2e 6a 70 67 20 31 32 36 34 77 22 20 61 6c 74 3d 22 22 2f 3e 3c 2f 61 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: sets-global.website-files.com/658cec990fe960c2d842cbdb/658cecd186303d8f3a24cfe1_metamas-banner_-p-1080.jpg 1080w, https://assets-global.website-files.com/658cec990fe960c2d842cbdb/658cecd186303d8f3a24cfe1_metamas-banner_.jpg 1264w" alt=""/></a><div class="
2024-07-04 22:20:16 UTC	1378	IN	Data Raw: 65 6e 73 69 6f 6e 3a 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 6c 69 3e 3c 6c 69 3e 4d 65 74 61 4d 61 73 6b 20 69 73 20 61 76 61 69 6c 61 62 6c 65 20 61 73 20 61 20 62 72 6f 77 73 65 72 20 65 78 74 65 6e 73 69 6f 6e 20 66 6f 72 20 70 6f 70 75 6c 61 72 20 77 65 62 20 62 72 6f 77 73 65 72 73 20 6c 69 6b 65 20 43 68 72 6f 6d 65 2c 20 46 69 72 65 66 6f 78 2c 20 42 72 61 76 65 2c 20 61 6e 64 20 45 64 67 65 2e 20 56 69 73 69 74 20 74 68 65 20 65 78 74 65 6e 73 69 6f 6e 20 73 74 6f 72 65 20 66 6f 72 20 79 6f 75 72 20 63 68 6f 73 65 6e 20 62 72 6f 77 73 65 72 20 61 6e 64 20 69 6e 73 74 61 6c 6c 20 4d 65 74 61 4d 61 73 6b 2e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 73 74 72 6f 6e 67 3e 43 72 65 61 74 65 20 61 20 4e 65 77 20 57 61 6c 6c 65 74 3a 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 6c 69 Data Ascii: ension:</strong></li><li>MetaMask is available as a browser extension for popular web browsers like Chrome, Firefox, Brave, and Edge. Visit the extension store for your chosen browser and install MetaMask.</li><li><strong>Create a New Wallet:</strong></li
2024-07-04 22:20:16 UTC	1378	IN	Data Raw: 69 3e 49 6e 70 75 74 20 74 68 65 20 70 61 73 73 77 6f 72 64 20 79 6f 75 20 63 72 65 61 74 65 64 20 64 75 72 69 6e 67 20 74 68 65 20 77 61 6c 6c 65 74 20 73 65 74 75 70 20 70 72 6f 63 65 73 73 2e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 73 74 72 6f 6e 67 3e 41 63 63 65 73 73 69 6e 67 20 59 6f 75 72 20 57 61 6c 6c 65 74 3a 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 6c 69 3e 3c 6c 69 3e 55 70 6f 6e 20 73 75 63 63 65 73 73 66 75 6c 20 6c 6f 67 69 6e 2c 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 64 69 72 65 63 74 65 64 20 74 6f 20 74 68 65 20 4d 65 74 61 4d 61 73 6b 20 64 61 73 68 62 6f 61 72 64 2e 20 48 65 72 65 2c 20 79 6f 75 20 63 61 6e 20 76 69 65 77 20 79 6f 75 72 20 77 61 6c 6c 65 74 20 62 61 6c 61 6e 63 65 2c 20 72 65 63 65 6e 74 20 74 72 61 6e 73 61 63 74 69 6f 6e 73 2c 20 61 Data Ascii: i>Input the password you created during the wallet setup process.</li><li><strong>Accessing Your Wallet:</strong></li><li>Upon successful login, you will be directed to the MetaMask dashboard. Here, you can view your wallet balance, recent transactions, a
2024-07-04 22:20:16 UTC	1378	IN	Data Raw: 2f 6c 69 3e 3c 6c 69 3e 45 78 70 6c 6f 72 65 20 64 65 63 65 6e 74 72 61 6c 69 7a 65 64 20 61 70 70 6c 69 63 61 74 69 6f 6e 73 20 62 79 20 76 69 73 69 74 69 6e 67 20 44 41 70 70 20 70 6c 61 74 66 6f 72 6d 73 20 74 68 72 6f 75 67 68 20 74 68 65 20 4d 65 74 61 4d 61 73 6b 20 62 72 6f 77 73 65 72 20 65 78 74 65 6e 73 69 6f 6e 2e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 73 74 72 6f 6e 67 3e 53 65 74 74 69 6e 67 73 20 61 6e 64 20 50 72 65 66 65 72 65 6e 63 65 73 3a 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 6c 69 3e 3c 6c 69 3e 43 75 73 74 6f 6d 69 7a 65 20 79 6f 75 72 20 4d 65 74 61 4d 61 73 6b 20 65 78 70 65 72 69 65 6e 63 65 20 62 79 20 61 64 6a 75 73 74 69 6e 67 20 73 65 74 74 69 6e 67 73 20 73 75 63 68 20 61 73 20 6c 61 6e 67 75 61 67 65 2c 20 63 75 72 72 65 6e 63 79 20 64 69 Data Ascii: /li><li>Explore decentralized applications by visiting DApp platforms through the MetaMask browser extension.</li><li><strong>Settings and Preferences:</strong></li><li>Customize your MetaMask experience by adjusting settings such as language, currency di
2024-07-04 22:20:16 UTC	757	IN	Data Raw: 69 6e 61 6e 63 65 20 61 6e 64 20 61 70 70 6c 69 63 61 74 69 6f 6e 73 2e 20 42 79 20 66 6f 6c 6c 6f 77 69 6e 67 20 74 68 65 20 73 74 65 70 73 20 6f 75 74 6c 69 6e 65 64 20 69 6e 20 74 68 69 73 20 67 75 69 64 65 20 61 6e 64 20 61 64 68 65 72 69 6e 67 20 74 6f 20 73 65 63 75 72 69 74 79 20 62 65 73 74 20 70 72 61 63 74 69 63 65 73 2c 20 79 6f 75 20 63 61 6e 20 63 6f 6e 66 69 64 65 6e 74 6c 79 20 6c 6f 67 20 69 6e 2c 20 6d 61 6e 61 67 65 20 79 6f 75 72 20 61 73 73 65 74 73 2c 20 61 6e 64 20 65 78 70 6c 6f 72 65 20 74 68 65 20 67 72 6f 77 69 6e 67 20 65 63 6f 73 79 73 74 65 6d 20 6f 66 20 64 65 63 65 6e 74 72 61 6c 69 7a 65 64 20 74 65 63 68 6e 6f 6c 6f 67 69 65 73 2e 20 41 73 20 74 68 65 20 62 6c 6f 63 6b 63 68 61 69 6e 20 73 70 61 63 65 20 65 76 6f 6c 76 65 Data Ascii: inance and applications. By following the steps outlined in this guide and adhering to security best practices, you can confidently log in, manage your assets, and explore the growing ecosystem of decentralized technologies. As the blockchain space evolve

