Edit tour

Windows Analysis Report
http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/

Overview

General Information

Sample URL:	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/
Analysis ID:	1467907
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected BlockedWebSite

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3380 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2496,i,4737292741680263157,11270633537139994011,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_42	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security
0.1.pages.csv	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Avira URL Cloud: detection malicious, Label: phishing
Source: http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social usering

Antivirus detection for URL or domain

Source: https://business.ifbsmetaiidentiityconfirms.com/cdn-cgi/styles/cf.errors.css	Avira URL Cloud: Label: malware
Source: https://business.ifbsmetaiidentiityconfirms.com/favicon.ico	Avira URL Cloud: Label: malware
Source: https://business.ifbsmetaiidentiityconfirms.com/cdn-cgi/images/icon-exclamation.png?1376755637	Avira URL Cloud: Label: malware

Phishing

Yara detected BlockedWebSite

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_42, type: DROPPED

Source: https://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	HTTP Parser: No favicon
Source: https://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49734 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49743 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49734 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	HTTP traffic detected: GET /meta-community-standard100068928266341/ HTTP/1.1Host: business.ifbsmetaiidentiityconfirms.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/styles/cf.errors.css HTTP/1.1Host: business.ifbsmetaiidentiityconfirms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1Host: business.ifbsmetaiidentiityconfirms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://business.ifbsmetaiidentiityconfirms.com/cdn-cgi/styles/cf.errors.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: business.ifbsmetaiidentiityconfirms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1Host: business.ifbsmetaiidentiityconfirms.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: business.ifbsmetaiidentiityconfirms.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: business.ifbsmetaiidentiityconfirms.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_41.2.dr, chromecache_45.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: chromecache_41.2.dr, chromecache_45.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:100
Source: chromecache_42.2.dr	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: chromecache_42.2.dr	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49743 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@17/10@8/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2496,i,4737292741680263157,11270633537139994011,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2496,i,4737292741680263157,11270633537139994011,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	100%	Avira URL Cloud	phishing
http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	100%	SlashNext	Credential Stealing type: Phishing & Social usering

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://cdn.jsdelivr.net/npm/bootstrap	0%	URL Reputation	safe
https://business.ifbsmetaiidentiityconfirms.com/cdn-cgi/styles/cf.errors.css	100%	Avira URL Cloud	malware
https://www.cloudflare.com/learning/access-management/phishing-attack/	0%	Avira URL Cloud	safe
https://www.cloudflare.com/5xx-error-landing	0%	Avira URL Cloud	safe
https://business.ifbsmetaiidentiityconfirms.com/favicon.ico	100%	Avira URL Cloud	malware
https://business.ifbsmetaiidentiityconfirms.com/cdn-cgi/images/icon-exclamation.png?1376755637	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
business.ifbsmetaiidentiityconfirms.com	188.114.96.3	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://business.ifbsmetaiidentiityconfirms.com/cdn-cgi/images/icon-exclamation.png?1376755637	false	Avira URL Cloud: malware	unknown
https://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	false		unknown
https://business.ifbsmetaiidentiityconfirms.com/favicon.ico	false	Avira URL Cloud: malware	unknown
https://business.ifbsmetaiidentiityconfirms.com/cdn-cgi/styles/cf.errors.css	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	chromecache_42.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/npm/bootstrap	chromecache_41.2.dr, chromecache_45.2.dr	false	URL Reputation: safe	unknown
https://www.cloudflare.com/5xx-error-landing	chromecache_42.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467907
Start date and time:	2024-07-05 00:51:40 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@17/10@8/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 142.250.186.46, 66.102.1.84, 34.104.35.123, 40.127.169.103, 192.229.221.95, 20.3.187.198, 199.232.214.172, 52.165.164.15, 142.250.186.163, 93.184.221.240
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, update.googleapis.com, hlb.apr-52dd2-0.edgecastdns.net, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: https://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/ Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The title of the webpage suggests that it is a suspected phishing site, which is a negative factor.","The text on the webpage warns about potential phishing and encourages the user to ignore the site and proceed, which may create a sense of caution rather than urgency.","There is no CAPTCHA or other anti-robot detection mechanism present on the webpage, which may make it easier for automated tools to access the site.","The text on the webpage does not contain any language that creates a sense of urgency or interest, such as 'click here to view document' or 'open the link to see your invoice'."]}
Title: Suspected phishing site \| Cloudflare OCR: O Warning Suspected Phishing This website has been reported for potential phishing. Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source. Leam More Ignore & Proceed Cloudflare Ray 10: 89e2afb47b7342de Your IP: Click to reveal Performance & security by Cloudflare
URL: https://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/ Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The title of the webpage suggests that it is a suspected phishing site, which is a red flag.","The text contains a warning about potential phishing and explains what phishing is, indicating that the site may be attempting to steal sensitive information.","The webpage does not contain a login form, which suggests that it may be trying to trick users into providing their login credentials on a fake page.","The text does not create a sense of urgency or interest, which is a common tactic used in phishing attacks to get users to act quickly without thinking.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism, which is a simple security measure that can help prevent automated attacks."]}
Title: Suspected phishing site \| Cloudflare OCR: O Warning Suspected Phishing This website has been reported for potential phishing. Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source. Leam More Ignore & Proceed Claudflare Ray ID: 89e2afb47b7342de Performance & security by Claudflare Your 19:846.123.33

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 41

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1149), with no line terminators
Category:	dropped
Size (bytes):	1149
Entropy (8bit):	5.087435219173736
Encrypted:	false
SSDEEP:	24:0E0OeofGGVomXJXy7qV3fYbWPDnS2s/sWrVq75G5/a:0E9be3mX5yePdbS2VWENuS
MD5:	F66D7EC97333454A5B8172D55C6442E1
SHA1:	3273ABA466B8CEED3F0350B50AD9A74A811417D5
SHA-256:	9276995A14A6343187CEBC85995859F867CC93C70C3812AF024F19B58725F187
SHA-512:	BB8EB780503D0CFDA085E19B4E430589A72239A08AE31D700376F1F9D991177FAFE7435A6879B6D0629B3CE4D8E787714078167C997C4DCF7B6684EDB2C6E769
Malicious:	false
Reputation:	low
Preview:	<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta property="og:type" content="article"/><meta property="og:title" content="We have scheduled your page to be deleted"/><meta name="description" content="We have received several reports that your account violates our terms of service and community guidelines. As a result, your account will be sent for verification."/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no"><meta property="og:image" content="./banner-meta.png"/><meta name="theme-color" content="#000000"/><link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,700&display=swap"/><link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"><link rel="icon" href="./favicon.png"/><title>Meta \| Facebook</title><script defer="defer" sr

Chrome Cache Entry: 42

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (394)
Category:	downloaded
Size (bytes):	4433
Entropy (8bit):	5.100586524677156
Encrypted:	false
SSDEEP:	96:1j9jwIjYjUDK/D5DMF+BOisBjrA2ZLim8rR49PaQxJbGD:1j9jhjYjIK/Vo+tsB5ZOm8rO9ieJGD
MD5:	66E538A2C6C448E0ECECFB85CC9EDF49
SHA1:	E803531F629CA7427D29407CCF6CA324CBBD64A6
SHA-256:	CDE24446189148B417D3A50B0A5D7AB8F07D3BB370C254B14C8B80E8C514F566
SHA-512:	50F2EDF4256AF26DA35005B79701281BBEFB9FC446FD4D5BB0B79D867A40934E6A317CBA1AAF225BD5D57CA0B2C36F3E93789B532C3CDD788060D79A89FCE2EF
Malicious:	false
Reputation:	low
URL:	https://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Suspected phishing site \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->.<style>body{margin:0;padding:0}</style>... [if gte IE 10]> >.<script>. if (!navigator.cookieEnabled) {. window.addEventListener('DOMContentLoaded

Chrome Cache Entry: 43

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 54 x 54, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.0936408308765495
Encrypted:	false
SSDEEP:	12:6v/7EljW8E6Cl2SYh8SZM4tf70FSDvMXDxJp6ScFChY9:U8hCl2SIdZBtAFSDUX/ozIhK
MD5:	C33DE66281E933259772399D10A6AFE8
SHA1:	B9F9D500F8814381451011D4DCF59CD2D90AD94F
SHA-256:	F1591A5221136C49438642155691AE6C68E25B7241F3D7EBE975B09A77662016
SHA-512:	5834FB9D66F550E6CECFE484B7B6A14F3FCA795405DECE8E652BD69AD917B94B6BBDCDF7639161B9C07F0D33EABD3E79580446B5867219F72F4FC43FD43B98C3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...6...6............3PLTE.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?..".....tRNS.@0.`........ P.p`...../IDATx.....0...l..6....+...~yJ.F"....oE..L.3..[..i2..n.WyJ..z&.....F.......b....p~...\|:t5.m...fp.i./e....%.%...n.P...enV.....!...,.......E........t![HW.B.g.R.\^.e..o+........%.&-j..q...f@..o...]... ....u0.x..2K.+C..8.U.L.Y.[=.....y...o.tF..]M..U.,4..........a.>/.)....C3gNI.i...R.=....Q7..K......IEND.B`.

