Edit tour

Windows Analysis Report
https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t

Overview

General Information

Sample URL:	https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t
Analysis ID:	1469042
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Classification

Process Tree

System is w10x64

chrome.exe (PID: 400 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2216,i,13896716818182238996,1355087275924318838,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://ing.shalominternationalministry.com/cgi-sys/images/404top_w.jpg	Avira URL Cloud: Label: malware
Source: http://ing.shalominternationalministry.com/cgi-sys/images/404mid.gif	Avira URL Cloud: Label: malware
Source: http://ing.shalominternationalministry.com/index.xml	Avira URL Cloud: Label: malware
Source: http://ing.shalominternationalministry.com/cgi-sys/images/x.png	Avira URL Cloud: Label: malware
Source: http://ing.shalominternationalministry.com/cgi-sys/images/404bottom.gif	Avira URL Cloud: Label: malware
Source: http://ing.shalominternationalministry.com/favicon.ico	Avira URL Cloud: Label: malware

Source: http://ing.shalominternationalministry.com/index.xml#?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49718 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 08 Jul 2024 10:29:16 GMTServer: ApacheLast-Modified: Sat, 01 Oct 2022 13:14:07 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 1191Keep-Alive: timeout=5, max=74Connection: Keep-AliveContent-Type: application/javascriptData Raw: 1f 8b 08 00 00 00 00 00 00 03 95 52 4d 6f db 38 10 bd f7 57 d0 82 61 88 85 22 3b 05 f6 22 43 c8 c1 ed 62 b3 6d 92 2e 92 3d 15 3d 30 d2 d8 62 43 93 5e 72 6c 27 70 fc df 77 48 4a b6 e2 a6 dd 2e 7c b0 38 9f 6f de 7b e3 b7 6c 66 56 4f 56 2e 1a 64 e9 8c b3 77 93 f3 77 ec f6 49 6d 84 d4 ec 0f b1 04 f5 e6 b3 35 df a0 c2 82 35 88 2b 57 8c c7 0b 89 cd fa 3e af cc 72 6c a1 6e 0c 3a f5 34 76 72 b9 52 70 06 8f 2b a1 eb 37 57 97 77 ec 93 ac 40 57 70 ec b3 62 9b ff 77 ef 78 29 1c 82 1d ab d8 7e b6 94 98 e3 23 b2 b7 e3 37 e9 7c ad 2b 94 46 a7 43 be 4b d6 0e 98 43 2b 2b 4c a6 5d 82 41 ca 77 1b 61 19 94 d8 48 37 85 bc 86 b9 58 2b 74 e5 ae 91 35 5c 99 1a 8a 64 2e 6a b8 33 8b 85 82 24 6b f3 b7 20 6c d5 c4 f4 4a 58 d0 78 48 dd 09 bb 00 2c 12 02 ad 31 24 b0 b1 66 7b a3 af a4 73 52 2f da fc 60 92 3d 00 ac 6e 51 20 5c ea 99 31 0f 12 8a c1 79 56 85 af 6b a2 b2 48 5e 1c 9a ec 33 c8 1d 20 d2 0c 82 b7 cf 86 39 3c d2 82 3a 3d 86 b3 e3 01 9c be e7 52 d7 9f 60 03 ea 46 c3 7b 5a 56 1e 08 81 0c 33 cd 77 16 70 6d 89 85 50 99 22 a7 7f 45 64 1e 89 eb 4a 06 c3 d4 13 c4 f3 78 ac fb 5b a3 54 34 45 f3 5c 81 5e 60 b3 e7 2d bc 4b 2d 51 0a 15 ee 3a ee 0b db 3c d1 b6 84 dc 82 a8 43 9e 36 4e ed 45 8a 14 59 9a 0d cc 94 70 2e 4d 2a a3 94 58 39 a8 13 9e 8b ba 6e a3 91 04 1f f4 7b 1a b3 4d 35 e7 c5 69 ef b1 aa d7 da 1b 48 bd 5e 57 df bb 6f bf 7b 20 f9 ee 48 65 de e9 5f 96 65 df 01 17 18 27 f0 e2 07 b5 f7 c2 c9 2a 19 8d ba ba 7d 8b f7 ff ef 09 57 fe c2 9e 58 e7 f7 54 0d 54 0f 1f 4f 6d f5 d9 02 79 b1 96 7e b9 2b 7b da ca 79 cf 3b f9 77 76 1c 8d 86 79 b4 23 ed 5b 13 ad e4 12 a8 79 b0 33 d3 b0 65 1f ac 35 36 7d 69 d3 82 7d 37 87 99 95 5f c8 2c fc b3 96 16 1c eb c6 32 34 ec 1e 58 3b 38 4f c2 0d de 1d b1 af 0f d5 7b 07 cb ae b1 0f 3b 46 ae c5 12 c8 4c d1 cf 48 78 f5 5a a9 e7 67 ff 95 24 17 bb 7d f1 e7 ed cd b5 77 af f3 ae eb f6 9c ba 34 50 32 f8 19 27 3c ae 18 9c 4f 3d 22 5d 62 2e 10 89 83 4b 32 d7 94 9a f5 0b aa 62 f1 b4 6f fc 38 26 e5 99 2c ed 17 fd 95 ca 07 93 e7 67 9a d7 62 97 c1 2f 62 03 a7 d8 32 fd cb e8 da 85 a7 d8 ec 8f b0 c9 13 6c 53 f9 c5 7e 2d 75 f6 73 ba b3 40 a9 43 4b 71 39 7f 4a 25 cf 76 56 6c 8b c1 24 5b 09 6c 8a ad d4 b5 d9 e6 ca 54 c2 5f 90 fb a0 a6 be 7d a0 1f 83 cd 4f ee eb 88 8a c9 99 73 24 49 47 4c 0f 43 23 6b b8 32 b5 b7 65 32 17 35 dc 85 f2 e4 42 e7 c7 57 7a fe db 84 17 3f 68 ba 17 4e 56 be 3e 2e 4a 79 31 cc a5 fb bd c3 f2 4a 17 1f 8d 5e 89 7a d4 99 e5 7d c5 28 44 81 c1 f9 f1 46 3a e3 78 26 f0 dd e1 9e 46 b8 99 12 74 64 02 8f 2b 41 c2 90 4e 17 e9 a1 2d a6 2a a3 94 58 39 a8 d9 b1 88 c6 f3 e2 b4 b0 4b b3 43 87 2f 9c 04 b2 49 f1 fa 4e d8 05 a0 7b c1 38 41 dd 45 03 7c f9 da b9 37 11 f7 ce a8 35 42 c2 65 39 4c 2d 9f 82 72 c0 ba ac 05 45 72 6e 42 36 0e fe 04 1b 50 37 1a de 93 1b
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: keep-aliveContent-Length: 30288Server: nginxContent-Type: application/javascript; charset=utf-8Last-Modified: Fri, 18 Oct 1991 12:00:00 GMTETag: W/"28feccc0-1538f"Cache-Control: public, max-age=31536000, stale-while-revalidate=604800Access-Control-Allow-Origin: Content-Encoding: gzipVia: 1.1 varnish, 1.1 varnishAccept-Ranges: bytesDate: Mon, 08 Jul 2024 10:29:17 GMTAge: 3412506X-Served-By: cache-lga13622-LGA, cache-nyc-kteb1890028-NYCX-Cache: HIT, HITX-Cache-Hits: 13, 16885X-Timer: S1720434557.329466,VS0,VE0Vary: Accept-EncodingData Raw: 1f 8b 08 00 00 00 00 00 02 03 bc bd 79 7b db 46 b2 2f fc ff fb 29 44 8c 8f 02 98 2d 4a 72 26 b9 77 40 b5 f9 38 5e 12 67 73 26 76 b6 43 31 79 20 b2 49 21 a6 00 06 00 b5 44 e4 7c f6 5b bf ea 05 0d 10 94 33 73 ee 7d 33 63 11 4b a3 d7 ea ea da eb f8 71 ef e0 f7 7f ae 55 71 77 70 fd f1 e0 e3 c1 e9 c1 e6 20 9c 46 07 5f be 3d 78 95 af b3 59 52 a5 79 76 90 64 b3 83 bc ba 54 c5 c1 34 cf aa 22 bd 58 57 79 51 52 d1 df ff c0 a7 83 bc 58 1c 2f d3 a9 ca 4a 75 f0 f8 f8 ff eb cd d7 d9 14 1f 86 4a 54 d1 7d b0 a6 c7 25 7d 36 ad 82 61 90 5f fc ae e8 42 ca ea 6e a5 f2 f9 c1 55 3e 5b 2f d5 e1 e1 9e 17 03 75 bb ca 8b aa 1c 35 6f a5 1a cc f2 e9 fa 4a 65 d5 a8 a2 66 7a 27 51 5c b7 1a dd a7 f3 b0 57 17 89 aa cb 22 bf 39 c8 d4 cd c1 cb a2 c8 8b 30 30 63 2e d4 1f eb b4 50 e5 41 72 70 93 66 33 2a 73 93 56 97 74 67 bf 0c a2 61 a1 aa 75 91 1d 50 2b d1 36 e6 bf 61 40 33 a3 e6 69 a6 66 41 cf 76 57 7f 3f d2 3f 71 75 99 96 e2 81 69 b8 4e 8a 83 4c 8e 27 a2 f0 46 22 52 f9 86 27 61 b0 50 d5 77 45 5e e5 a8 fb cd 5c e4 32 1b 94 98 60 91 d0 15 ad c1 34 a9 44 49 97 ab 75 79 29 d6 74 41 ad aa 5b 2a b9 94 f7 5b 31 95 cb 41 95 bf a5 a6 b2 85 98 d3 cd 65 52 be b9 c9 a8 c6 95 2a aa 3b b1 92 f3 fa fd 4c ae 06 d3 64 b9 0c 75 d3 91 b8 44 15 0b 69 3b 7f a0 42 ea bc 9e 84 c0 3e ac 57 a9 a2 95 cb d6 57 17 aa a8 a7 a2 1a 64 f9 4c bd a3 9b ad b8 eb ac e8 20 5b 2f 97 54 fe f0 b0 92 54 d5 40 cf da 56 5c cb 7b d4 11 f7 4e 44 59 4c f1 93 e5 df f0 c2 d3 f5 76 e8 aa ba c2 94 8a 2c ba c7 3c a6 34 3f 61 25 ab cd a6 88 06 d3 42 25 95 7a b9 54 98 d0 30 28 a7 45 ba c2 2a 12 40 e4 83 4a dd 56 52 d1 77 73 82 81 f4 20 cd 0e ae a3 6c 9c 4e 0e 0f c3 9c 7e 24 ae a3 61 35 b8 54 c9 6c 90 ac 56 2a 9b 3d bf 4c 97 b3 30 8f 06 ab a4 a0 1a bf a5 81 0d 0a 75 95 5f 2b fb 66 eb 7a 75 0b c8 f3 06 28 a5 1a a9 7e 10 c4 3b b0 ad 36 9b 8e b9 54 a3 e5 78 aa 17 43 45 13 2a 62 3e 8b ed fb 2d 86 7b 21 03 de a9 81 b8 91 4d 08 b3 4d 13 98 df 0c e6 00 8a b4 e2 Data Ascii: y{F/)D-Jr&w@8^gs&vC1y I!D\|[3s}3cKqUqwp F_=xYRyvdT4"XWyQRX/JuJT}%}6a_BnU>[/u5oJefz'Q\W"900c.PArpf3sVtgauP+6a@3ifAvW??quiNL'F"R'aPwE^\2`4DIuy)tA[[1AeR;LduDi;B>WWdL [/TT@V\{NDYL