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	52.222.232.99	443	3720	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:20:17 UTC	643	OUT	GET /js/jquery-3.5.1.min.dc5e7f18c8.js?site=658cec990fe960c2d842cbdb HTTP/1.1 Host: d3e54v103j8qbb.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://metaioseklcogin.webflow.io sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://metaioseklcogin.webflow.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:20:17 UTC	574	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 89476 Connection: close Last-Modified: Mon, 20 Jul 2020 17:53:02 GMT Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 04 Jul 2024 06:44:07 GMT Cache-Control: max-age=84600, must-revalidate Etag: "dc5e7f18c8d36ac1d3d4753a87c98d0a" Vary: Accept-Encoding Via: 1.1 5519a8cb450b567e8b7111ae986a9b4c.cloudfront.net (CloudFront) Age: 56171 Access-Control-Allow-Origin: * X-Cache: Hit from cloudfront X-Amz-Cf-Pop: FRA56-P4 X-Amz-Cf-Id: Ik0oPfDRIjimy3rDa9rhsM9K0c5XVRsFxF_eJ4WIgC1R79-4D7jZZg==
2024-07-04 22:20:17 UTC	15810	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 35 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2024-07-04 22:20:17 UTC	16384	IN	Data Raw: 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 21 65 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 3d 79 21 3d 3d 6d 3f 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 3a 22 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 22 2c 63 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 66 3d 78 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 70 3d 21 6e 26 26 21 78 2c 64 3d 21 31 3b 69 66 28 63 29 7b 69 66 28 79 29 7b 77 68 69 6c 65 28 6c 29 7b 61 3d 65 3b 77 68 69 6c 65 28 61 3d 61 5b 6c 5d 29 69 66 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e Data Ascii: ction(e){return!!e.parentNode}:function(e,t,n){var r,i,o,a,s,u,l=y!==m?"nextSibling":"previousSibling",c=e.parentNode,f=x&&e.nodeName.toLowerCase(),p=!n&&!x,d=!1;if(c){if(y){while(l){a=e;while(a=a[l])if(x?a.nodeName.toLowerCase()===f:1===a.nodeType)return
2024-07-04 22:20:17 UTC	16384	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 64 6f 53 63 72 6f 6c 6c 3f 43 2e 73 65 74 54 69 6d 65 6f 75 74 28 53 2e 72 65 61 64 79 29 3a 28 45 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 42 29 2c 43 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 42 29 29 3b 76 61 72 20 24 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 29 7b 76 61 72 20 73 3d 30 2c 75 3d 65 2e 6c 65 6e 67 74 68 2c 6c 3d 6e 75 6c 6c 3d 3d 6e 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 3d 77 28 6e 29 29 66 6f 72 28 73 20 69 6e 20 69 3d 21 30 2c 6e 29 24 28 65 2c 74 2c 73 2c 6e 5b 73 5d 2c 21 30 2c 6f 2c 61 29 3b 65 6c 73 65 20 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 26 26 28 Data Ascii: documentElement.doScroll?C.setTimeout(S.ready):(E.addEventListener("DOMContentLoaded",B),C.addEventListener("load",B));var $=function(e,t,n,r,i,o,a){var s=0,u=e.length,l=null==n;if("object"===w(n))for(s in i=!0,n)$(e,t,s,n[s],!0,o,a);else if(void 0!==r&&(
2024-07-04 22:20:17 UTC	16384	IN	Data Raw: 6f 6e 63 65 3a 75 2e 6e 6f 6e 63 65 7c 7c 75 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 6f 6e 63 65 22 29 7d 2c 6c 29 3a 62 28 75 2e 74 65 78 74 43 6f 6e 74 65 6e 74 2e 72 65 70 6c 61 63 65 28 6a 65 2c 22 22 29 2c 75 2c 6c 29 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 52 65 28 65 2c 74 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 2c 69 3d 74 3f 53 2e 66 69 6c 74 65 72 28 74 2c 65 29 3a 65 2c 6f 3d 30 3b 6e 75 6c 6c 21 3d 28 72 3d 69 5b 6f 5d 29 3b 6f 2b 2b 29 6e 7c 7c 31 21 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 7c 7c 53 2e 63 6c 65 61 6e 44 61 74 61 28 76 65 28 72 29 29 2c 72 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 28 6e 26 26 69 65 28 72 29 26 26 79 65 28 76 65 28 72 2c 22 73 63 72 69 70 74 22 29 29 2c 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e Data Ascii: once:u.nonce\|\|u.getAttribute("nonce")},l):b(u.textContent.replace(je,""),u,l))}return n}function Re(e,t,n){for(var r,i=t?S.filter(t,e):e,o=0;null!=(r=i[o]);o++)n\|\|1!==r.nodeType\|\|S.cleanData(ve(r)),r.parentNode&&(n&&ie(r)&&ye(ve(r,"script")),r.parentNode.