Chrome Cache Entry: 44

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 54 x 54, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	452
Entropy (8bit):	7.0936408308765495
Encrypted:	false
SSDEEP:	12:6v/7EljW8E6Cl2SYh8SZM4tf70FSDvMXDxJp6ScFChY9:U8hCl2SIdZBtAFSDUX/ozIhK
MD5:	C33DE66281E933259772399D10A6AFE8
SHA1:	B9F9D500F8814381451011D4DCF59CD2D90AD94F
SHA-256:	F1591A5221136C49438642155691AE6C68E25B7241F3D7EBE975B09A77662016
SHA-512:	5834FB9D66F550E6CECFE484B7B6A14F3FCA795405DECE8E652BD69AD917B94B6BBDCDF7639161B9C07F0D33EABD3E79580446B5867219F72F4FC43FD43B98C3
Malicious:	false
Reputation:	low
URL:	https://business.ifbsmetaiidentiityconfirms.com/cdn-cgi/images/icon-exclamation.png?1376755637
Preview:	.PNG........IHDR...6...6............3PLTE.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?..".....tRNS.@0.`........ P.p`...../IDATx.....0...l..6....+...~yJ.F"....oE..L.3..[..i2..n.WyJ..z&.....F.......b....p~...\|:t5.m...fp.i./e....%.%...n.P...enV.....!...,.......E........t![HW.B.g.R.\^.e..o+........%.&-j..q...f@..o...]... ....u0.x..2K.+C..8.U.L.Y.[=.....y...o.tF..]M..U.,4..........a.>/.)....C3gNI.i...R.=....Q7..K......IEND.B`.

Chrome Cache Entry: 45

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1149), with no line terminators
Category:	downloaded
Size (bytes):	1149
Entropy (8bit):	5.087435219173736
Encrypted:	false
SSDEEP:	24:0E0OeofGGVomXJXy7qV3fYbWPDnS2s/sWrVq75G5/a:0E9be3mX5yePdbS2VWENuS
MD5:	F66D7EC97333454A5B8172D55C6442E1
SHA1:	3273ABA466B8CEED3F0350B50AD9A74A811417D5
SHA-256:	9276995A14A6343187CEBC85995859F867CC93C70C3812AF024F19B58725F187
SHA-512:	BB8EB780503D0CFDA085E19B4E430589A72239A08AE31D700376F1F9D991177FAFE7435A6879B6D0629B3CE4D8E787714078167C997C4DCF7B6684EDB2C6E769
Malicious:	false
Reputation:	low
URL:	https://business.ifbsmetaiidentiityconfirms.com/favicon.ico
Preview:	<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta property="og:type" content="article"/><meta property="og:title" content="We have scheduled your page to be deleted"/><meta name="description" content="We have received several reports that your account violates our terms of service and community guidelines. As a result, your account will be sent for verification."/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no"><meta property="og:image" content="./banner-meta.png"/><meta name="theme-color" content="#000000"/><link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,700&display=swap"/><link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"><link rel="icon" href="./favicon.png"/><title>Meta \| Facebook</title><script defer="defer" sr

Chrome Cache Entry: 46

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24050)
Category:	downloaded
Size (bytes):	24051
Entropy (8bit):	4.941039417164537
Encrypted:	false
SSDEEP:	192:VuR/6okgTQwq23gGM8lUR9YRGQ2BwoX6zp+1+nDT1FvxKSI7/UsV7MSE6XZ2dKzk:JwV+oUcoQJpdf1dxKSI7/Ue7ZX2qk
MD5:	5E8C69A459A691B5D1B9BE442332C87D
SHA1:	F24DD1AD7C9080575D92A9A9A2C42620725EF836
SHA-256:	84E3C77025ACE5AF143972B4A40FC834DCDFD4E449D4B36A57E62326F16B3091
SHA-512:	6DB74B262D717916DE0B0B600EEAD2CC6A10E52A9E26D701FAE761FCBC931F35F251553669A92BE3B524F380F32E62AC6AD572BEA23C78965228CE9EFB92ED42
Malicious:	false
Reputation:	low
URL:	https://business.ifbsmetaiidentiityconfirms.com/cdn-cgi/styles/cf.errors.css
Preview:	#cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapper del,#cf-wrapper details,#cf-wrapper dfn,#cf-wrapper div,#cf-wrapper dl,#cf-wrapper dt,#cf-wrapper em,#cf-wrapper embed,#cf-wrapper fieldset,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper form,#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper html,#cf-wrapper i,#cf-wrapper iframe,#cf-wrapper img,#cf-wrapper label,#cf-wrapper legend,#cf-wrapper li,#cf-wrapper mark,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper object,#cf-wrapper ol,#cf-wrapper output,#cf-wrapper p,#cf-wrapper pre,#cf-wrapper s,#cf-wrapper samp,#cf-wrapper section,#cf-wrapper small,#cf-wrapper span,#cf-wrapper strike,#cf-wrapper strong,#cf-wrapper sub,#cf-w