Source: global traffic	HTTP traffic detected: GET /ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t HTTP/1.1Host: m.exactag.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /index.xml HTTP/1.1Host: ing.shalominternationalministry.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/js/simple-expand.min.js HTTP/1.1Host: ing.shalominternationalministry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ing.shalominternationalministry.com/index.xmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/x.png HTTP/1.1Host: ing.shalominternationalministry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ing.shalominternationalministry.com/index.xmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ing.shalominternationalministry.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404top_w.jpg HTTP/1.1Host: ing.shalominternationalministry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ing.shalominternationalministry.com/index.xmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404mid.gif HTTP/1.1Host: ing.shalominternationalministry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ing.shalominternationalministry.com/index.xmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404bottom.gif HTTP/1.1Host: ing.shalominternationalministry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ing.shalominternationalministry.com/index.xmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/x.png HTTP/1.1Host: ing.shalominternationalministry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ing.shalominternationalministry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ing.shalominternationalministry.com/index.xmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404mid.gif HTTP/1.1Host: ing.shalominternationalministry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404top_w.jpg HTTP/1.1Host: ing.shalominternationalministry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404bottom.gif HTTP/1.1Host: ing.shalominternationalministry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: m.exactag.com
Source: global traffic	DNS traffic detected: DNS query: ing.shalominternationalministry.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 08 Jul 2024 10:29:16 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, Keep-AliveLast-Modified: Sat, 01 Oct 2022 13:16:54 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4677Keep-Alive: timeout=5, max=75Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 73 d3 c8 96 fe 0c bf e2 8c 73 67 80 aa d8 4a 26 61 76 b0 15 df 82 90 0c b9 05 24 9b 84 e5 4e 6d ed 52 6d e9 48 ea 49 ab 8f e8 6e d9 d6 4d cd fe f6 3d dd 92 5f 63 b8 70 77 0d b1 a5 7e 79 ce f3 16 ff f0 fa f2 f4 f6 f7 ab 33 28 5c a9 e0 ea c3 ab b7 17 a7 d0 eb 47 d1 c7 a3 d3 28 7a 7d fb 1a fe fe e6 f6 dd 5b 38 1c 1c c0 8d 33 32 71 51 74 f6 be 07 bd c2 b9 6a 18 45 b3 d9 6c 30 3b 1a 90 c9 a3 db eb 68 ee 51 0e fd b5 ee b1 6f c3 9d 41 ea d2 de f8 71 1c 86 cc 4b a5 ed c9 0e 80 c3 17 2f 5e b4 f7 7a fe d0 50 09 9d 9f f4 50 f7 60 f9 e4 31 50 a4 50 19 ca a4 c2 25 4a 5e 56 79 c0 98 67 3a 3a 3c e4 73 d0 7d e2 12 9d 00 7f ac 8f 9f 6b 39 3d e9 9d 92 76 a8 5d ff b6 a9 b0 07 49 fb 76 d2 73 38 77 91 1f 3e 82 a4 10 c6 a2 3b a9 5d d6 ff b5 07 d1 1a 9a 93 4e e1 f8 f8 e0 18 fa 70 f5 f2 b7 33 78 7f 79 0b e7 97 1f de bf 8e a3 76 ef f1 e3 47 fc 89 7f e8 f7 e1 65 9a c2 8d 92 29 c2 65 ed 2c f4 fb e3 76 cf 26 46 56 0e ac 49 96 02 12 4a 71 f0 c7 e7 1a 4d 33 48 a8 8c da c7 fe d1 e0 68 70 38 28 a5 1e fc 61 7b e3 38 6a 6f 8e 17 74 1e c2 45 49 2e fb b6 b1 d1 1f 36 b2 b2 ac 14 f6 71 5e 09 9d 3e 04 59 8a 5a a9 b3 ae 51 08 8e 8d e9 fc 48 ac 5d f3 72 42 69 73 5f 89 34 95 3a 1f 1e 8c 4a 61 72 a9 f9 21 63 0f fb 99 28 a5 6a 86 05 aa 29 3a 99 88 d1 9f cb 7b 7b de 64 21 35 9a fb ee ce cf 07 d5 1c 44 ed 68 34 93 a9 2b 86 bf fe f2 6b 35 df 79 03 f6 1c 55 ec f7 fd 44 24 77 b9 a1 5a a7 7d 59 8a 1c 87 b5 51 4f 9f 2c f5 86 35 1b f1 49 3e ff 69 36 f8 a3 ca 9f 3c 1b ad 5d 32 58 a1 70 43 4d dd d3 c6 e4 02 65 5e b8 e1 e1 57 68 94 32 fd 2e 1a 7c 7e 90 cb 6c 27 89 f6 a7 df 7c 83 fa 76 2c ec e5 c2 91 99 90 73 54 de 57 64 a5 93 a4 19 47 09 27 a7 38 52 98 b9 e1 d1 0b 46 c9 14 f1 00 ff fe 4f 00 e7 f3 f9 fd da e1 45 ac c7 3e 99 a3 17 ff c6 df 87 fc 38 82 2e b1 90 56 fb d5 3f 5c a4 f7 f5 09 7e 09 b5 5b 9f e2 4b d5 17 4a e6 7a 98 f0 16 9a ef 70 a0 83 83 3d 34 86 4c 42 29 de 87 e2 59 f9 0f 1c 1e 79 ae e1 75 d6 46 f9 eb c1 c1 b7 e2 4d 84 de ae e6 01 ff fb d6 eb 05 59 87 e9 a4 b9 df 1e bf 62 f7 f3 f3 05 3b eb 1a 85 43 e9 d8 83 64 b4 35 f1 5b 07 26 54 57 a4 ef 13 52 64 86 7b 2f 5f 1d 1c 6c 0e fb 79 e7 b0 6f 04 cf d1 59 27 0c 2b 02 f1 c5 11 47 87 3b 47 fc 8b fe af 8d 5c 84 e0 fd 3f 7a fe c5 4a 4c c8 39 2a 19 e5 7e 22 92 bb dc 50 ad d3 be 2c 45 8e c3 da a8 a7 4f a2 24 97 7d db d8 28 ac d9 88 4f b6 57 06 b9 cc 9e 3c 1b ad dd 32 58 21 b7 53 53 f7 b4 51 c8 a2 d5 72 78 fc ed e5 cc c4 e7 4f ab fd 85 1e 78 1e 22 0e df 23 a8 44 9a 4a 9d 0f e1 b0 4d be fd 19 41 a2 50 98 21 33 2d be 75 9a 48 12 32 a9 e4 36 ac c2 81 17 07 3f 8e a0 95 01 bf 3c 67 ec 11 94 52 f7 3b 31 3c ad 5d ea 98 1d 80 a8 1d 8d c0 e1 dc f5 39 c6 9c d7 12 06 47 f3 dd 24 a0 56 70 bf 8e a3 30 73
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 08 Jul 2024 10:29:18 GMTServer: ApacheLast-Modified: Sat, 01 Oct 2022 13:16:54 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4677Keep-Alive: timeout=5, max=74Connection: Keep-AliveContent-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 73 d3 c8 96 fe 0c bf e2 8c 73 67 80 aa d8 4a 26 61 76 b0 15 df 82 90 0c b9 05 24 9b 84 e5 4e 6d ed 52 6d e9 48 ea 49 ab 8f e8 6e d9 d6 4d cd fe f6 3d dd 92 5f 63 b8 70 77 0d b1 a5 7e 79 ce f3 16 ff f0 fa f2 f4 f6 f7 ab 33 28 5c a9 e0 ea c3 ab b7 17 a7 d0 eb 47 d1 c7 a3 d3 28 7a 7d fb 1a fe fe e6 f6 dd 5b 38 1c 1c c0 8d 33 32 71 51 74 f6 be 07 bd c2 b9 6a 18 45 b3 d9 6c 30 3b 1a 90 c9 a3 db eb 68 ee 51 0e fd b5 ee b1 6f c3 9d 41 ea d2 de f8 71 1c 86 cc 4b a5 ed c9 0e 80 c3 17 2f 5e b4 f7 7a fe d0 50 09 9d 9f f4 50 f7 60 f9 e4 31 50 a4 50 19 ca a4 c2 25 4a 5e 56 79 c0 98 67 3a 3a 3c e4 73 d0 7d e2 12 9d 00 7f ac 8f 9f 6b 39 3d e9 9d 92 76 a8 5d ff b6 a9 b0 07 49 fb 76 d2 73 38 77 91 1f 3e 82 a4 10 c6 a2 3b a9 5d d6 ff b5 07 d1 1a 9a 93 4e e1 f8 f8 e0 18 fa 70 f5 f2 b7 33 78 7f 79 0b e7 97 1f de bf 8e a3 76 ef f1 e3 47 fc 89 7f e8 f7 e1 65 9a c2 8d 92 29 c2 65 ed 2c f4 fb e3 76 cf 26 46 56 0e ac 49 96 02 12 4a 71 f0 c7 e7 1a 4d 33 48 a8 8c da c7 fe d1 e0 68 70 38 28 a5 1e fc 61 7b e3 38 6a 6f 8e 17 74 1e c2 45 49 2e fb b6 b1 d1 1f 36 b2 b2 ac 14 f6 71 5e 09 9d 3e 04 59 8a 5a a9 b3 ae 51 08 8e 8d e9 fc 48 ac 5d f3 72 42 69 73 5f 89 34 95 3a 1f 1e 8c 4a 61 72 a9 f9 21 63 0f fb 99 28 a5 6a 86 05 aa 29 3a 99 88 d1 9f cb 7b 7b de 64 21 35 9a fb ee ce cf 07 d5 1c 44 ed 68 34 93 a9 2b 86 bf fe f2 6b 35 df 79 03 f6 1c 55 ec f7 fd 44 24 77 b9 a1 5a a7 7d 59 8a 1c 87 b5 51 4f 9f 2c f5 86 35 1b f1 49 3e ff 69 36 f8 a3 ca 9f 3c 1b ad 5d 32 58 a1 70 43 4d dd d3 c6 e4 02 65 5e b8 e1 e1 57 68 94 32 fd 2e 1a 7c 7e 90 cb 6c 27 89 f6 a7 df 7c 83 fa 76 2c ec e5 c2 91 99 90 73 54 de 57 64 a5 93 a4 19 47 09 27 a7 38 52 98 b9 e1 d1 0b 46 c9 14 f1 00 ff fe 4f 00 e7 f3 f9 fd da e1 45 ac c7 3e 99 a3 17 ff c6 df 87 fc 38 82 2e b1 90 56 fb d5 3f 5c a4 f7 f5 09 7e 09 b5 5b 9f e2 4b d5 17 4a e6 7a 98 f0 16 9a ef 70 a0 83 83 3d 34 86 4c 42 29 de 87 e2 59 f9 0f 1c 1e 79 ae e1 75 d6 46 f9 eb c1 c1 b7 e2 4d 84 de ae e6 01 ff fb d6 eb 05 59 87 e9 a4 b9 df 1e bf 62 f7 f3 f3 05 3b eb 1a 85 43 e9 d8 83 64 b4 35 f1 5b 07 26 54 57 a4 ef 13 52 64 86 7b 2f 5f 1d 1c 6c 0e fb 79 e7 b0 6f 04 cf d1 59 27 0c 2b 02 f1 c5 11 47 87 3b 47 fc 8b fe af 8d 5c 84 e0 fd 3f 7a fe c5 4a 4c c8 39 2a 19 e5 7e 22 92 bb dc 50 ad d3 be 2c 45 8e c3 da a8 a7 4f a2 24 97 7d db d8 28 ac d9 88 4f b6 57 06 b9 cc 9e 3c 1b ad dd 32 58 21 b7 53 53 f7 b4 51 c8 a2 d5 72 78 fc ed e5 cc c4 e7 4f ab fd 85 1e 78 1e 22 0e df 23 a8 44 9a 4a 9d 0f e1 b0 4d be fd 19 41 a2 50 98 21 33 2d be 75 9a 48 12 32 a9 e4 36 ac c2 81 17 07 3f 8e a0 95 01 bf 3c 67 ec 11 94 52 f7 3b 31 3c ad 5d ea 98 1d 80 a8 1d 8d c0 e1 dc f5 39 c6 9c d7 12 06 47 f3 dd 24 a0 56 70 bf 8e a3 30 73 df 8f 42 bb 51 1e 3d fa 66