2024-07-04 22:20:17 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 72 3d 53 2e 66 78 26 26 53 2e 66 78 2e 73 70 65 65 64 73 5b 72 5d 7c 7c 72 2c 65 3d 65 7c 7c 22 66 78 22 2c 74 68 69 73 2e 71 75 65 75 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 43 2e 73 65 74 54 69 6d 65 6f 75 74 28 65 2c 72 29 3b 74 2e 73 74 6f 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 43 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 6e 29 7d 7d 29 7d 2c 72 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 2c 69 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 65 6c 65 63 74 22 29 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 6f 70 74 69 6f 6e 22 29 29 2c 72 74 2e 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 2c 79 2e 63 68 Data Ascii: ){return r=S.fx&&S.fx.speeds[r]\|\|r,e=e\|\|"fx",this.queue(e,function(e,t){var n=C.setTimeout(e,r);t.stop=function(){C.clearTimeout(n)}})},rt=E.createElement("input"),it=E.createElement("select").appendChild(E.createElement("option")),rt.type="checkbox",y.ch
2024-07-04 22:20:17 UTC	8130	IN	Data Raw: 7b 53 28 74 68 69 73 29 2e 72 65 70 6c 61 63 65 57 69 74 68 28 74 68 69 73 2e 63 68 69 6c 64 4e 6f 64 65 73 29 7d 29 2c 74 68 69 73 7d 7d 29 2c 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 68 69 64 64 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 76 69 73 69 62 6c 65 28 65 29 7d 2c 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 76 69 73 69 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 21 28 65 2e 6f 66 66 73 65 74 57 69 64 74 68 7c 7c 65 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7c 7c 65 2e 67 65 74 43 6c 69 65 6e 74 52 65 63 74 73 28 29 2e 6c 65 6e 67 74 68 29 7d 2c 53 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 78 68 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 Data Ascii: {S(this).replaceWith(this.childNodes)}),this}}),S.expr.pseudos.hidden=function(e){return!S.expr.pseudos.visible(e)},S.expr.pseudos.visible=function(e){return!!(e.offsetWidth\|\|e.offsetHeight\|\|e.getClientRects().length)},S.ajaxSettings.xhr=function(){try{re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	18.245.162.13	443	3720	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:20:17 UTC	621	OUT	GET /658cec990fe960c2d842cbdb/css/metaioseklcogin.webflow.5e22c9479.css HTTP/1.1 Host: assets-global.website-files.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://metaioseklcogin.webflow.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:20:17 UTC	638	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 8349 Connection: close Date: Thu, 04 Jul 2024 22:20:18 GMT Last-Modified: Thu, 28 Dec 2023 03:38:04 GMT Etag: "5fcca36659ec716141950a9b3718ee2f" X-Amz-Server-Side-Encryption: AES256 Cache-Control: max-age=84600, must-revalidate Content-Encoding: gzip X-Amz-Version-Id: bfgi9GpljHyrtJ9Wcq5TqHMsli_oItVC Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 310376e5a20c07d438beee7fb9acf51c.cloudfront.net (CloudFront) Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront X-Amz-Cf-Pop: LHR5-P2 X-Amz-Cf-Id: w-fmoFs1kv0HLzB_TjTH4YI7FVbuiR3M9QZ1KesySnlBzo3DUkxvxQ==