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 00:52:21.710242987 CEST	443	49708	40.113.103.199	192.168.2.6
Jul 5, 2024 00:52:21.710367918 CEST	49708	443	192.168.2.6	40.113.103.199
Jul 5, 2024 00:52:21.715607882 CEST	49708	443	192.168.2.6	40.113.103.199
Jul 5, 2024 00:52:21.715619087 CEST	443	49708	40.113.103.199	192.168.2.6
Jul 5, 2024 00:52:21.715821981 CEST	443	49708	40.113.103.199	192.168.2.6
Jul 5, 2024 00:52:21.717992067 CEST	49708	443	192.168.2.6	40.113.103.199
Jul 5, 2024 00:52:21.718159914 CEST	49708	443	192.168.2.6	40.113.103.199
Jul 5, 2024 00:52:21.718166113 CEST	443	49708	40.113.103.199	192.168.2.6
Jul 5, 2024 00:52:21.718265057 CEST	49708	443	192.168.2.6	40.113.103.199
Jul 5, 2024 00:52:21.764496088 CEST	443	49708	40.113.103.199	192.168.2.6
Jul 5, 2024 00:52:21.896559000 CEST	443	49708	40.113.103.199	192.168.2.6
Jul 5, 2024 00:52:21.897197008 CEST	443	49708	40.113.103.199	192.168.2.6
Jul 5, 2024 00:52:21.897252083 CEST	49708	443	192.168.2.6	40.113.103.199
Jul 5, 2024 00:52:21.897538900 CEST	49708	443	192.168.2.6	40.113.103.199
Jul 5, 2024 00:52:21.897556067 CEST	443	49708	40.113.103.199	192.168.2.6
Jul 5, 2024 00:52:21.897569895 CEST	49708	443	192.168.2.6	40.113.103.199
Jul 5, 2024 00:52:25.449582100 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:25.449623108 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:25.449714899 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:25.450273991 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:25.450289011 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:25.659918070 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:25.659918070 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:25.988032103 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:26.285947084 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:26.286026955 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:28.140747070 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:28.140779018 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:28.141102076 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:28.142925978 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:28.143162012 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:28.143168926 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:28.143305063 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:28.184506893 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:28.324045897 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:28.324269056 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:28.324321032 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:28.331700087 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:28.331721067 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:28.956357002 CEST	49710	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:28.956414938 CEST	443	49710	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:28.956496000 CEST	49710	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:28.962951899 CEST	49710	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:28.962981939 CEST	443	49710	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:29.863153934 CEST	443	49710	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:29.863226891 CEST	49710	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:29.866808891 CEST	49710	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:29.866822958 CEST	443	49710	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:29.867028952 CEST	443	49710	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:29.869247913 CEST	49710	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:29.869332075 CEST	49710	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:29.869338989 CEST	443	49710	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:29.869492054 CEST	49710	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:29.912509918 CEST	443	49710	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:30.042562008 CEST	443	49710	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:30.042777061 CEST	443	49710	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:30.042881966 CEST	49710	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:30.044600010 CEST	49710	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:30.044620991 CEST	443	49710	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:32.723649025 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:32.723690033 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:32.723750114 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:32.724144936 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:32.724154949 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.230407953 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.281757116 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.300623894 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.300635099 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.301712036 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.301780939 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.304450989 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.304522991 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.305059910 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.305067062 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.354717016 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.609483004 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.609524012 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.609550953 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.609577894 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.609591007 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.609611034 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.609626055 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.609668016 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.609710932 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.611941099 CEST	49716	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.611953020 CEST	443	49716	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.700416088 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.700450897 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:33.700520039 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.701073885 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:33.701086044 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.170063019 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.170721054 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.170747042 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.171036005 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.172374010 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.172430038 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.173192024 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.220498085 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.307754993 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.307794094 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.307821989 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.307837009 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.307848930 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.307873964 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.307882071 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.307888985 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.307915926 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.307954073 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.308128119 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.308128119 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.308135033 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.308589935 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.309031963 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.309037924 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.348772049 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.348778963 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.393376112 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.396800995 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.396861076 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.396897078 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.396907091 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.397182941 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.397221088 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.397227049 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.397782087 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.397841930 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.397850037 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.397867918 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.397902966 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.399194956 CEST	49719	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.399209976 CEST	443	49719	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.460427046 CEST	49720	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.460469007 CEST	443	49720	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.460525990 CEST	49720	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.460763931 CEST	49720	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.460773945 CEST	443	49720	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.913213015 CEST	49721	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:34.913254023 CEST	443	49721	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:34.913367033 CEST	49721	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:34.913907051 CEST	49721	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:34.913918972 CEST	443	49721	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:34.963449955 CEST	443	49720	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.963701963 CEST	49720	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.963726997 CEST	443	49720	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.964000940 CEST	443	49720	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.964320898 CEST	49720	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:34.964364052 CEST	443	49720	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:34.964498043 CEST	49720	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.008917093 CEST	49722	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:52:35.008940935 CEST	443	49722	172.217.18.4	192.168.2.6
Jul 5, 2024 00:52:35.008990049 CEST	49722	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:52:35.009677887 CEST	49722	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:52:35.009691000 CEST	443	49722	172.217.18.4	192.168.2.6
Jul 5, 2024 00:52:35.012490988 CEST	443	49720	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.095123053 CEST	443	49720	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.095169067 CEST	443	49720	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.095251083 CEST	49720	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.106395006 CEST	49720	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.106411934 CEST	443	49720	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.196506977 CEST	49723	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.196542025 CEST	443	49723	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.196604967 CEST	49723	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.196821928 CEST	49723	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.196830988 CEST	443	49723	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.243515015 CEST	49724	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.243540049 CEST	443	49724	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.243742943 CEST	49724	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.244239092 CEST	49724	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.244254112 CEST	443	49724	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.268696070 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:35.268696070 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:35.595386028 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:35.671366930 CEST	443	49723	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.673680067 CEST	443	49722	172.217.18.4	192.168.2.6
Jul 5, 2024 00:52:35.706746101 CEST	49723	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.706780910 CEST	443	49723	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.707009077 CEST	49722	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:52:35.707035065 CEST	443	49722	172.217.18.4	192.168.2.6