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49718 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@17/20@10/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2216,i,13896716818182238996,1355087275924318838,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2216,i,13896716818182238996,1355087275924318838,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://ing.shalominternationalministry.com/cgi-sys/images/404top_w.jpg	100%	Avira URL Cloud	malware
http://ing.shalominternationalministry.com/cgi-sys/images/404mid.gif	100%	Avira URL Cloud	malware
http://ing.shalominternationalministry.com/index.xml	100%	Avira URL Cloud	malware
http://ing.shalominternationalministry.com/cgi-sys/images/x.png	100%	Avira URL Cloud	malware
http://ing.shalominternationalministry.com/cgi-sys/images/404bottom.gif	100%	Avira URL Cloud	malware
http://code.jquery.com/jquery-3.3.1.min.js	0%	Avira URL Cloud	safe
http://ing.shalominternationalministry.com/favicon.ico	100%	Avira URL Cloud	malware
http://code.jquery.com/jquery-3.3.1.min.js	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
code.jquery.com	151.101.130.137	true	false	unknown
www.google.com	172.217.16.196	true	false	unknown
ing.shalominternationalministry.com	192.185.171.24	true	false	unknown
tp-emea.exactag.com	213.202.235.9	true	false	unknown
m.exactag.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t	false		unknown
http://ing.shalominternationalministry.com/cgi-sys/images/404mid.gif	false	Avira URL Cloud: malware	unknown
http://ing.shalominternationalministry.com/cgi-sys/images/x.png	false	Avira URL Cloud: malware	unknown
http://ing.shalominternationalministry.com/index.xml	false	Avira URL Cloud: malware	unknown
http://ing.shalominternationalministry.com/cgi-sys/images/404bottom.gif	false	Avira URL Cloud: malware	unknown
http://ing.shalominternationalministry.com/cgi-sys/images/404top_w.jpg	false	Avira URL Cloud: malware	unknown
http://ing.shalominternationalministry.com/index.xml#?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t	false		unknown
http://code.jquery.com/jquery-3.3.1.min.js	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ing.shalominternationalministry.com/favicon.ico	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.185.171.24	ing.shalominternationalministry.com	United States	46606	UNIFIEDLAYER-AS-1US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
213.202.235.9	tp-emea.exactag.com	Germany	24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1469042
Start date and time:	2024-07-08 12:28:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@17/20@10/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 142.250.184.206, 74.125.71.84, 34.104.35.123, 20.12.23.50, 93.184.221.240, 13.85.23.206, 20.166.126.56, 142.250.181.227
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, time.windows.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: http://ing.shalominternationalministry.com/index.xml#?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The title and text of the webpage do not contain a login form.","The text of the webpage does not create a sense of urgency.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}
Title: 404 - PAGE NOT FOUND OCR: ERROR 404 - PAGE NOT FOUND Why am I How to find the correct spelling and folder 404 Errors After Clicking WordPress Links How to modify_your .htaccess file