2024-07-04 22:20:17 UTC	8349	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 3d d9 72 e3 38 92 ef fd 15 5c 77 4c 44 55 97 65 53 a7 25 57 74 c7 50 87 6d b9 2c 95 e5 5b ae a8 8d a0 48 8a a2 cd 43 23 52 97 27 26 62 76 f7 27 f6 03 f6 fb f6 1b 36 01 f0 00 40 90 a2 5c d5 b1 e3 2a 5b 22 98 48 24 12 99 89 44 22 09 ce 02 c7 96 fe fe 8b 24 95 1c bf 14 18 9b a0 e4 5b 6f 46 49 d5 5f 96 7e 70 2a 95 65 f9 2f 9f d1 dd b5 31 79 b5 82 1c 88 a9 e7 06 a5 a9 ea 58 f6 f6 54 f2 55 d7 2f f9 c6 c2 9a 7e fe e5 1f bf fc 32 f1 f4 2d 6e c4 51 17 a6 e5 9e 4a 32 2e 56 17 81 a5 d9 c6 a1 a4 fa 96 0e 1f ba 11 a8 96 ed 1f 4a 53 cb d4 d4 79 60 79 2e fe be 5c c0 cd a9 e7 05 c6 e2 50 9a 19 aa 8e 3f cd 85 b7 9c 1f 02 4a 0b a0 1c c3 5d 1e 4a ae ba 3a 94 7c 43 23 35 fd a5 03 ed 91 86 75 cb 9f db 2a 50 36 b1 3d ed 95 b4 be d4 2d ef 50 d2 Data Ascii: =r8\wLDUeS%WtPm,[HC#R'&bv'6@\["H$D"$[oFI_~pe/1yXTU/~2-nQJ2.VJSy`y.\P?J]J:\|C#5u*P6=-P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	18.245.162.13	443	3720	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:20:17 UTC	589	OUT	GET /658cec990fe960c2d842cbdb/js/webflow.235cb1a9b.js HTTP/1.1 Host: assets-global.website-files.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://metaioseklcogin.webflow.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:20:17 UTC	646	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 13749 Connection: close Date: Thu, 04 Jul 2024 22:20:18 GMT Last-Modified: Thu, 28 Dec 2023 03:38:04 GMT Etag: "5e0038fa5c16dd501aa22bfde680e147" X-Amz-Server-Side-Encryption: AES256 Cache-Control: max-age=84600, must-revalidate Content-Encoding: gzip X-Amz-Version-Id: Ab_ztBRRRPLPv.RkeNCNHMyRR.abI2MZ Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 20b4df37ae65ece5b6c10c53388c5dc4.cloudfront.net (CloudFront) Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront X-Amz-Cf-Pop: LHR5-P2 X-Amz-Cf-Id: G-5ja2hgBqOOVeGl_46_t-yvgdsiJqV_aHJYee0av5HG4YH7HzRWWQ==
2024-07-04 22:20:17 UTC	13749	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c5 7d fb 5b da ca d6 f0 ef fb af c0 1c 0f 4d 64 08 60 ef d0 29 af b5 da da 6a ed b6 b6 b6 45 b6 3b c0 00 a9 90 60 32 88 28 bc 7f fb b7 d6 5c 92 09 17 eb d9 ef 79 9e ef d9 bb 32 f7 59 b3 66 cd ba cd 25 7f 94 b6 36 fe c8 6d e5 ce 58 ab 3b 08 27 d5 dc 7e 14 06 bc c8 82 4e 2e f6 39 cb 0d fc 56 e4 45 53 2c f2 3f 03 bf cd 82 98 e5 8e 0e 4e 31 7e 10 0c fc 80 e5 e2 76 e4 8f 78 9c 1b 7a d3 9c d7 6e b3 38 ce f1 3e cb 79 23 3f 37 8e fd a0 97 f3 82 9c 17 4f 83 76 ae ef 05 9d 01 8b aa 58 39 97 bb f6 22 dd 6b 8e 26 a1 d9 2c d7 68 d6 64 09 95 e6 8e c6 71 df 8e 98 d7 99 ee 8f 83 36 f7 c3 c0 c1 12 a5 3f fe b0 6d 87 be be c3 96 06 9c da 8c 4c 21 8a 49 f6 74 36 63 b6 3d a5 77 ec 66 14 46 3c ae de cd e7 8e ab 22 50 8c 4c 75 c4 a9 61 f5 cf 9c 0e Data Ascii: }[Md`)jE;`2(\y2Yf%6mX;'~N.9VES,?N1~vxzn8>y#?7OvX9"k&,hdq6?mL!It6c=wfF<"PLua

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	18.245.162.13	443	3720	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:20:18 UTC	671	OUT	GET /658cec990fe960c2d842cbdb/658ced94adc727c27bb15f04_MetaMask_Fox.svg.png HTTP/1.1 Host: assets-global.website-files.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://metaioseklcogin.webflow.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:20:19 UTC	629	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1755 Connection: close Date: Wed, 03 Jul 2024 22:20:14 GMT Last-Modified: Thu, 28 Dec 2023 03:37:58 GMT Etag: "e0675d3650a072904da930dc2fc9c729" X-Amz-Server-Side-Encryption: AES256 Cache-Control: max-age=31536000, must-revalidate X-Amz-Version-Id: LzUuHB4cmEFXNat7E9L1kP14rUX_lx_d Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 e7ce508ea436f9dfba9e3864b3102646.cloudfront.net (CloudFront) Age: 86405 Access-Control-Allow-Origin: * X-Cache: Hit from cloudfront X-Amz-Cf-Pop: LHR5-P2 X-Amz-Cf-Id: P1i7uW63aHA0XxZOXxcEWAy-gJSodiWr8Jk60uHi4-cQQ7-Wpj5b5w==