Jul 5, 2024 00:52:35.707231045 CEST	443	49723	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.708230019 CEST	443	49722	172.217.18.4	192.168.2.6
Jul 5, 2024 00:52:35.708298922 CEST	49722	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:52:35.709342957 CEST	49723	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.709420919 CEST	443	49723	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.712568998 CEST	49722	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:52:35.712686062 CEST	443	49722	172.217.18.4	192.168.2.6
Jul 5, 2024 00:52:35.713350058 CEST	49723	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.715248108 CEST	443	49721	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:35.715317011 CEST	49721	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:35.718852043 CEST	49721	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:35.718863964 CEST	443	49721	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:35.719115019 CEST	443	49721	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:35.746036053 CEST	443	49724	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.746579885 CEST	49721	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:35.756495953 CEST	443	49723	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.762516022 CEST	49724	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.762531042 CEST	443	49724	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.763051987 CEST	49721	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:35.763057947 CEST	443	49721	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:35.763458967 CEST	443	49724	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.763513088 CEST	49724	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.763588905 CEST	49721	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:35.766392946 CEST	49724	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.766450882 CEST	443	49724	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.766912937 CEST	49724	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.766920090 CEST	443	49724	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.767411947 CEST	49722	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:52:35.767426968 CEST	443	49722	172.217.18.4	192.168.2.6
Jul 5, 2024 00:52:35.808501005 CEST	443	49721	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:35.814259052 CEST	49724	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.814260960 CEST	49722	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:52:35.876614094 CEST	443	49724	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.876674891 CEST	443	49724	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.876893044 CEST	49724	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.914011955 CEST	49724	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.914043903 CEST	443	49724	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.941812992 CEST	443	49721	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:35.942115068 CEST	443	49721	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:35.942169905 CEST	49721	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:35.942553997 CEST	49721	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:35.942559958 CEST	443	49721	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:35.967909098 CEST	443	49723	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.968225002 CEST	443	49723	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:35.968285084 CEST	49723	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.988768101 CEST	49723	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:35.988792896 CEST	443	49723	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:36.022744894 CEST	49725	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:36.022775888 CEST	443	49725	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:36.022988081 CEST	49725	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:36.025080919 CEST	49725	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:36.025096893 CEST	443	49725	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:36.636583090 CEST	49726	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:36.636624098 CEST	443	49726	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:36.636688948 CEST	49726	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:36.637053013 CEST	49726	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:36.637061119 CEST	443	49726	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:36.715361118 CEST	443	49725	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:36.715441942 CEST	49725	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:36.783987045 CEST	49725	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:36.784013987 CEST	443	49725	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:36.784357071 CEST	443	49725	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:36.829906940 CEST	49725	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:36.896622896 CEST	49725	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:36.940493107 CEST	443	49725	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:37.098953962 CEST	443	49725	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:37.099035025 CEST	443	49725	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:37.099103928 CEST	49725	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:37.099839926 CEST	49725	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:37.099858046 CEST	443	49725	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:37.109208107 CEST	443	49726	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:37.111836910 CEST	49726	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:37.111864090 CEST	443	49726	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:37.112184048 CEST	443	49726	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:37.112658024 CEST	49726	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:37.112711906 CEST	443	49726	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:37.112977028 CEST	49726	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:37.156510115 CEST	443	49726	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:37.228934050 CEST	49728	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:37.228981018 CEST	443	49728	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:37.229058027 CEST	49728	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:37.229754925 CEST	49728	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:37.229767084 CEST	443	49728	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:37.236963987 CEST	443	49726	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:37.237054110 CEST	443	49726	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:37.237106085 CEST	49726	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:37.258739948 CEST	49726	443	192.168.2.6	188.114.97.3
Jul 5, 2024 00:52:37.258749962 CEST	443	49726	188.114.97.3	192.168.2.6
Jul 5, 2024 00:52:37.270018101 CEST	443	49704	173.222.162.64	192.168.2.6
Jul 5, 2024 00:52:37.270131111 CEST	49704	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:37.898458004 CEST	443	49728	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:37.898531914 CEST	49728	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:37.899780035 CEST	49728	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:37.899791002 CEST	443	49728	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:37.900007010 CEST	443	49728	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:37.901061058 CEST	49728	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:37.948488951 CEST	443	49728	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:38.184072018 CEST	443	49728	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:38.184148073 CEST	443	49728	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:38.184227943 CEST	49728	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:38.185477972 CEST	49728	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:38.185499907 CEST	443	49728	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:38.185511112 CEST	49728	443	192.168.2.6	184.28.90.27
Jul 5, 2024 00:52:38.185517073 CEST	443	49728	184.28.90.27	192.168.2.6
Jul 5, 2024 00:52:41.431185007 CEST	49730	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:41.431231022 CEST	443	49730	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:41.431294918 CEST	49730	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:41.431838989 CEST	49730	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:41.431852102 CEST	443	49730	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:43.242383957 CEST	443	49730	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:43.242471933 CEST	49730	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:43.245595932 CEST	49730	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:43.245611906 CEST	443	49730	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:43.245853901 CEST	443	49730	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:43.247035980 CEST	49730	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:43.247205973 CEST	49730	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:43.247211933 CEST	443	49730	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:43.247390985 CEST	49730	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:43.288510084 CEST	443	49730	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:43.421935081 CEST	443	49730	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:43.422023058 CEST	443	49730	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:43.422081947 CEST	49730	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:43.422260046 CEST	49730	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:43.422280073 CEST	443	49730	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:45.579899073 CEST	443	49722	172.217.18.4	192.168.2.6
Jul 5, 2024 00:52:45.579957008 CEST	443	49722	172.217.18.4	192.168.2.6
Jul 5, 2024 00:52:45.580169916 CEST	49722	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:52:47.128580093 CEST	49722	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:52:47.128608942 CEST	443	49722	172.217.18.4	192.168.2.6
Jul 5, 2024 00:52:48.198005915 CEST	49704	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:48.198256969 CEST	49704	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:48.198729992 CEST	49734	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:48.198777914 CEST	443	49734	173.222.162.64	192.168.2.6
Jul 5, 2024 00:52:48.198858023 CEST	49734	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:48.199309111 CEST	49734	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:48.199326038 CEST	443	49734	173.222.162.64	192.168.2.6
Jul 5, 2024 00:52:48.202931881 CEST	443	49704	173.222.162.64	192.168.2.6
Jul 5, 2024 00:52:48.203274965 CEST	443	49704	173.222.162.64	192.168.2.6
Jul 5, 2024 00:52:48.806960106 CEST	443	49734	173.222.162.64	192.168.2.6
Jul 5, 2024 00:52:48.807065010 CEST	49734	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:52:56.353425980 CEST	49736	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:56.353468895 CEST	443	49736	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:56.353713989 CEST	49736	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:56.354173899 CEST	49736	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:56.354188919 CEST	443	49736	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:57.158082008 CEST	443	49736	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:57.158160925 CEST	49736	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:57.161420107 CEST	49736	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:57.161433935 CEST	443	49736	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:57.161689997 CEST	443	49736	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:57.163619041 CEST	49736	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:57.163670063 CEST	49736	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:57.163676023 CEST	443	49736	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:57.163821936 CEST	49736	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:57.204508066 CEST	443	49736	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:57.337213039 CEST	443	49736	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:57.337644100 CEST	49736	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:57.337682009 CEST	443	49736	40.115.3.253	192.168.2.6