Input

Output

URL: http://ing.shalominternationalministry.com/index.xml#?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t Model: Perplexity: mixtral-8x7b-instruct

{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The title and text of the webpage do not contain a login form.","The text of the webpage does not create a sense of urgency.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}

Title: 404 - PAGE NOT FOUND OCR: ERROR 404 - PAGE NOT FOUND Why am I How to find the correct spelling and folder 404 Errors After Clicking WordPress Links How to modify_your .htaccess file

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 49

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 868 x 14
Category:	dropped
Size (bytes):	537
Entropy (8bit):	6.848296452361371
Encrypted:	false
SSDEEP:	12:BDGHgnth2eq8ExIFDW+ax8+RorOwL+8Cu2uPhNWnyRmK3Fd7HRa:lGHith7rEAW+a0W8GChUnyRmoy
MD5:	54EB288427ACF79ED320EFD4916FE0B7
SHA1:	67BA813FF74D52035D70FCDA58B57563F01FB829
SHA-256:	70E4A5F9F7D98C1564B17ECC69196FED4F74FE5AFB2C61B4FB7045DD3309DC4F
SHA-512:	C7C00A268ADA15FC6B19F64860DD5CE92FA69E6B64E2D7B3ADA02B74E6CC3C4EB4466BBA443752A76F4EE908FA93F3683C6256F7A473B05C86ECAEBBCAC125E1
Malicious:	false
Reputation:	low
Preview:	GIF89ad......6e............\|.....m.....\.......Nw................X..s........d.................{..~.....k.....c..Y......................................................................................!.......,....d......@.AB,...r.l:..tJ.Z..v..z..xL....z]T...\|N.....~.....OnB.............Un.............S......................................f..............D.........f..............D.#p.........E......H...2..............@....#..... C..I...(S.\...0c.I...8s.....6.*.d.......(ph.DC...8..Z...X.j....`..K...S9X Q"I..;

Chrome Cache Entry: 50

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 868x169, components 3
Category:	downloaded
Size (bytes):	4335
Entropy (8bit):	5.483603315043782
Encrypted:	false
SSDEEP:	48:Ivi3ZsdwUKPGIhuF/ig2BamU/CSkMKisRHcfZakyWr9A9RSxNRXbRzwn:HpowU4ovDPCSrKishcxjyWrCCb+n
MD5:	DE6ECBBB2471827D90BF32C47A0CBC45
SHA1:	FFEAAFE8B9CA2752908C5D4E95E4803EF7FFDD18
SHA-256:	5CAE6C33F0F9D4449CE8539A60E7D40EBA2DDC75979FC26284854A29C36D08CB
SHA-512:	FAF0F054EF55B3362BA26615BC670DCC0471D660BBFBC4D086CE8CB143D31235AFC4AD4332FB669CAB4ED422C99FE67AB31D8E955D9B18F21A4CFDD33090D496
Malicious:	false
Reputation:	low
URL:	http://ing.shalominternationalministry.com/cgi-sys/images/404top_w.jpg
Preview:	......JFIF.....H.H.....C..............................................!........."$".$.......C.........................................................................d..........................................:..............................!..16FQt.....aq..AV..&..................................'....................R........Q.!13...............?..X..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 51

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 11816
Category:	downloaded
Size (bytes):	4677
Entropy (8bit):	7.946065353100574
Encrypted:	false
SSDEEP:	96:bZ/NwFlux9fPOlplZDCxX44cnBn4PxuyjWe8zngjoNRc/YrdgN:bZ/CQZOLUcFleWJMUraYrdgN
MD5:	E6AAE2410885DF2F2629465B60A2691D
SHA1:	859D3D883FB8CA2AADEDF5753ABCD7ACCE922479
SHA-256:	A113D210F17827A95D9D1EEE68BF4E0AA8BD39D67DF1D9420FF5E9C0F49B1D48
SHA-512:	77CFA85A05295F3E1D239AE09D6EC80B7D038A0466276B7D5586E614035BABFAA7FAC4B965643EF18C38648ED68BACBFB510BCF06AC578BCFE2C11F7892544AD
Malicious:	false
Reputation:	low
URL:	http://ing.shalominternationalministry.com/index.xml
Preview:	...........Rms......sg...J&av.......$...Nm.Rm.H.I...n..M...=._c.pw...~y...........3(\.........G...(z}.......[8....32qQt.....j.E..l0;.....h.Q....o.A....q...K......./^..z..P....P.`..1P.P...%J^Vy..g::<.s.}........k9=.v.].....I.v.s8w..>....;.]........N......p..3x.y......v...G......e...).e.,...v.&FV..I...Jq....M3H.......hp8(...a{.8jo..t..EI......6.....q^..>.Y.Z...Q.....H.].rBis_.4.:...Jar..!c...(.j...):....{{.d!5........D.h4..+....k5.y...U...D$w..Z.}Y....QO.,..5..I>.i6...<..]2X.pCM.....e^...Wh.2...\|~..l'....\|..v,.....sT.Wd....G.'.8R.....F......O.......E..>.......8....V..?\....~..[..K..J.z.....p...=4.LB)..Y....y..u.F......M.........Y.....b....;...C..d.5.[.&TW...Rd.{/_..l..y.o...Y'.+....G.;G.....\...?z..JL.9..~"...P..,E....O.$.}..(..O.W...<...2X!.SS..Q..rx......O....x."..#.D.J...M...A.P.!3-.u.H.2..6....?.....<g...R.;1<.]..........9....G..$.Vp...0s.B.Q.=.f.%a..fQmB<.q..MZq..0&....V....k....I&;..A...}m.D3.q..Icy+!Ef.}.~...`.i....../~].B......&.