2024-07-04 22:20:19 UTC	1755	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 25 74 45 58 74 64 61 74 65 3a 63 72 65 61 74 65 00 32 30 32 32 2d 30 38 2d 33 31 54 31 32 3a 32 35 3a 35 30 2b 30 30 3a 30 30 dd 69 50 3e 00 00 00 25 74 45 58 74 64 61 74 65 3a 6d 6f 64 69 66 79 00 32 30 32 32 2d 30 38 2d 33 31 54 31 32 3a 32 35 3a 35 30 2b 30 30 3a 30 30 ac 34 e8 82 00 00 05 dd 49 44 41 54 58 47 e5 56 5b 6c 14 55 18 fe 66 76 67 67 77 da dd Data Ascii: PNGIHDR szzgAMAa cHRMz&u0`:pQ<pHYs+bKGD%tEXtdate:create2022-08-31T12:25:50+00:00iP>%tEXtdate:modify2022-08-31T12:25:50+00:004IDATXGV[lUfvggw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	18.245.162.13	443	3720	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:20:18 UTC	670	OUT	GET /658cec990fe960c2d842cbdb/658cecd186303d8f3a24cfe1_metamas-banner_.jpg HTTP/1.1 Host: assets-global.website-files.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://metaioseklcogin.webflow.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:20:19 UTC	631	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 67389 Connection: close Date: Wed, 03 Jul 2024 22:20:14 GMT Last-Modified: Thu, 28 Dec 2023 03:34:43 GMT Etag: "789ee2a125e78f503ed9ade1c0d8c922" X-Amz-Server-Side-Encryption: AES256 Cache-Control: max-age=31536000, must-revalidate X-Amz-Version-Id: fG7fmyLhaqs2B6AjOD98j4jXkzmMwvmK Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 fc04a806354711fcd17762fa99ff51ba.cloudfront.net (CloudFront) Age: 86406 Access-Control-Allow-Origin: * X-Cache: Hit from cloudfront X-Amz-Cf-Pop: LHR5-P2 X-Amz-Cf-Id: S3Z9AbU_WgI126JjpwmBdYfpwNyUjAYOk06UMRDMa8dS_5z1CMk2ng==
2024-07-04 22:20:19 UTC	15753	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 03 03 03 03 03 03 04 04 04 04 05 05 05 05 05 07 07 06 06 07 07 0b 08 09 08 09 08 0b 11 0b 0c 0b 0b 0c 0b 11 0f 12 0f 0e 0f 12 0f 1b 15 13 13 15 1b 1f 1a 19 1a 1f 26 22 22 26 30 2d 30 3e 3e 54 01 05 05 05 05 05 05 05 06 06 05 08 08 07 08 08 0b 0a 09 09 0a 0b 11 0c 0d 0c 0d 0c 11 1a 10 13 10 10 13 10 1a 17 1b 16 15 16 1b 17 29 20 1c 1c 20 29 2f 27 25 27 2f 39 33 33 39 47 44 47 5d 5d 7d ff c2 00 11 08 02 fc 04 f0 03 01 11 00 02 11 01 03 11 01 ff c4 00 36 00 01 00 00 07 01 01 00 00 00 00 00 00 00 00 00 00 00 01 03 04 05 06 07 08 09 02 01 01 00 03 01 01 01 01 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 f5 4c 00 00 00 00 00 00 00 00 00 00 Data Ascii: JFIF&""&0-0>>T) )/'%'/9339GDG]]}6L
2024-07-04 22:20:19 UTC	16384	IN	Data Raw: 10 e7 4d 30 2a 8f 97 8e db fc f8 26 70 4c e0 99 c1 33 8a 8f 97 b9 c5 73 82 60 00 78 8f 47 e7 91 c7 c7 fb e9 d7 90 c6 1c 4e d9 17 53 6f 87 6b 19 c6 c6 71 b1 9c 6c 67 1b 39 c6 c6 71 b3 8b cc 0f 3f 3c f3 cf 3c f3 cf 3c f3 cf 3c f3 cf 3c f3 cf 3c f3 cf 3c f3 cf 3c 1e 87 cf 12 3e 1f 90 b3 d5 e9 7e 9f 53 8c 33 34 3d 79 76 41 9d d3 2a cf ca 59 ad 0e 96 d2 cc 20 8b 9b a5 ce 6d c0 47 6b ac db 22 da 90 c6 b2 91 27 49 ec 1c 13 38 7e 12 75 7a d1 c2 ee 6d 3f ea 9c 33 39 72 b1 41 37 59 0b 64 32 4a 91 b9 1d 64 59 a4 97 04 d2 06 51 22 cf 2b fc 49 1c bc 66 9d 13 af 2b 16 e9 f3 93 bb 93 87 73 c8 47 c2 49 ba 89 32 4a 67 97 a9 22 a0 95 4c 42 5c 36 65 55 57 3d 79 59 a4 09 dd 16 31 88 e6 94 bc 64 37 55 22 69 b6 eb 3c 6a c6 53 3c ca d1 87 ea 4a d1 59 eb 75 5b 7e 11 1b 67 8c 7c Data Ascii: M0&pL3s`xGNSokqlg9q?<<<<<<<<>~S34=yvAY mGk"'I8~uzm?39rA7Yd2JdYQ"+If+sGI2Jg"LB\6eUW=yY1d7U"i<jS<JYu[~g\|