Jul 5, 2024 00:52:57.337706089 CEST	49736	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:52:57.337739944 CEST	49736	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:00.042090893 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:00.042129993 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:00.042277098 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:00.044229984 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:00.044266939 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:00.987977028 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:00.988049984 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:00.989816904 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:00.989833117 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:00.990103006 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:00.991288900 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:00.991354942 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:00.991363049 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:00.991451025 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:01.036509991 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:01.183919907 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:01.184000969 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:01.184051991 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:01.184250116 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:01.184274912 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:07.965297937 CEST	443	49734	173.222.162.64	192.168.2.6
Jul 5, 2024 00:53:07.965363979 CEST	49734	443	192.168.2.6	173.222.162.64
Jul 5, 2024 00:53:19.494002104 CEST	49738	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:19.494046926 CEST	443	49738	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:19.496316910 CEST	49738	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:19.500217915 CEST	49738	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:19.500238895 CEST	443	49738	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:20.325932026 CEST	443	49738	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:20.325997114 CEST	49738	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:20.330254078 CEST	49738	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:20.330265999 CEST	443	49738	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:20.330502987 CEST	443	49738	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:20.331707001 CEST	49738	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:20.331767082 CEST	49738	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:20.331773996 CEST	443	49738	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:20.331855059 CEST	49738	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:20.376511097 CEST	443	49738	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:20.513885975 CEST	443	49738	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:20.514137983 CEST	443	49738	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:20.514203072 CEST	49738	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:20.514420986 CEST	49738	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:20.514451027 CEST	443	49738	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:20.514462948 CEST	49738	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:25.589008093 CEST	49740	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:25.589062929 CEST	443	49740	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:25.589207888 CEST	49740	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:25.590049982 CEST	49740	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:25.590063095 CEST	443	49740	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:26.523523092 CEST	443	49740	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:26.523600101 CEST	49740	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:26.527565956 CEST	49740	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:26.527576923 CEST	443	49740	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:26.527810097 CEST	443	49740	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:26.532069921 CEST	49740	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:26.532130957 CEST	49740	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:26.532141924 CEST	443	49740	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:26.532330036 CEST	49740	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:26.572501898 CEST	443	49740	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:26.710812092 CEST	443	49740	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:26.711425066 CEST	49740	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:26.711445093 CEST	443	49740	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:26.711503029 CEST	49740	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:35.049158096 CEST	49742	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:53:35.049222946 CEST	443	49742	172.217.18.4	192.168.2.6
Jul 5, 2024 00:53:35.049350023 CEST	49742	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:53:35.051011086 CEST	49742	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:53:35.051028967 CEST	443	49742	172.217.18.4	192.168.2.6
Jul 5, 2024 00:53:35.697346926 CEST	443	49742	172.217.18.4	192.168.2.6
Jul 5, 2024 00:53:35.697824955 CEST	49742	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:53:35.697860956 CEST	443	49742	172.217.18.4	192.168.2.6
Jul 5, 2024 00:53:35.698146105 CEST	443	49742	172.217.18.4	192.168.2.6
Jul 5, 2024 00:53:35.698800087 CEST	49742	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:53:35.698860884 CEST	443	49742	172.217.18.4	192.168.2.6
Jul 5, 2024 00:53:35.752893925 CEST	49742	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:53:39.840641022 CEST	49743	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:39.840718985 CEST	443	49743	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:39.840856075 CEST	49743	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:39.841787100 CEST	49743	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:39.841805935 CEST	443	49743	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:40.737251043 CEST	443	49743	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:40.737329960 CEST	49743	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:40.739130974 CEST	49743	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:40.739144087 CEST	443	49743	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:40.739403963 CEST	443	49743	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:40.740695953 CEST	49743	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:40.740746021 CEST	49743	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:40.740751028 CEST	443	49743	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:40.740840912 CEST	49743	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:40.784506083 CEST	443	49743	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:40.917342901 CEST	443	49743	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:40.917758942 CEST	49743	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:40.917782068 CEST	443	49743	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:40.917793036 CEST	49743	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:40.917803049 CEST	443	49743	40.115.3.253	192.168.2.6
Jul 5, 2024 00:53:40.917848110 CEST	49743	443	192.168.2.6	40.115.3.253
Jul 5, 2024 00:53:45.598963022 CEST	443	49742	172.217.18.4	192.168.2.6
Jul 5, 2024 00:53:45.599039078 CEST	443	49742	172.217.18.4	192.168.2.6
Jul 5, 2024 00:53:45.599150896 CEST	49742	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:53:47.051472902 CEST	49742	443	192.168.2.6	172.217.18.4
Jul 5, 2024 00:53:47.051513910 CEST	443	49742	172.217.18.4	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 00:52:30.465843916 CEST	53	50877	1.1.1.1	192.168.2.6
Jul 5, 2024 00:52:30.550362110 CEST	53	51146	1.1.1.1	192.168.2.6
Jul 5, 2024 00:52:31.575876951 CEST	53	54792	1.1.1.1	192.168.2.6
Jul 5, 2024 00:52:32.666076899 CEST	54277	53	192.168.2.6	1.1.1.1
Jul 5, 2024 00:52:32.666249037 CEST	56300	53	192.168.2.6	1.1.1.1
Jul 5, 2024 00:52:32.681910992 CEST	53	54277	1.1.1.1	192.168.2.6
Jul 5, 2024 00:52:32.681932926 CEST	53	56300	1.1.1.1	192.168.2.6
Jul 5, 2024 00:52:32.685214996 CEST	60431	53	192.168.2.6	1.1.1.1
Jul 5, 2024 00:52:32.685381889 CEST	63636	53	192.168.2.6	1.1.1.1
Jul 5, 2024 00:52:32.700767994 CEST	53	63636	1.1.1.1	192.168.2.6
Jul 5, 2024 00:52:32.723120928 CEST	53	60431	1.1.1.1	192.168.2.6
Jul 5, 2024 00:52:34.998872995 CEST	54262	53	192.168.2.6	1.1.1.1
Jul 5, 2024 00:52:34.999162912 CEST	58516	53	192.168.2.6	1.1.1.1
Jul 5, 2024 00:52:35.006402969 CEST	53	54262	1.1.1.1	192.168.2.6
Jul 5, 2024 00:52:35.006416082 CEST	53	58516	1.1.1.1	192.168.2.6
Jul 5, 2024 00:52:35.223599911 CEST	49978	53	192.168.2.6	1.1.1.1
Jul 5, 2024 00:52:35.224093914 CEST	62559	53	192.168.2.6	1.1.1.1
Jul 5, 2024 00:52:35.231657982 CEST	53	62559	1.1.1.1	192.168.2.6
Jul 5, 2024 00:52:35.242791891 CEST	53	49978	1.1.1.1	192.168.2.6
Jul 5, 2024 00:52:48.590769053 CEST	53	57180	1.1.1.1	192.168.2.6
Jul 5, 2024 00:53:07.413152933 CEST	53	55339	1.1.1.1	192.168.2.6
Jul 5, 2024 00:53:30.122682095 CEST	53	63797	1.1.1.1	192.168.2.6
Jul 5, 2024 00:53:30.193023920 CEST	53	54589	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 5, 2024 00:52:32.666076899 CEST	192.168.2.6	1.1.1.1	0x68a3	Standard query (0)	business.ifbsmetaiidentiityconfirms.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:32.666249037 CEST	192.168.2.6	1.1.1.1	0x7353	Standard query (0)	business.ifbsmetaiidentiityconfirms.com	65	IN (0x0001)	false
Jul 5, 2024 00:52:32.685214996 CEST	192.168.2.6	1.1.1.1	0x1f3e	Standard query (0)	business.ifbsmetaiidentiityconfirms.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:32.685381889 CEST	192.168.2.6	1.1.1.1	0x7348	Standard query (0)	business.ifbsmetaiidentiityconfirms.com	65	IN (0x0001)	false
Jul 5, 2024 00:52:34.998872995 CEST	192.168.2.6	1.1.1.1	0xcc10	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:34.999162912 CEST	192.168.2.6	1.1.1.1	0xdbd8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 5, 2024 00:52:35.223599911 CEST	192.168.2.6	1.1.1.1	0xc64	Standard query (0)	business.ifbsmetaiidentiityconfirms.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:35.224093914 CEST	192.168.2.6	1.1.1.1	0x556a	Standard query (0)	business.ifbsmetaiidentiityconfirms.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 5, 2024 00:52:32.681910992 CEST	1.1.1.1	192.168.2.6	0x68a3	No error (0)	business.ifbsmetaiidentiityconfirms.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:32.681910992 CEST	1.1.1.1	192.168.2.6	0x68a3	No error (0)	business.ifbsmetaiidentiityconfirms.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:32.681932926 CEST	1.1.1.1	192.168.2.6	0x7353	No error (0)	business.ifbsmetaiidentiityconfirms.com			65	IN (0x0001)	false
Jul 5, 2024 00:52:32.700767994 CEST	1.1.1.1	192.168.2.6	0x7348	No error (0)	business.ifbsmetaiidentiityconfirms.com			65	IN (0x0001)	false
Jul 5, 2024 00:52:32.723120928 CEST	1.1.1.1	192.168.2.6	0x1f3e	No error (0)	business.ifbsmetaiidentiityconfirms.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:32.723120928 CEST	1.1.1.1	192.168.2.6	0x1f3e	No error (0)	business.ifbsmetaiidentiityconfirms.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:35.006402969 CEST	1.1.1.1	192.168.2.6	0xcc10	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:35.006416082 CEST	1.1.1.1	192.168.2.6	0xdbd8	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 5, 2024 00:52:35.231657982 CEST	1.1.1.1	192.168.2.6	0x556a	No error (0)	business.ifbsmetaiidentiityconfirms.com			65	IN (0x0001)	false
Jul 5, 2024 00:52:35.242791891 CEST	1.1.1.1	192.168.2.6	0xc64	No error (0)	business.ifbsmetaiidentiityconfirms.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:35.242791891 CEST	1.1.1.1	192.168.2.6	0xc64	No error (0)	business.ifbsmetaiidentiityconfirms.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:46.374761105 CEST	1.1.1.1	192.168.2.6	0xe563	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 5, 2024 00:52:46.374761105 CEST	1.1.1.1	192.168.2.6	0xe563	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:48.293591976 CEST	1.1.1.1	192.168.2.6	0xacb5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:52:48.293591976 CEST	1.1.1.1	192.168.2.6	0xacb5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:53:03.684273958 CEST	1.1.1.1	192.168.2.6	0xaf73	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:53:03.684273958 CEST	1.1.1.1	192.168.2.6	0xaf73	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:53:22.499906063 CEST	1.1.1.1	192.168.2.6	0x1809	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:53:22.499906063 CEST	1.1.1.1	192.168.2.6	0x1809	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:53:47.841140985 CEST	1.1.1.1	192.168.2.6	0x3ebb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 5, 2024 00:53:47.841140985 CEST	1.1.1.1	192.168.2.6	0x3ebb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