Chrome Cache Entry: 52

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 868 x 14
Category:	downloaded
Size (bytes):	537
Entropy (8bit):	6.848296452361371
Encrypted:	false
SSDEEP:	12:BDGHgnth2eq8ExIFDW+ax8+RorOwL+8Cu2uPhNWnyRmK3Fd7HRa:lGHith7rEAW+a0W8GChUnyRmoy
MD5:	54EB288427ACF79ED320EFD4916FE0B7
SHA1:	67BA813FF74D52035D70FCDA58B57563F01FB829
SHA-256:	70E4A5F9F7D98C1564B17ECC69196FED4F74FE5AFB2C61B4FB7045DD3309DC4F
SHA-512:	C7C00A268ADA15FC6B19F64860DD5CE92FA69E6B64E2D7B3ADA02B74E6CC3C4EB4466BBA443752A76F4EE908FA93F3683C6256F7A473B05C86ECAEBBCAC125E1
Malicious:	false
Reputation:	low
URL:	http://ing.shalominternationalministry.com/cgi-sys/images/404bottom.gif
Preview:	GIF89ad......6e............\|.....m.....\.......Nw................X..s........d.................{..~.....k.....c..Y......................................................................................!.......,....d......@.AB,...r.l:..tJ.Z..v..z..xL....z]T...\|N.....~.....OnB.............Un.............S......................................f..............D.........f..............D.#p.........E......H...2..............@....#..... C..I...(S.\...0c.I...8s.....6.*.d.......(ph.DC...8..Z...X.j....`..K...S9X Q"I..;

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 868 x 4
Category:	downloaded
Size (bytes):	120
Entropy (8bit):	6.060493667147718
Encrypted:	false
SSDEEP:	3:CcnebN95vXG5Z1CK/7kCfrpvsdhyt86psoPHHn:tQG5Z1Dn+Wy6pseH
MD5:	DC8055F43FBB4A4B6DFB298EC35188F2
SHA1:	1FFC540743DE1CDB929D9D1218978005141E8D9D
SHA-256:	B857737891B84293B3DF526B48CE3D54FDCC5789C250EADFF9DD38E3C2C68CAF
SHA-512:	2CC173EFBA132E4352582F000F226E86A9A898B8A3AC1BA9633B2F19838B618EE3047555928E5258CC97E514D6F96ADF86391F7C6104288F1A61543E93B13518
Malicious:	false
Reputation:	low
URL:	http://ing.shalominternationalministry.com/cgi-sys/images/404mid.gif
Preview:	GIF89ad.................!.......,....d.....I...............H....................D..VL*.....J.T..P.j......-...;

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 97 x 97, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	7.864218635615192
Encrypted:	false
SSDEEP:	48:TlCtqLaLvN6P+NsI1hmhzoioE0jAoeZBrnFIVVbtdoV0GdXSnZ9wKS6Ei3:ItqLaLVvk9X08n3nWV5+B1SnZ9wKfD3
MD5:	F851DB995B0253A71D638F779BE88330
SHA1:	5F5319E016676E6B92F7E597B837677DDF52C0A5
SHA-256:	2C024E287D53DCC084B60B01A69990C369E758DC7C91B0FE4791F02D18AAE61A
SHA-512:	AB09FAECBB8C24ACADE89EFC25515C2B25C12C378144180E5B807309F793720E30BCE75A604515181554068FE4BAAD34E4EE050A6B5C5F9485D1E4712B9EC724
Malicious:	false
Reputation:	low
URL:	http://ing.shalominternationalministry.com/cgi-sys/images/x.png
Preview:	.PNG........IHDR...a...a.......?.....sBIT.....O....`PLTEf.....^^.77...zz\|....uu.-&.{W.........A-. ..3&.iH.RB.......\@....//.............`.....t.__...3j&.....pHYs...........~.....tEXtCreation Time.03/04/09.......tEXtSoftware.Adobe Fireworks CS4......]IDATh....z....1.H....m....[....t...6..........]].S.SY.C..z.O..................g^tf.e:0[...^..B19.m9......5(.....p......Z..1.E.}....Z.Q..R...w........C.......;..ZH..j8stB0....t..._4M.D{..c.U..:...w....&.q...f..+..F..b.7...H...P........u.s..D....?.n.S.H...su....K.!R;DN..BA._..K,..]/....(o.}..~...v.Gke.~.66.+..#6.SW.N..w9.&.}..m...j...kW.....0E.{.........8...!2NT.....AU../.kUu...D._..w.[..........]%@.cm.(.UU..L_.%....XWU..3[.T...m. J...T.9@..Of.b....C\|Ukk/..R8.H.>p.V....R.....e.Es$...=@x...A...?.$..=.....T<..`j..o4.B..b.......]...h.M.p....<z.:.@H.....y..N.........."..0T.....X..71.4...k..$...V.Tx^...s...}..1../.7.`s+..6..W!..!.zR....V....I..N...}7}...X-.2T.........6).V........`6+.Y..6t'".U/.#>F..80.

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 97 x 97, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.864218635615192
Encrypted:	false
SSDEEP:	48:TlCtqLaLvN6P+NsI1hmhzoioE0jAoeZBrnFIVVbtdoV0GdXSnZ9wKS6Ei3:ItqLaLVvk9X08n3nWV5+B1SnZ9wKfD3
MD5:	F851DB995B0253A71D638F779BE88330
SHA1:	5F5319E016676E6B92F7E597B837677DDF52C0A5
SHA-256:	2C024E287D53DCC084B60B01A69990C369E758DC7C91B0FE4791F02D18AAE61A
SHA-512:	AB09FAECBB8C24ACADE89EFC25515C2B25C12C378144180E5B807309F793720E30BCE75A604515181554068FE4BAAD34E4EE050A6B5C5F9485D1E4712B9EC724
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...a...a.......?.....sBIT.....O....`PLTEf.....^^.77...zz\|....uu.-&.{W.........A-. ..3&.iH.RB.......\@....//.............`.....t.__...3j&.....pHYs...........~.....tEXtCreation Time.03/04/09.......tEXtSoftware.Adobe Fireworks CS4......]IDATh....z....1.H....m....[....t...6..........]].S.SY.C..z.O..................g^tf.e:0[...^..B19.m9......5(.....p......Z..1.E.}....Z.Q..R...w........C.......;..ZH..j8stB0....t..._4M.D{..c.U..:...w....&.q...f..+..F..b.7...H...P........u.s..D....?.n.S.H...su....K.!R;DN..BA._..K,..]/....(o.}..~...v.Gke.~.66.+..#6.SW.N..w9.&.}..m...j...kW.....0E.{.........8...!2NT.....AU../.kUu...D._..w.[..........]%@.cm.(.UU..L_.%....XWU..3[.T...m. J...T.9@..Of.b....C\|Ukk/..R8.H.>p.V....R.....e.Es$...=@x...A...?.$..=.....T<..`j..o4.B..b.......]...h.M.p....<z.:.@H.....y..N.........."..0T.....X..71.4...k..$...V.Tx^...s...}..1../.7.`s+..6..W!..!.zR....V....I..N...}7}...X-.2T.........6).V........`6+.Y..6t'".U/.#>F..80.