2024-07-04 22:20:19 UTC	16384	IN	Data Raw: 8c 3a 87 be 1c af 58 a1 bd 5c 0f e0 9a 69 1f bb c1 0f ef ed 32 f1 97 ab ba 8f 3c 10 c3 5c ea 2a 07 ca 3e 02 6a ef a4 39 2e 9a f6 1f da 70 f6 20 37 10 da 8b 80 d2 31 d0 4a d5 f0 83 b3 e4 92 f9 67 0f f2 0d fb 4a d3 6a 5e 48 82 88 96 66 63 f2 5b 81 9e ab 42 3a 25 fa dc 59 ed 59 c2 af 75 3f d6 f6 7f 6b 8d 49 3a 7e 8f b8 95 0e 21 a6 db 4a 58 cc 0f 38 42 d4 01 3e 29 73 df be cf 84 1e 72 7a 03 43 eb 32 6a d8 b0 f4 18 06 af 6a 5e f3 21 8c 7d 10 ef 89 dd 57 1e e3 9f 77 ae 39 2d 41 10 5e 4a 43 ba 00 9e 72 e4 72 4d ab 77 a2 c8 f7 8f 4a fb 75 15 4e f5 1a 61 93 05 dd 11 14 73 eb a7 60 fc 3e 6e 18 c3 47 27 80 a0 fc ca af 94 d4 09 5d 66 68 9a 11 75 d6 65 dd 8a 6f 46 06 74 14 1d 0f 94 e3 41 cc d3 f5 8b e0 83 9a 1b a1 95 4c bd 6e ef 00 b1 20 8d c7 0c 4d 05 6a 9b 2c 9a 00 Data Ascii: :X\i2<\*>j9.p 71JgJj^Hfc[B:%YYu?kI:~!JX8B>)srzC2jj^!}Ww9-A^JCrrMwJuNas`>nG']fhueoFtALn Mj,
2024-07-04 22:20:19 UTC	15439	IN	Data Raw: d6 37 02 f9 09 8d 48 03 90 bf 48 7c 25 8f 46 ab e8 b4 c3 8e 3f a8 96 5b 25 e8 f6 b8 10 56 b8 0c e8 f2 c1 88 0f ab f0 78 ae 8b 42 bb ac b9 97 02 b0 b7 c4 34 7c b1 e0 db 79 5e 19 fd b2 ee 3a d8 9a f1 d4 56 f2 ff 00 83 a1 03 21 fa c2 98 3c 3a be d4 1e 10 08 85 61 01 62 27 cf 12 75 48 15 60 79 23 80 80 5b b1 92 83 49 df 99 8a 00 70 05 94 27 77 1e 22 a6 ca ca c7 d2 85 f0 56 2e be fd 94 a8 64 e3 11 cb a0 e6 28 cd f1 cb f0 94 2c ba 97 ff 00 f4 e4 18 ac ed ec 07 82 77 b6 ec bf 8f 96 6a dc 9a 06 cb 00 24 4f d1 68 f7 77 d5 8f 8b 5e 96 40 56 19 03 25 fd 3e 7b 8f 33 64 e1 f4 3d 47 ad 7d 23 da 49 b9 81 46 80 f8 2c 03 3b a6 06 d8 88 1e 03 5f 56 52 55 fc 44 12 70 e2 f6 77 32 73 2e fe 87 cb 11 60 8b e1 ff 00 3a 1d 51 34 65 00 a1 a3 c4 60 e8 fa 44 ae e8 71 48 cc 21 08 bb Data Ascii: 7HH\|%F?[%VxB4\|y^:V!<:ab'uH`y#[Ip'w"V.d(,wj$Ohw^@V%>{3d=G}#IF,;_VRUDpw2s.`:Q4e`DqH!
2024-07-04 22:20:19 UTC	3429	IN	Data Raw: ba a4 bb a4 9e 41 a3 88 b7 88 35 0a 3e a8 f1 36 9f d9 fa 2d a3 77 11 85 fd a0 a2 fb 17 0d ed 25 49 7b 38 26 fd 9b d9 62 3e 6b ee e2 ca b6 9d ff 00 66 b6 94 52 c3 7e 61 c7 45 4d 53 1d 5c 4c 95 8e 04 10 8f 1f 15 ce b6 6a a6 a7 17 45 be c9 2a 3e bb 7e 6a 76 97 b5 c0 71 51 f4 ac 42 aa 90 17 13 ba c0 2a 61 68 65 ff 00 aa 77 9e 62 a9 69 73 89 1a 10 2c a2 be 10 d2 2c 54 c5 a2 30 cb de c0 dd 50 dd b4 ef 66 f2 a5 16 91 84 69 bc a6 8b 8b 93 60 9a 6c eb 38 58 9d 15 47 58 f1 c2 d5 87 9c 87 18 d0 a8 ce 17 59 ca 70 5e 41 1a 16 85 08 2d 18 08 b1 4f e8 91 bd 44 43 99 25 bb 29 e2 d3 45 f2 2a 3e a4 9f f5 4e ce 68 be aa a4 63 73 be 20 59 43 7b 61 de 14 a6 f1 b5 9b db 75 44 6f cd 9f 8a ab f3 6e ff 00 b0 ff 00 6a 1f 31 37 c9 a9 c3 14 ac 51 79 a9 be 89 de 71 a3 90 8c 71 34 6e Data Ascii: A5>6-w%I{8&b>kfR~aEMS\LjE>~jvqQBahewbis,,T0Pfi`l8XGXYp^A-ODC%)E*>Nhcs YC{auDonj17Qyqq4n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	18.239.69.126	443	3720	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:20:19 UTC	425	OUT	GET /658cec990fe960c2d842cbdb/658ced94adc727c27bb15f04_MetaMask_Fox.svg.png HTTP/1.1 Host: assets-global.website-files.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:20:20 UTC	631	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1755 Connection: close Date: Tue, 02 Jul 2024 22:22:27 GMT Last-Modified: Thu, 28 Dec 2023 03:37:58 GMT Etag: "e0675d3650a072904da930dc2fc9c729" X-Amz-Server-Side-Encryption: AES256 Cache-Control: max-age=31536000, must-revalidate X-Amz-Version-Id: LzUuHB4cmEFXNat7E9L1kP14rUX_lx_d Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 ee6fa75e712f6cdc2fa03f92f2cfbde0.cloudfront.net (CloudFront) Age: 172674 Access-Control-Allow-Origin: * X-Cache: Hit from cloudfront X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: 5wVy6bUElJQr32ERrzEm-JdbrvbY38WAY19Tc8NiaiJjpy_XdLgaXA==