business.ifbsmetaiidentiityconfirms.com

https:

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49708	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:21 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 48 6a 58 74 67 6f 44 6d 7a 55 57 66 53 35 2f 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 30 33 30 37 36 33 64 61 65 62 31 31 30 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: HjXtgoDmzUWfS5/q.1Context: 87030763daeb1105
2024-07-04 22:52:21 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 22:52:21 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 48 6a 58 74 67 6f 44 6d 7a 55 57 66 53 35 2f 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 30 33 30 37 36 33 64 61 65 62 31 31 30 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: HjXtgoDmzUWfS5/q.2Context: 87030763daeb1105<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-04 22:52:21 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 48 6a 58 74 67 6f 44 6d 7a 55 57 66 53 35 2f 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 30 33 30 37 36 33 64 61 65 62 31 31 30 35 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: HjXtgoDmzUWfS5/q.3Context: 87030763daeb1105
2024-07-04 22:52:21 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 22:52:21 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 77 48 75 33 7a 72 73 76 50 6b 36 62 67 66 69 65 56 58 41 4c 6f 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: wHu3zrsvPk6bgfieVXALow.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49709	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:28 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 39 2b 39 4c 75 74 33 77 30 65 56 4b 42 6e 4b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 32 37 30 62 33 66 61 31 31 31 64 65 31 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 99+9Lut3w0eVKBnK.1Context: 13270b3fa111de1c
2024-07-04 22:52:28 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 22:52:28 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 39 39 2b 39 4c 75 74 33 77 30 65 56 4b 42 6e 4b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 32 37 30 62 33 66 61 31 31 31 64 65 31 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 99+9Lut3w0eVKBnK.2Context: 13270b3fa111de1c<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-04 22:52:28 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 39 39 2b 39 4c 75 74 33 77 30 65 56 4b 42 6e 4b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 32 37 30 62 33 66 61 31 31 31 64 65 31 63 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 99+9Lut3w0eVKBnK.3Context: 13270b3fa111de1c
2024-07-04 22:52:28 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 22:52:28 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 31 76 74 56 46 30 7a 50 75 6b 4b 35 76 4a 71 2b 45 36 4f 2f 59 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 1vtVF0zPukK5vJq+E6O/Yg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49710	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:29 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 44 74 37 66 72 6d 44 72 70 55 53 48 4d 41 5a 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 39 36 61 32 39 38 38 66 30 34 36 61 38 30 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Dt7frmDrpUSHMAZr.1Context: a96a2988f046a80c
2024-07-04 22:52:29 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 22:52:29 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 44 74 37 66 72 6d 44 72 70 55 53 48 4d 41 5a 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 39 36 61 32 39 38 38 66 30 34 36 61 38 30 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: Dt7frmDrpUSHMAZr.2Context: a96a2988f046a80c<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
2024-07-04 22:52:29 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 44 74 37 66 72 6d 44 72 70 55 53 48 4d 41 5a 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 39 36 61 32 39 38 38 66 30 34 36 61 38 30 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Dt7frmDrpUSHMAZr.3Context: a96a2988f046a80c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-04 22:52:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 22:52:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 73 38 2f 62 61 2f 5a 78 76 6b 61 52 35 65 75 30 2b 6e 62 6f 78 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: s8/ba/ZxvkaR5eu0+nboxg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49716	188.114.97.3	443	3380	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:33 UTC	721	OUT	GET /meta-community-standard100068928266341/ HTTP/1.1 Host: business.ifbsmetaiidentiityconfirms.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:52:33 UTC	579	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 22:52:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VGl0MHP03yZQOiG0QPbwkYeXei0Iy4uypk6a7RQoRtstf2k4Nq2pY4nied0yiRssmkJhq199yZgVOAelK%2B34RGDNNAxmq70qAndly4HJ3WNr8BbkIOrh8XCvyh21o08qW%2B42x3tpws3X3dDQS7yFY4qAJA%2FBMVLUGNs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e2afb47b7342de-EWR
2024-07-04 22:52:33 UTC	790	IN	Data Raw: 31 31 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1151<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-07-04 22:52:33 UTC	1369	IN	Data Raw: 2d 63 73 73 27 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 Data Ascii: -css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = d
2024-07-04 22:52:33 UTC	1369	IN	Data Raw: 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 64 71 4b 33 41 4f 57 4c 34 43 6a 4e 55 69 49 69 5a 7a 6d 79 50 68 49 79 41 54 55 4a 45 59 77 49 54 37 38 44 53 31 46 43 55 68 77 2d 31 37 32 30 31 33 33 35 35 33 2d 30 2e 30 2e 31 2e 31 2d 2f 6d 65 74 61 2d 63 6f 6d 6d 75 6e 69 74 79 2d 73 74 61 6e 64 61 72 64 31 30 30 30 36 38 39 32 38 32 36 36 33 34 31 2f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f Data Ascii: " enctype="text/plain"> <input type="hidden" name="atok" value="dqK3AOWL4CjNUiIiZzmyPhIyATUJEYwIT78DS1FCUhw-1720133553-0.0.1.1-/meta-community-standard100068928266341/"> <a href="https://www.cloudflare.co
2024-07-04 22:52:33 UTC	913	IN	Data Raw: 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f Data Ascii: -ip">8.46.123.33</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/
2024-07-04 22:52:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49719	188.114.97.3	443	3380	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:34 UTC	644	OUT	GET /cdn-cgi/styles/cf.errors.css HTTP/1.1 Host: business.ifbsmetaiidentiityconfirms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:52:34 UTC	411	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 22:52:34 GMT Content-Type: text/css Content-Length: 24051 Connection: close Last-Modified: Fri, 28 Jun 2024 11:25:31 GMT ETag: "667e9dab-5df3" Server: cloudflare CF-RAY: 89e2afba1f6f0f7d-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Fri, 05 Jul 2024 00:52:34 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-07-04 22:52:34 UTC	958	IN	Data Raw: 23 63 66 2d 77 72 61 70 70 65 72 20 61 2c 23 63 66 2d 77 72 61 70 70 65 72 20 61 62 62 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 61 72 74 69 63 6c 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 61 73 69 64 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 69 67 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 6c 6f 63 6b 71 75 6f 74 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 6f 64 79 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 61 6e 76 61 73 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 61 70 74 69 6f 6e 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 65 6e 74 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 69 74 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 6f 64 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 64 64 2c 23 63 66 2d 77 72 61 70 70 Data Ascii: #cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapp
2024-07-04 22:52:34 UTC	1369	IN	Data Raw: 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 74 72 6f 6e 67 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 75 62 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 75 6d 6d 61 72 79 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 75 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 61 62 6c 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 62 6f 64 79 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 66 6f 6f 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 68 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 68 65 61 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 75 2c 23 63 66 2d 77 72 61 70 70 65 72 20 75 6c 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f Data Ascii: e,#cf-wrapper strong,#cf-wrapper sub,#cf-wrapper summary,#cf-wrapper sup,#cf-wrapper table,#cf-wrapper tbody,#cf-wrapper td,#cf-wrapper tfoot,#cf-wrapper th,#cf-wrapper thead,#cf-wrapper tr,#cf-wrapper tt,#cf-wrapper u,#cf-wrapper ul{margin:0;padding:0;bo
2024-07-04 22:52:34 UTC	1369	IN	Data Raw: 31 2e 35 21 69 6d 70 6f 72 74 61 6e 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 34 36 2c 31 33 39 2c 33 31 2c 2e 33 29 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 73 65 63 74 69 6f 6e 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 65 63 74 69 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 30 20 30 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 65 6d 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 65 6d Data Ascii: 1.5!important;text-decoration:none!important;letter-spacing:normal;-webkit-tap-highlight-color:rgba(246,139,31,.3);-webkit-font-smoothing:antialiased}#cf-wrapper .cf-section,#cf-wrapper section{background:0 0;display:block;margin-bottom:2em;margin-top:2em
2024-07-04 22:52:34 UTC	1369	IN	Data Raw: 6c 64 28 32 6e 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 34 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 6e 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 66 6f 75 72 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 6e 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 74 77 6f 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 6e 29 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 32 2e 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 32 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 Data Ascii: ld(2n),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.four>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.two>.cf-column:nth-child(2n){padding-left:22.5px;padding-right:0}#cf-wrapper .cf-columns.cols-2>.cf-column:nth-chi
2024-07-04 22:52:34 UTC	1369	IN	Data Raw: 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 66 6f 75 72 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 6f 64 64 29 7b 63 6c 65 61 72 3a 6e 6f 6e 65 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 34 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 34 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 34 6e 2b 31 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 66 6f 75 72 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 Data Ascii: ),#cf-wrapper .cf-columns.four>.cf-column:nth-child(odd){clear:none}#cf-wrapper .cf-columns.cols-4>.cf-column:first-child,#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+1),#cf-wrapper .cf-columns.four>.cf-column:first-child,#cf-wrapper .cf-columns