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 868x169, components 3
Category:	dropped
Size (bytes):	4335
Entropy (8bit):	5.483603315043782
Encrypted:	false
SSDEEP:	48:Ivi3ZsdwUKPGIhuF/ig2BamU/CSkMKisRHcfZakyWr9A9RSxNRXbRzwn:HpowU4ovDPCSrKishcxjyWrCCb+n
MD5:	DE6ECBBB2471827D90BF32C47A0CBC45
SHA1:	FFEAAFE8B9CA2752908C5D4E95E4803EF7FFDD18
SHA-256:	5CAE6C33F0F9D4449CE8539A60E7D40EBA2DDC75979FC26284854A29C36D08CB
SHA-512:	FAF0F054EF55B3362BA26615BC670DCC0471D660BBFBC4D086CE8CB143D31235AFC4AD4332FB669CAB4ED422C99FE67AB31D8E955D9B18F21A4CFDD33090D496
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....C..............................................!........."$".$.......C.........................................................................d..........................................:..............................!..16FQt.....aq..AV..&..................................'....................R........Q.!13...............?..X..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 868 x 4
Category:	dropped
Size (bytes):	120
Entropy (8bit):	6.060493667147718
Encrypted:	false
SSDEEP:	3:CcnebN95vXG5Z1CK/7kCfrpvsdhyt86psoPHHn:tQG5Z1Dn+Wy6pseH
MD5:	DC8055F43FBB4A4B6DFB298EC35188F2
SHA1:	1FFC540743DE1CDB929D9D1218978005141E8D9D
SHA-256:	B857737891B84293B3DF526B48CE3D54FDCC5789C250EADFF9DD38E3C2C68CAF
SHA-512:	2CC173EFBA132E4352582F000F226E86A9A898B8A3AC1BA9633B2F19838B618EE3047555928E5258CC97E514D6F96ADF86391F7C6104288F1A61543E93B13518
Malicious:	false
Reputation:	low
Preview:	GIF89ad.................!.......,....d.....I...............H....................D..VL*.....J.T..P.j......-...;

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 2782
Category:	downloaded
Size (bytes):	1191
Entropy (8bit):	7.796270292729931
Encrypted:	false
SSDEEP:	24:XcZ+V72kAJOJMbpIYwbu7xzHfOHSyW3BgOk0o8fG+ITcIlp4ezR1ZO5:XcZKAeYpIrqzHfkSLHkbH4sRjO5
MD5:	DE892F8C9F4F88B59E09D5F162C5E1F2
SHA1:	1D257DA4E5DDE3A5817F2F41F047BAFD49B646A3
SHA-256:	70C74579F4A1E433CC33E298EA1C08073BFFCDFB6D6DD36163C942B2C8FE4381
SHA-512:	84006416B70DFE6B8CBA6F5EAA0F618406D8404A9FE0E04680BAC3D63F43294F7514A1777D1882A19574331599E4A3E4BC4B6298822535C7283CC1557A2024DC
Malicious:	false
Reputation:	low
URL:	http://ing.shalominternationalministry.com/cgi-sys/js/simple-expand.min.js
Preview:	...........RMo.8...W.a..";.."C...b.m...=.=0..bC.^rl'p..wHJ....\|.8.o.{.lfVOV..d.w..w..Im........5..5.+W......>..rl.n.:.4vr.Rp..+..7W.w.@Wp.b..w.x).....~....#...7.\|.+.F.C.K...C++L.].A.w.a...H7....X+t.5\...d.j.3...$k. l...JX.xH....,...1$..f{...sR/..`.=..nQ \.1....yV..k..H^...3.. .....9<.:=.......R.`..F.{ZV....3.w.pm..P."..Ed...J......x..[.T4E.\.^`..-.K-Q...:...<....C.6N.E..Y...p.M..X9.....n.....{..M5..i....H.^W.o.{ ..He.._.e....'...........}.....W..X..T.T..Om...y..~.+{..y.;.wv...y.#.[.....y.3.e..56}i.}7..._.,.......24..X;8O........{....;F....L..Hx.Z..g..$..}....w......4P2..'<...O="]b....K2.....b.o.8&.,........g..b../b...2.........lS..~-u.s..@.CKq9.J%.vVl..$[.l......T._.....}....O...s$IGL.C#k.2..e2.5...B..Wz...?h..NV.>.Jy1.....J...^.z..}.(D....F:.x&...F...td..+A.N..-.*..X9......K.C./...I..N...{.8A.E.\|..7...5B.e9L-..r....ErnB6....P7......i.JX..U.l....W..0%.......LF......F.r/K\....[..g@......p....t...T_5P=\|$,A.K=...l.2..~.Ky.9..I.

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 11816
Category:	downloaded
Size (bytes):	4677
Entropy (8bit):	7.946065353100574
Encrypted:	false
SSDEEP:	96:bZ/NwFlux9fPOlplZDCxX44cnBn4PxuyjWe8zngjoNRc/YrdgN:bZ/CQZOLUcFleWJMUraYrdgN
MD5:	E6AAE2410885DF2F2629465B60A2691D
SHA1:	859D3D883FB8CA2AADEDF5753ABCD7ACCE922479
SHA-256:	A113D210F17827A95D9D1EEE68BF4E0AA8BD39D67DF1D9420FF5E9C0F49B1D48
SHA-512:	77CFA85A05295F3E1D239AE09D6EC80B7D038A0466276B7D5586E614035BABFAA7FAC4B965643EF18C38648ED68BACBFB510BCF06AC578BCFE2C11F7892544AD
Malicious:	false
Reputation:	low
URL:	http://ing.shalominternationalministry.com/favicon.ico
Preview:	...........Rms......sg...J&av.......$...Nm.Rm.H.I...n..M...=._c.pw...~y...........3(\.........G...(z}.......[8....32qQt.....j.E..l0;.....h.Q....o.A....q...K......./^..z..P....P.`..1P.P...%J^Vy..g::<.s.}........k9=.v.].....I.v.s8w..>....;.]........N......p..3x.y......v...G......e...).e.,...v.&FV..I...Jq....M3H.......hp8(...a{.8jo..t..EI......6.....q^..>.Y.Z...Q.....H.].rBis_.4.:...Jar..!c...(.j...):....{{.d!5........D.h4..+....k5.y...U...D$w..Z.}Y....QO.,..5..I>.i6...<..]2X.pCM.....e^...Wh.2...\|~..l'....\|..v,.....sT.Wd....G.'.8R.....F......O.......E..>.......8....V..?\....~..[..K..J.z.....p...=4.LB)..Y....y..u.F......M.........Y.....b....;...C..d.5.[.&TW...Rd.{/_..l..y.o...Y'.+....G.;G.....\...?z..JL.9..~"...P..,E....O.$.}..(..O.W...<...2X!.SS..Q..rx......O....x."..#.D.J...M...A.P.!3-.u.H.2..6....?.....<g...R.;1<.]..........9....G..$.Vp...0s.B.Q.=.f.%a..fQmB<.q..MZq..0&....V....k....I&;..A...}m.D3.q..Icy+!Ef.}.~...`.i....../~].B......&.