2024-07-04 22:20:20 UTC	1755	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 25 74 45 58 74 64 61 74 65 3a 63 72 65 61 74 65 00 32 30 32 32 2d 30 38 2d 33 31 54 31 32 3a 32 35 3a 35 30 2b 30 30 3a 30 30 dd 69 50 3e 00 00 00 25 74 45 58 74 64 61 74 65 3a 6d 6f 64 69 66 79 00 32 30 32 32 2d 30 38 2d 33 31 54 31 32 3a 32 35 3a 35 30 2b 30 30 3a 30 30 ac 34 e8 82 00 00 05 dd 49 44 41 54 58 47 e5 56 5b 6c 14 55 18 fe 66 76 67 67 77 da dd Data Ascii: PNGIHDR szzgAMAa cHRMz&u0`:pQ<pHYs+bKGD%tEXtdate:create2022-08-31T12:25:50+00:00iP>%tEXtdate:modify2022-08-31T12:25:50+00:004IDATXGV[lUfvggw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49745	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:20:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-04 22:20:20 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=31422 Date: Thu, 04 Jul 2024 22:20:20 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:20:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-04 22:20:21 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=31442 Date: Thu, 04 Jul 2024 22:20:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-04 22:20:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	18.239.69.126	443	3720	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:20:21 UTC	424	OUT	GET /658cec990fe960c2d842cbdb/658cecd186303d8f3a24cfe1_metamas-banner_.jpg HTTP/1.1 Host: assets-global.website-files.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:20:21 UTC	633	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 67389 Connection: close Date: Tue, 02 Jul 2024 22:22:27 GMT Last-Modified: Thu, 28 Dec 2023 03:34:43 GMT Etag: "789ee2a125e78f503ed9ade1c0d8c922" X-Amz-Server-Side-Encryption: AES256 Cache-Control: max-age=31536000, must-revalidate X-Amz-Version-Id: fG7fmyLhaqs2B6AjOD98j4jXkzmMwvmK Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 13676fca7076b460ad3ad018e40a51da.cloudfront.net (CloudFront) Age: 172675 Access-Control-Allow-Origin: * X-Cache: Hit from cloudfront X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: O0XWDrM-fM5NmtRLoO_bd1VFd765fTYFah6BFiPso-Ng87f0eBWRVA==
2024-07-04 22:20:21 UTC	16384	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 03 03 03 03 03 03 04 04 04 04 05 05 05 05 05 07 07 06 06 07 07 0b 08 09 08 09 08 0b 11 0b 0c 0b 0b 0c 0b 11 0f 12 0f 0e 0f 12 0f 1b 15 13 13 15 1b 1f 1a 19 1a 1f 26 22 22 26 30 2d 30 3e 3e 54 01 05 05 05 05 05 05 05 06 06 05 08 08 07 08 08 0b 0a 09 09 0a 0b 11 0c 0d 0c 0d 0c 11 1a 10 13 10 10 13 10 1a 17 1b 16 15 16 1b 17 29 20 1c 1c 20 29 2f 27 25 27 2f 39 33 33 39 47 44 47 5d 5d 7d ff c2 00 11 08 02 fc 04 f0 03 01 11 00 02 11 01 03 11 01 ff c4 00 36 00 01 00 00 07 01 01 00 00 00 00 00 00 00 00 00 00 00 01 03 04 05 06 07 08 09 02 01 01 00 03 01 01 01 01 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 f5 4c 00 00 00 00 00 00 00 00 00 00 Data Ascii: JFIF&""&0-0>>T) )/'%'/9339GDG]]}6L
2024-07-04 22:20:21 UTC	16384	IN	Data Raw: 01 63 88 81 3f 24 ce a8 37 3e ff 00 5a 2e 7c 31 64 47 24 2f 80 9e 26 db 6e bc 5e 5e a3 ba a0 f8 b1 1d 64 50 cb 91 c8 92 a0 74 0e a5 99 7f 20 cb 90 e9 e1 6e f2 c1 86 60 ac 46 75 86 fb 67 58 6f b6 19 80 c5 93 91 f5 a4 4e 63 6f 01 ee 80 58 e2 20 41 f9 3b bb f4 7c 9b aa 92 2a 62 cf 24 bd 24 12 b3 99 52 25 69 66 8f 9e 49 66 4f d4 74 57 b2 bc b7 af cc c4 ac e5 52 4f d1 85 3e ee 5c 6e b3 d8 91 04 72 cd b5 79 0f 36 73 09 31 3b 28 40 3a 93 18 1a 7c de 69 67 65 10 c8 cf 5d 5c 89 9f a3 55 b0 49 2a cf b4 91 cd 6e 45 59 42 99 dd e7 da b3 b9 66 57 96 79 d4 c9 12 f7 6e fb bc 7b c9 14 a8 a7 f5 1a ac 4e fb cb 37 54 88 e7 6a f0 41 bc 33 4c ef 1c 45 25 96 5e 8a 61 92 48 1a ce 42 6c 75 36 6f c7 11 b8 cd b6 f0 e0 a7 36 19 c1 73 8a e6 c0 7c bf 66 01 63 88 81 47 e5 24 8d 25 5e Data Ascii: c?$7>Z.\|1dG$/&n^^dPt n`FugXoNcoX A;\|b$$R%ifIfOtWRO>\nry6s1;(@:\|ige]\UInEYBfWyn{N7TjA3LE%^aHBlu6o6s\|fcG$%^