2024-07-04 22:52:34 UTC	1369	IN	Data Raw: 30 3b 70 61 64 64 69 6e 67 3a 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 68 31 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 32 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 33 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 68 34 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 35 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 36 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 74 72 6f 6e 67 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 36 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 23 63 66 2d 77 72 61 70 70 65 72 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 33 7d 23 63 66 2d 77 72 61 70 70 65 Data Ascii: 0;padding:0}#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3{font-weight:400}#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper strong{font-weight:600}#cf-wrapper h1{font-size:36px;line-height:1.2}#cf-wrapper h2{font-size:30px;line-height:1.3}#cf-wrappe
2024-07-04 22:52:34 UTC	1369	IN	Data Raw: 68 32 2b 68 34 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 32 2b 68 35 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 32 2b 68 36 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 33 2b 68 35 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 33 2b 68 36 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 33 2b 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 34 2b 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 35 2b 6f 6c 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 35 2b 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 35 2b 75 6c 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2e 35 65 6d 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 39 39 39 3b 63 6f 6c Data Ascii: h2+h4,#cf-wrapper h2+h5,#cf-wrapper h2+h6,#cf-wrapper h3+h5,#cf-wrapper h3+h6,#cf-wrapper h3+p,#cf-wrapper h4+p,#cf-wrapper h5+ol,#cf-wrapper h5+p,#cf-wrapper h5+ul{margin-top:.5em}#cf-wrapper .cf-btn{background-color:transparent;border:1px solid #999;col
2024-07-04 22:52:34 UTC	1369	IN	Data Raw: 3a 23 36 32 61 31 64 38 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 31 36 33 39 35 39 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 64 61 6e 67 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 65 72 72 6f 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 69 6d 70 6f 72 74 61 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 64 32 34 32 36 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 64 61 6e 67 65 72 3a 68 6f 76 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 65 72 72 6f 72 3a 68 6f 76 65 72 2c 23 Data Ascii: :#62a1d8;border:1px solid #163959;color:#fff}#cf-wrapper .cf-btn-danger,#cf-wrapper .cf-btn-error,#cf-wrapper .cf-btn-important{background-color:#bd2426;border-color:transparent;color:#fff}#cf-wrapper .cf-btn-danger:hover,#cf-wrapper .cf-btn-error:hover,#
2024-07-04 22:52:34 UTC	1369	IN	Data Raw: 61 63 65 3a 6e 6f 77 72 61 70 7d 23 63 66 2d 77 72 61 70 70 65 72 20 69 6e 70 75 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 65 6c 65 63 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 65 78 74 61 72 65 61 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 39 39 39 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 34 30 34 30 34 30 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 36 36 36 37 65 6d 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 34 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 65 6d 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e Data Ascii: ace:nowrap}#cf-wrapper input,#cf-wrapper select,#cf-wrapper textarea{background:#fff!important;border:1px solid #999!important;color:#404040!important;font-size:.86667em!important;line-height:1.24!important;margin:0 0 1em!important;max-width:100%!importan
2024-07-04 22:52:34 UTC	1369	IN	Data Raw: 3a 23 34 30 34 30 34 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 3a 37 2e 35 70 78 20 31 35 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 70 78 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 61 6c 65 72 74 3a 65 6d 70 74 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 61 6c 65 72 74 20 2e 63 66 2d 63 6c 6f 73 65 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 2e 37 35 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 3b 70 61 64 64 69 6e Data Ascii: :#404040;font-size:13px;padding:7.5px 15px;position:relative;vertical-align:middle;border-radius:2px}#cf-wrapper .cf-alert:empty{display:none}#cf-wrapper .cf-alert .cf-close{border:1px solid transparent;color:inherit;font-size:18.75px;line-height:1;paddin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49720	188.114.97.3	443	3380	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:34 UTC	697	OUT	GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1 Host: business.ifbsmetaiidentiityconfirms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://business.ifbsmetaiidentiityconfirms.com/cdn-cgi/styles/cf.errors.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:52:35 UTC	409	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 22:52:35 GMT Content-Type: image/png Content-Length: 452 Connection: close Last-Modified: Fri, 28 Jun 2024 11:25:31 GMT ETag: "667e9dab-1c4" Server: cloudflare CF-RAY: 89e2afbeff8341b2-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Fri, 05 Jul 2024 00:52:35 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-07-04 22:52:35 UTC	452	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 36 00 00 00 36 08 03 00 00 00 bb 9b 9a ef 00 00 00 33 50 4c 54 45 c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f ab b2 22 ed 00 00 00 11 74 52 4e 53 00 40 30 10 60 8f bf ff ef 7f af 9f df 20 50 cf 70 60 82 c8 9b 00 00 01 2f 49 44 41 54 78 01 bd d3 05 d2 b4 30 10 06 e1 8e 6c de c1 36 dc ff b2 9f 2b 95 c9 12 7e 79 4a 91 46 22 b8 c2 8b c8 80 94 6f 45 1f ac 4c 81 33 f2 ac 03 5b 1e 95 69 32 b5 94 6e 98 57 79 4a c4 91 8a 7a 26 9a 82 a9 af a4 46 95 f5 d0 1a fb 95 c7 62 bf b2 f2 e9 70 7e e3 a7 a0 df ee 7c 3a 74 35 f1 6d b3 b3 99 66 70 af 69 f2 2f 65 ef c7 fa 99 25 de 25 1b c9 b4 f0 6e d2 50 a6 ed fb 65 Data Ascii: PNGIHDR663PLTEE?E?E?E?E?E?E?E?E?E?E?E?E?E?E?E?E?"tRNS@0` Pp`/IDATx0l6+~yJF"oEL3[i2nWyJz&Fbp~\|:t5mfpi/e%%nPe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49723	188.114.97.3	443	3380	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:35 UTC	673	OUT	GET /favicon.ico HTTP/1.1 Host: business.ifbsmetaiidentiityconfirms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:52:35 UTC	673	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 22:52:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 24 Jun 2024 07:56:10 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MbZmG0hebSci6hVj%2BrdmmxgSY5cvsvxUpo8gDjWFG%2BDRPVdeWXRQQRkMrHFF%2FNNmcHjKtkJX963mKyg8fXiDN8pQrM6dp3sJ9tAYtyBZFv0VyTMZ%2B1XyH7tLc0E3nEk852ZJQcQQ4ol4r9lagh52Nd6TsUukkN4FKpc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e2afc38f024408-EWR alt-svc: h3=":443"; ma=86400
2024-07-04 22:52:35 UTC	696	IN	Data Raw: 34 37 64 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 72 74 69 63 6c 65 22 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 57 65 20 68 61 76 65 20 73 63 68 65 64 75 6c 65 64 20 79 6f 75 72 20 70 61 67 65 20 74 6f 20 62 65 20 64 65 6c 65 74 65 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 57 65 20 68 61 76 65 20 72 65 63 65 69 76 65 64 20 73 65 76 65 72 61 6c 20 72 65 70 6f 72 74 73 20 Data Ascii: 47d<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta property="og:type" content="article"/><meta property="og:title" content="We have scheduled your page to be deleted"/><meta name="description" content="We have received several reports
2024-07-04 22:52:35 UTC	460	IN	Data Raw: 77 61 70 22 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 40 35 2e 30 2e 32 2f 64 69 73 74 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 6e 74 65 67 72 69 74 79 3d 22 73 68 61 33 38 34 2d 45 56 53 54 51 4e 33 2f 61 7a 70 72 47 31 41 6e 6d 33 51 44 67 70 4a 4c 49 6d 39 4e 61 6f 30 59 7a 31 7a 74 63 51 54 77 46 73 70 64 33 79 44 36 35 56 6f 68 68 70 75 75 43 4f 6d 4c 41 53 6a 43 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2e 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 2f 3e Data Ascii: wap"/><link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"><link rel="icon" href="./favicon.png"/>
2024-07-04 22:52:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49721	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:35 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6c 61 62 50 62 59 73 65 76 30 4b 32 55 76 39 4c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 66 32 31 62 33 31 64 34 37 61 39 64 61 34 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: labPbYsev0K2Uv9L.1Context: 5f21b31d47a9da41
2024-07-04 22:52:35 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 22:52:35 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 6c 61 62 50 62 59 73 65 76 30 4b 32 55 76 39 4c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 66 32 31 62 33 31 64 34 37 61 39 64 61 34 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: labPbYsev0K2Uv9L.2Context: 5f21b31d47a9da41<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-04 22:52:35 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6c 61 62 50 62 59 73 65 76 30 4b 32 55 76 39 4c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 66 32 31 62 33 31 64 34 37 61 39 64 61 34 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: labPbYsev0K2Uv9L.3Context: 5f21b31d47a9da41<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-04 22:52:35 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 22:52:35 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 59 42 55 4c 63 4b 64 42 6f 30 75 42 78 58 69 49 68 6f 4a 30 41 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: YBULcKdBo0uBxXiIhoJ0AA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49724	188.114.97.3	443	3380	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:35 UTC	409	OUT	GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1 Host: business.ifbsmetaiidentiityconfirms.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:52:35 UTC	409	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 22:52:35 GMT Content-Type: image/png Content-Length: 452 Connection: close Last-Modified: Fri, 28 Jun 2024 11:25:31 GMT ETag: "667e9dab-1c4" Server: cloudflare CF-RAY: 89e2afc3dbe48c7d-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Fri, 05 Jul 2024 00:52:35 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-07-04 22:52:35 UTC	452	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 36 00 00 00 36 08 03 00 00 00 bb 9b 9a ef 00 00 00 33 50 4c 54 45 c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f ab b2 22 ed 00 00 00 11 74 52 4e 53 00 40 30 10 60 8f bf ff ef 7f af 9f df 20 50 cf 70 60 82 c8 9b 00 00 01 2f 49 44 41 54 78 01 bd d3 05 d2 b4 30 10 06 e1 8e 6c de c1 36 dc ff b2 9f 2b 95 c9 12 7e 79 4a 91 46 22 b8 c2 8b c8 80 94 6f 45 1f ac 4c 81 33 f2 ac 03 5b 1e 95 69 32 b5 94 6e 98 57 79 4a c4 91 8a 7a 26 9a 82 a9 af a4 46 95 f5 d0 1a fb 95 c7 62 bf b2 f2 e9 70 7e e3 a7 a0 df ee 7c 3a 74 35 f1 6d b3 b3 99 66 70 af 69 f2 2f 65 ef c7 fa 99 25 de 25 1b c9 b4 f0 6e d2 50 a6 ed fb 65 Data Ascii: PNGIHDR663PLTEE?E?E?E?E?E?E?E?E?E?E?E?E?E?E?E?E?"tRNS@0` Pp`/IDATx0l6+~yJF"oEL3[i2nWyJz&Fbp~\|:t5mfpi/e%%nPe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49725	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:36 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-04 22:52:37 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=29486 Date: Thu, 04 Jul 2024 22:52:36 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49726	188.114.97.3	443	3380	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:37 UTC	374	OUT	GET /favicon.ico HTTP/1.1 Host: business.ifbsmetaiidentiityconfirms.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 22:52:37 UTC	669	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 22:52:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 24 Jun 2024 07:56:10 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2yY4WnR6FZrQ5s82XmxWYXR7SMffk4vktT3o%2BldL5Kf8MZVUxrLHCyYCL7sk3Miv9tbynQJwnG3G9vCXzQFadHiUUoX34FFcQ1ekxW%2BVnugLY275WE9K19rIMbuwCeGM8Fh7WxmrxM4zbMwpVDZDnEFvZh7rD7cbd7g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e2afcc58534289-EWR alt-svc: h3=":443"; ma=86400