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, from Unix, original size modulo 2^32 86927
Category:	downloaded
Size (bytes):	30288
Entropy (8bit):	7.989374364238999
Encrypted:	false
SSDEEP:	384:vqVmdqPCM85TevWTS9XJbgB2EttwJ52qjCpG6XUcUsJ5plH94VYb/n9SjXjwPG6G:vqUdH5TevT9Zi2CtE5FcGcUvq9f9tG
MD5:	FA20D8437865646E82DC61B9ADF6C93E
SHA1:	936B2B3A3757ECA48867CF43BADEF1C608177A28
SHA-256:	777EFEE22CC03118F4E5BA78AEF0CF7ADB1E8A13FC2B5C60FD220E80472F0188
SHA-512:	81C77E1A7B29D089EF10056C10AAC8F696CC889499D9B68B40550E861173557EDAF39049859188FE9EEC55F69B3B22B05044AFD8B6B212101EC792A7FD289F02
Malicious:	false
Reputation:	low
URL:	http://code.jquery.com/jquery-3.3.1.min.js
Preview:	............y{.F./...)D....-Jr&.w@..8^.gs&v.C1y .I!.....D.\|.[......3s.}3c.K.......q.....Uqwp........ .F._.=x...YR.yv.d....T..4.".XWyQR.......X./..Ju...........JT.}...%}6..a._...B..n....U>[/.....u....5o......Je..fz'Q\....W....".9......00c....P.Arp.f3s.V.tg...a..u..P+.6.a@3..i.fA.vW.?.?qu...i.N..L.'..F"R..'a.P.wE^...\.2...`.....4.DI..uy).tA..[...[1..A.........eR.....;.....L...d..u..D..i;..B...>.W.....W......d.L....... [/.T..T.@..V\.{...NDYL.......v...,..<.4?a%.....B%.z.T..0(.E...@.J.VR.ws... ....l.N...~$..a5.T.l..V.=.L..0...........u._+.f.zu....(...~..;..6...T..x..CE.b>...-.{!.....M..M.........7[.N..:>/..^.zu~..d...../..L..V.....m.`.@x=........e\|"..YQ$w..t...x......m.,.p..NF...>~...I..M.....J...Ub.......x..#..-M.U...%..j+T2......o.B.b+..UW1n..,.~$.....pMqeF,2,SD..>..V.9.sy..N..#.......U...O..2y...).Q.t...".}..y..zR.........y..$.OP}6.;J.*.....KQ.A..b..Q.x../....6$..s..0... .B..M.......R..nu...w:.....\|..o.'.H.2iTV....H...d.Y.I..