2024-07-04 22:20:21 UTC	16384	IN	Data Raw: 9d e1 62 69 85 b0 3a 31 eb d6 41 47 78 8d 34 87 4f 41 eb 16 44 0a b1 05 5e 9e b1 3a 07 38 4e d0 5b 56 89 63 f2 1d 3c 33 47 c6 29 a4 d2 23 fa dc d6 54 ef 34 b1 f1 3e a5 6a a9 7a ab 60 b2 f9 81 d0 ec de 93 f8 55 22 69 c4 8e 2c 4d a7 1b 2d 06 d3 e8 b5 aa c9 a7 c2 50 f8 81 d6 f1 08 57 37 f2 f2 f8 1d 06 86 b4 6f 02 0d 14 53 17 65 da 32 73 77 91 63 4f ea 67 97 72 61 50 ae e4 02 da 6d a0 1b 0a da 5e 80 36 85 57 7b 9b 62 6a eb e4 3a 4f 74 9a 3e 58 a6 93 49 7e 70 90 de 2a 0b 6a fe 92 6e 96 46 80 6b 17 d3 27 a8 97 6f 28 30 9d e4 d3 f0 f2 88 cf 16 10 9c 25 e9 34 74 ea a9 5d 23 32 37 2f f7 07 ce 01 ee 13 a7 b8 bd d3 c4 4b 13 0a 0c ed 15 c5 f9 3d 20 a1 63 8d 63 96 11 cc 2c b7 2b b1 4d 76 44 ab 55 67 f4 79 66 51 5f d8 1d 7f 4c af 3a 6d c1 af 92 2b dc 7a a0 77 99 dc 9f Data Ascii: bi:1AGx4OAD^:8N[Vc<3G)#T4>jz`U"i,M-PW7oSe2swcOgraPm^6W{bj:Ot>XI~p*jnFk'o(0%4t]#27/K= cc,+MvDUgyfQ_L:m+zw
2024-07-04 22:20:22 UTC	16384	IN	Data Raw: 08 98 86 75 38 08 8c 63 78 95 0b da da 50 8a 98 45 0a 78 2c 2b 13 25 29 57 5d e5 08 80 96 d1 5d 55 d0 49 98 16 da a4 82 53 ba f7 32 5c 89 5a 61 31 66 4b d4 30 04 08 00 50 0c 54 c5 ee 1d a5 77 ad 4a 2c 72 22 ca c2 36 bb d9 5a 8f 0c 09 5d d9 b4 21 23 71 56 ec b2 a0 b5 5a 8b b9 a6 e7 29 33 ac 53 24 47 bf 4b 26 48 aa 48 f9 e9 ea 97 5c 51 bb 37 cc bc e2 1f 0d d2 b3 11 53 88 a1 4c a2 c2 b0 1d 20 bb 9d df 54 b6 ab 51 0f 7d a6 f8 a5 ab d1 e6 d0 f6 96 ef eb 49 f3 ea 99 cb c5 a8 5c 2a 2b da b5 57 c8 ff 00 10 2a c9 64 42 22 af 46 26 02 50 6d 50 e4 5b 1f 48 2a ee 2d 2a bb 2a 5b 01 8a 99 bb cb c6 b7 03 5d c1 db 1f e0 63 61 83 ae 23 6f ec cb df 72 35 1c 02 cc 49 a5 fa d5 d0 a1 74 1d 73 00 51 80 3f c0 ba 97 f2 d6 50 5a db 4f 07 f4 e9 9f f0 73 1a e6 63 47 71 7b 0e ec 0a Data Ascii: u8cxPEx,+%)W]]UIS2\Za1fK0PTwJ,r"6Z]!#qVZ)3S$GK&HH\Q7SL TQ}I\+WdB"F&PmP[H-*[]ca#or5ItsQ?PZOscGq{
2024-07-04 22:20:22 UTC	1853	IN	Data Raw: 26 ba c6 e1 31 b8 45 bd 14 bf 12 b5 bd 18 6a 14 7d 50 87 29 36 47 35 24 82 36 92 4a 9a 63 29 f8 7b 4a dc bf 15 bf 97 76 48 e4 5b 74 75 20 ad d9 72 10 46 3c ba b6 c5 f5 4e ca e0 fa ba fd 57 c3 c9 9d 09 39 00 86 67 2d 53 4d c5 d5 b3 0b 52 55 f3 b6 f1 af 2f 0f 17 4e 51 c9 a1 e5 1c b7 b2 d1 69 cb c3 d1 f4 5a f2 dd 5d 5d 5f d0 06 a1 47 d5 08 72 de ea 59 44 60 a9 66 74 a7 e1 ed 30 8d 8b 9a 8d da d7 35 e7 f3 0e 88 d8 30 65 af f0 83 4b c3 9a c3 d3 3a 21 84 1b 6f 67 5c 26 02 e7 b7 81 d4 28 5e 64 6d ca 79 20 38 6f 2a 4d 21 3c 6f 74 7f a4 3b 57 ba 02 ec 7b bb 24 27 d8 36 ad a3 40 59 65 35 83 aa 9d 6c c6 0b 26 8e 71 dd 95 8a e2 3b 0b 62 bd d4 60 e4 09 ba 6b af 03 de 45 88 b7 fb 4f 1d 21 63 d1 4f 36 3d 14 32 9c b4 f5 6c 0d 91 36 c3 7c ae 51 16 c6 4e 42 dd 10 9a 6e d6 Data Ascii: &1Ej}P)6G5$6Jc){JvH[tu rF<NW9g-SMRU/NQiZ]]_GrYD`ft050eK:!og\&(^dmy 8o*M!<ot;W{$'6@Ye5l&q;b`kEO!cO6=2l6\|QNBn

Target ID:	0
Start time:	18:20:07
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:20:11
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2296,i,4188136114675171219,13452510514202242541,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	18:20:13
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://metaioseklcogin.webflow.io/"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://metaioseklcogin.webflow.io/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 47

Chrome Cache Entry: 48

Chrome Cache Entry: 49

Chrome Cache Entry: 50

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 4948, Parent PID: 1076

General

Chronological Activities

Analysis Process: chrome.exePID: 3720, Parent PID: 4948

General

Chronological Activities

Windows Analysis Report
https://metaioseklcogin.webflow.io/