2024-07-04 22:52:37 UTC	700	IN	Data Raw: 34 37 64 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 72 74 69 63 6c 65 22 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 57 65 20 68 61 76 65 20 73 63 68 65 64 75 6c 65 64 20 79 6f 75 72 20 70 61 67 65 20 74 6f 20 62 65 20 64 65 6c 65 74 65 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 57 65 20 68 61 76 65 20 72 65 63 65 69 76 65 64 20 73 65 76 65 72 61 6c 20 72 65 70 6f 72 74 73 20 Data Ascii: 47d<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta property="og:type" content="article"/><meta property="og:title" content="We have scheduled your page to be deleted"/><meta name="description" content="We have received several reports
2024-07-04 22:52:37 UTC	456	IN	Data Raw: 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 40 35 2e 30 2e 32 2f 64 69 73 74 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 6e 74 65 67 72 69 74 79 3d 22 73 68 61 33 38 34 2d 45 56 53 54 51 4e 33 2f 61 7a 70 72 47 31 41 6e 6d 33 51 44 67 70 4a 4c 49 6d 39 4e 61 6f 30 59 7a 31 7a 74 63 51 54 77 46 73 70 64 33 79 44 36 35 56 6f 68 68 70 75 75 43 4f 6d 4c 41 53 6a 43 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2e 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 74 69 74 Data Ascii: /><link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"><link rel="icon" href="./favicon.png"/><tit
2024-07-04 22:52:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49728	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:37 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-04 22:52:38 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=29505 Date: Thu, 04 Jul 2024 22:52:38 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-04 22:52:38 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49730	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:43 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 66 62 44 42 42 4d 4f 34 74 6b 79 64 35 2f 68 35 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 66 30 35 62 37 63 39 64 32 31 64 39 66 62 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: fbDBBMO4tkyd5/h5.1Context: 8f05b7c9d21d9fb9
2024-07-04 22:52:43 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 22:52:43 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 66 62 44 42 42 4d 4f 34 74 6b 79 64 35 2f 68 35 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 66 30 35 62 37 63 39 64 32 31 64 39 66 62 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: fbDBBMO4tkyd5/h5.2Context: 8f05b7c9d21d9fb9<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-04 22:52:43 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 66 62 44 42 42 4d 4f 34 74 6b 79 64 35 2f 68 35 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 66 30 35 62 37 63 39 64 32 31 64 39 66 62 39 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: fbDBBMO4tkyd5/h5.3Context: 8f05b7c9d21d9fb9
2024-07-04 22:52:43 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 22:52:43 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 5a 51 51 53 35 65 6d 7a 55 47 64 61 68 42 73 70 41 75 53 59 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qZQQS5emzUGdahBspAuSYA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49736	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:52:57 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 75 53 2f 51 36 65 59 4f 30 65 5a 62 37 78 49 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 32 62 66 63 65 39 36 64 35 32 66 64 66 65 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: muS/Q6eYO0eZb7xI.1Context: 22bfce96d52fdfe2
2024-07-04 22:52:57 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 22:52:57 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 6d 75 53 2f 51 36 65 59 4f 30 65 5a 62 37 78 49 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 32 62 66 63 65 39 36 64 35 32 66 64 66 65 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: muS/Q6eYO0eZb7xI.2Context: 22bfce96d52fdfe2<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-04 22:52:57 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 75 53 2f 51 36 65 59 4f 30 65 5a 62 37 78 49 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 32 62 66 63 65 39 36 64 35 32 66 64 66 65 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: muS/Q6eYO0eZb7xI.3Context: 22bfce96d52fdfe2<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-04 22:52:57 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 22:52:57 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 55 4e 5a 71 48 75 56 59 4f 30 61 4a 52 57 6d 42 4b 32 4f 4d 4d 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: UNZqHuVYO0aJRWmBK2OMMQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49737	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:53:00 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6b 58 6b 69 75 49 64 74 2f 55 36 46 52 6f 6c 65 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 62 31 66 32 37 33 35 36 34 33 37 66 35 65 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: kXkiuIdt/U6FRole.1Context: 9b1f27356437f5e3
2024-07-04 22:53:00 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 22:53:00 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 6b 58 6b 69 75 49 64 74 2f 55 36 46 52 6f 6c 65 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 62 31 66 32 37 33 35 36 34 33 37 66 35 65 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: kXkiuIdt/U6FRole.2Context: 9b1f27356437f5e3<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-04 22:53:00 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 6b 58 6b 69 75 49 64 74 2f 55 36 46 52 6f 6c 65 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 62 31 66 32 37 33 35 36 34 33 37 66 35 65 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: kXkiuIdt/U6FRole.3Context: 9b1f27356437f5e3
2024-07-04 22:53:01 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 22:53:01 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 4e 66 77 50 69 33 49 34 6b 79 46 34 5a 31 72 65 4a 68 61 76 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4NfwPi3I4kyF4Z1reJhavQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49738	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:53:20 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 47 79 59 52 53 41 73 70 50 45 36 71 74 72 4b 66 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 36 65 33 35 31 31 34 39 33 34 33 33 39 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: GyYRSAspPE6qtrKf.1Context: e76e351149343392
2024-07-04 22:53:20 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 22:53:20 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 47 79 59 52 53 41 73 70 50 45 36 71 74 72 4b 66 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 36 65 33 35 31 31 34 39 33 34 33 33 39 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: GyYRSAspPE6qtrKf.2Context: e76e351149343392<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-04 22:53:20 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 47 79 59 52 53 41 73 70 50 45 36 71 74 72 4b 66 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 36 65 33 35 31 31 34 39 33 34 33 33 39 32 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: GyYRSAspPE6qtrKf.3Context: e76e351149343392
2024-07-04 22:53:20 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 22:53:20 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 61 71 7a 33 53 69 32 31 30 57 79 36 77 4f 66 30 4e 47 79 54 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Iaqz3Si210Wy6wOf0NGyTg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49740	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:53:26 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4f 72 78 41 68 77 54 2b 4c 55 69 6d 46 54 7a 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 36 35 35 31 65 62 66 32 33 34 63 65 32 63 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: OrxAhwT+LUimFTzr.1Context: 26551ebf234ce2ce
2024-07-04 22:53:26 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 22:53:26 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 4f 72 78 41 68 77 54 2b 4c 55 69 6d 46 54 7a 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 36 35 35 31 65 62 66 32 33 34 63 65 32 63 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: OrxAhwT+LUimFTzr.2Context: 26551ebf234ce2ce<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-04 22:53:26 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4f 72 78 41 68 77 54 2b 4c 55 69 6d 46 54 7a 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 36 35 35 31 65 62 66 32 33 34 63 65 32 63 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: OrxAhwT+LUimFTzr.3Context: 26551ebf234ce2ce<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-04 22:53:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 22:53:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 56 4c 53 49 77 46 52 65 58 55 43 62 31 70 50 48 6a 37 71 4f 59 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: VLSIwFReXUCb1pPHj7qOYg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49743	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 22:53:40 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 74 6f 73 32 45 51 48 52 36 30 61 67 50 6f 4d 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 36 61 61 37 32 61 63 64 37 63 37 66 34 66 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: tos2EQHR60agPoMJ.1Context: b6aa72acd7c7f4f2
2024-07-04 22:53:40 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-04 22:53:40 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 74 6f 73 32 45 51 48 52 36 30 61 67 50 6f 4d 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 36 61 61 37 32 61 63 64 37 63 37 66 34 66 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: tos2EQHR60agPoMJ.2Context: b6aa72acd7c7f4f2<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-04 22:53:40 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 74 6f 73 32 45 51 48 52 36 30 61 67 50 6f 4d 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 36 61 61 37 32 61 63 64 37 63 37 66 34 66 32 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: tos2EQHR60agPoMJ.3Context: b6aa72acd7c7f4f2
2024-07-04 22:53:40 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-04 22:53:40 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 68 79 2f 53 65 38 4d 59 55 43 53 36 37 58 6d 50 49 54 63 78 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Ihy/Se8MYUCS67XmPITcxg.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 4044, Parent PID: 5732

General

Target ID:	0
Start time:	18:52:25
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3380, Parent PID: 4044

General

Target ID:	2
Start time:	18:52:28
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2496,i,4737292741680263157,11270633537139994011,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 4608, Parent PID: 5732

General

Target ID:	3
Start time:	18:52:31
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 41

Chrome Cache Entry: 42

Chrome Cache Entry: 43

Chrome Cache Entry: 44

Chrome Cache Entry: 45

Chrome Cache Entry: 46

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 4044, Parent PID: 5732

General

Chronological Activities

Analysis Process: chrome.exePID: 3380, Parent PID: 4044

General

Windows Analysis Report
http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/