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 8, 2024 12:29:06.761562109 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 8, 2024 12:29:07.076176882 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 8, 2024 12:29:07.620491982 CEST	49674	443	192.168.2.7	104.98.116.138
Jul 8, 2024 12:29:07.620575905 CEST	49675	443	192.168.2.7	104.98.116.138
Jul 8, 2024 12:29:07.683032990 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 8, 2024 12:29:07.745491982 CEST	49672	443	192.168.2.7	104.98.116.138
Jul 8, 2024 12:29:08.886113882 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 8, 2024 12:29:11.292417049 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 8, 2024 12:29:15.134890079 CEST	49704	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.134922981 CEST	443	49704	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.135117054 CEST	49705	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.135118961 CEST	49704	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.135150909 CEST	443	49705	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.135199070 CEST	49705	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.135323048 CEST	49704	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.135338068 CEST	443	49704	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.135483027 CEST	49705	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.135495901 CEST	443	49705	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.312496901 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 8, 2024 12:29:15.684458971 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 8, 2024 12:29:15.941502094 CEST	443	49704	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.943598032 CEST	49704	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.943614006 CEST	443	49704	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.944709063 CEST	443	49704	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.944818020 CEST	49704	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.946451902 CEST	49704	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.946521044 CEST	443	49704	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.946619034 CEST	49704	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.946631908 CEST	443	49704	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.965882063 CEST	443	49705	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.967080116 CEST	49705	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.967108011 CEST	443	49705	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.968152046 CEST	443	49705	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.968221903 CEST	49705	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.969665051 CEST	49705	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:15.969737053 CEST	443	49705	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:15.996361017 CEST	49704	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:16.011563063 CEST	49705	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:16.011574030 CEST	443	49705	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:16.066118956 CEST	49705	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:16.104319096 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 8, 2024 12:29:16.124579906 CEST	443	49704	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:16.124676943 CEST	443	49704	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:16.124748945 CEST	49704	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:16.131994009 CEST	49704	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:16.132018089 CEST	443	49704	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:16.261009932 CEST	49708	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:16.266673088 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:16.266756058 CEST	49708	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:16.266987085 CEST	49708	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:16.274913073 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:16.432574034 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 8, 2024 12:29:16.782466888 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:16.782502890 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:16.782519102 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:16.782548904 CEST	49708	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:16.782718897 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:16.782728910 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:16.782758951 CEST	49708	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:16.825447083 CEST	49708	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:16.898114920 CEST	49708	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:16.898581982 CEST	49709	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:16.906032085 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:16.906048059 CEST	80	49709	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:16.906119108 CEST	49709	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:16.914606094 CEST	49709	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:16.916007996 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:16.919549942 CEST	80	49709	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:16.920860052 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:16.920938015 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:16.921425104 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:16.927544117 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.024084091 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:17.024149895 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:17.024291039 CEST	49708	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:17.233429909 CEST	49674	443	192.168.2.7	104.98.116.138
Jul 8, 2024 12:29:17.233665943 CEST	49675	443	192.168.2.7	104.98.116.138
Jul 8, 2024 12:29:17.345509052 CEST	49672	443	192.168.2.7	104.98.116.138
Jul 8, 2024 12:29:17.375401020 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.375417948 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.375430107 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.375507116 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.375538111 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.375545025 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.375557899 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.375600100 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.375890017 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.375895977 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.375909090 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.375916004 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.375931025 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.375931025 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.375967026 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.380479097 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.380523920 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.380530119 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.380579948 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.380606890 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.381496906 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.414871931 CEST	80	49709	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:17.414942026 CEST	80	49709	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:17.414947987 CEST	80	49709	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:17.415010929 CEST	49709	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:17.464306116 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.464323997 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.464338064 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.464384079 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.464422941 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.464488029 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.464493990 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.464536905 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.464648962 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.464656115 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.464700937 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.465071917 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.465128899 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.465133905 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.465179920 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.465445042 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.465483904 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.465490103 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.465507984 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.465528965 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.465588093 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:29:17.513365030 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:29:17.866566896 CEST	49711	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:29:17.866614103 CEST	443	49711	172.217.16.196	192.168.2.7
Jul 8, 2024 12:29:17.866713047 CEST	49711	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:29:17.866925001 CEST	49711	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:29:17.866935968 CEST	443	49711	172.217.16.196	192.168.2.7
Jul 8, 2024 12:29:17.882213116 CEST	49709	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:17.884733915 CEST	49708	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:17.885576963 CEST	49712	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:17.887238026 CEST	80	49709	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:17.890151978 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:17.890737057 CEST	80	49712	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:17.890810013 CEST	49712	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:17.891387939 CEST	49712	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:17.896142006 CEST	80	49712	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:17.936081886 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 8, 2024 12:29:18.010121107 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.011799097 CEST	80	49709	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.011817932 CEST	80	49709	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.011826038 CEST	80	49709	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.011864901 CEST	49709	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.011960983 CEST	80	49709	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.012028933 CEST	49709	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.050303936 CEST	49713	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.055622101 CEST	80	49713	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.055747032 CEST	49713	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.056509972 CEST	49713	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.058799028 CEST	49708	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.061738014 CEST	80	49713	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.397700071 CEST	80	49712	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.448692083 CEST	49712	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.512761116 CEST	443	49711	172.217.16.196	192.168.2.7
Jul 8, 2024 12:29:18.519974947 CEST	49711	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:29:18.520013094 CEST	443	49711	172.217.16.196	192.168.2.7
Jul 8, 2024 12:29:18.521158934 CEST	443	49711	172.217.16.196	192.168.2.7
Jul 8, 2024 12:29:18.521250010 CEST	49711	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:29:18.528040886 CEST	49711	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:29:18.528157949 CEST	443	49711	172.217.16.196	192.168.2.7
Jul 8, 2024 12:29:18.571089029 CEST	80	49713	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.571109056 CEST	80	49713	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.571120977 CEST	80	49713	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.571167946 CEST	49713	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.572376013 CEST	49711	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:29:18.572387934 CEST	443	49711	172.217.16.196	192.168.2.7
Jul 8, 2024 12:29:18.583923101 CEST	49712	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.588831902 CEST	80	49712	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.612118959 CEST	49713	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.612601995 CEST	49711	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:29:18.623688936 CEST	49714	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:18.623723984 CEST	443	49714	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:18.623783112 CEST	49714	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:18.626667023 CEST	49714	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:18.626678944 CEST	443	49714	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:18.711273909 CEST	80	49712	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.711327076 CEST	80	49712	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.711339951 CEST	80	49712	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.711354017 CEST	80	49712	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.711365938 CEST	80	49712	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.711401939 CEST	49712	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.711458921 CEST	49712	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.772933006 CEST	49713	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.773847103 CEST	49715	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.774754047 CEST	49716	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.777893066 CEST	80	49713	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.778743982 CEST	80	49715	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.778820992 CEST	49715	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.779572964 CEST	80	49716	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.779687881 CEST	49716	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.780472040 CEST	49715	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.780572891 CEST	49716	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:18.786083937 CEST	80	49715	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.786098957 CEST	80	49716	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.902034044 CEST	80	49713	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:18.979600906 CEST	49713	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:19.267360926 CEST	80	49715	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:19.267378092 CEST	80	49715	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:19.267391920 CEST	80	49715	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:19.267446995 CEST	49715	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:19.267643929 CEST	80	49715	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:19.267761946 CEST	49715	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:19.285070896 CEST	80	49716	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:19.300966978 CEST	443	49714	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:19.301042080 CEST	49714	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:19.304569006 CEST	49714	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:19.304579973 CEST	443	49714	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:19.304836035 CEST	443	49714	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:19.339391947 CEST	49716	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:19.342094898 CEST	49714	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:19.384510040 CEST	443	49714	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:19.578947067 CEST	443	49714	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:19.579024076 CEST	443	49714	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:19.579119921 CEST	49714	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:19.688131094 CEST	49714	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:19.688159943 CEST	443	49714	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:19.688205004 CEST	49714	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:19.688211918 CEST	443	49714	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:19.895050049 CEST	49718	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:19.895102978 CEST	443	49718	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:19.895380020 CEST	49718	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:19.896095991 CEST	49718	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:19.896107912 CEST	443	49718	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:20.533845901 CEST	443	49718	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:20.533920050 CEST	49718	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:20.535096884 CEST	49718	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:20.535110950 CEST	443	49718	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:20.535402060 CEST	443	49718	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:20.536467075 CEST	49718	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:20.576518059 CEST	443	49718	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:20.813929081 CEST	443	49718	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:20.814007044 CEST	443	49718	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:20.814080000 CEST	49718	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:20.814810991 CEST	49718	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:20.814831018 CEST	443	49718	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:20.814842939 CEST	49718	443	192.168.2.7	184.28.90.27
Jul 8, 2024 12:29:20.814850092 CEST	443	49718	184.28.90.27	192.168.2.7
Jul 8, 2024 12:29:20.917829037 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 8, 2024 12:29:23.011302948 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:23.011368990 CEST	49708	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:23.013135910 CEST	80	49709	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:23.013211012 CEST	49709	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:23.544121027 CEST	49708	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:23.544275045 CEST	49709	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:23.549264908 CEST	80	49708	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:23.549283981 CEST	80	49709	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:23.711935997 CEST	80	49712	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:23.711997032 CEST	49712	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:23.983308077 CEST	80	49713	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:23.983445883 CEST	49713	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:24.268438101 CEST	80	49715	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:24.268507004 CEST	49715	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:24.285914898 CEST	80	49716	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:24.286103010 CEST	49716	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:25.579065084 CEST	49713	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:25.579164982 CEST	49715	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:25.579186916 CEST	49716	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:25.579266071 CEST	49712	80	192.168.2.7	192.185.171.24
Jul 8, 2024 12:29:25.583883047 CEST	80	49713	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:25.584022045 CEST	80	49715	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:25.584028006 CEST	80	49716	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:25.584038973 CEST	80	49712	192.185.171.24	192.168.2.7
Jul 8, 2024 12:29:25.715236902 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 8, 2024 12:29:26.871180058 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 8, 2024 12:29:28.422760010 CEST	443	49711	172.217.16.196	192.168.2.7
Jul 8, 2024 12:29:28.422842026 CEST	443	49711	172.217.16.196	192.168.2.7
Jul 8, 2024 12:29:28.422962904 CEST	49711	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:29:28.477087021 CEST	49698	443	192.168.2.7	104.98.116.138
Jul 8, 2024 12:29:28.477582932 CEST	49720	443	192.168.2.7	104.98.116.138
Jul 8, 2024 12:29:28.477615118 CEST	443	49720	104.98.116.138	192.168.2.7
Jul 8, 2024 12:29:28.477684975 CEST	49720	443	192.168.2.7	104.98.116.138
Jul 8, 2024 12:29:28.478117943 CEST	49720	443	192.168.2.7	104.98.116.138
Jul 8, 2024 12:29:28.478130102 CEST	443	49720	104.98.116.138	192.168.2.7
Jul 8, 2024 12:29:28.481897116 CEST	443	49698	104.98.116.138	192.168.2.7
Jul 8, 2024 12:29:29.551242113 CEST	49711	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:29:29.551271915 CEST	443	49711	172.217.16.196	192.168.2.7
Jul 8, 2024 12:29:29.653333902 CEST	443	49720	104.98.116.138	192.168.2.7
Jul 8, 2024 12:29:29.653362036 CEST	443	49720	104.98.116.138	192.168.2.7
Jul 8, 2024 12:29:29.653409958 CEST	49720	443	192.168.2.7	104.98.116.138
Jul 8, 2024 12:29:29.653446913 CEST	49720	443	192.168.2.7	104.98.116.138
Jul 8, 2024 12:29:35.981384993 CEST	443	49705	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:35.981465101 CEST	443	49705	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:35.981895924 CEST	49705	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:37.543770075 CEST	49705	443	192.168.2.7	213.202.235.9
Jul 8, 2024 12:29:37.543797016 CEST	443	49705	213.202.235.9	192.168.2.7
Jul 8, 2024 12:29:38.791989088 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 8, 2024 12:30:02.467185974 CEST	49710	80	192.168.2.7	151.101.130.137
Jul 8, 2024 12:30:02.475410938 CEST	80	49710	151.101.130.137	192.168.2.7
Jul 8, 2024 12:30:17.903670073 CEST	49726	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:30:17.903719902 CEST	443	49726	172.217.16.196	192.168.2.7
Jul 8, 2024 12:30:17.903958082 CEST	49726	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:30:17.904366016 CEST	49726	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:30:17.904381037 CEST	443	49726	172.217.16.196	192.168.2.7
Jul 8, 2024 12:30:19.390916109 CEST	443	49726	172.217.16.196	192.168.2.7
Jul 8, 2024 12:30:19.391259909 CEST	49726	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:30:19.391289949 CEST	443	49726	172.217.16.196	192.168.2.7
Jul 8, 2024 12:30:19.391583920 CEST	443	49726	172.217.16.196	192.168.2.7
Jul 8, 2024 12:30:19.391886950 CEST	49726	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:30:19.391946077 CEST	443	49726	172.217.16.196	192.168.2.7
Jul 8, 2024 12:30:19.557920933 CEST	49726	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:30:28.484042883 CEST	443	49726	172.217.16.196	192.168.2.7
Jul 8, 2024 12:30:28.484122992 CEST	443	49726	172.217.16.196	192.168.2.7
Jul 8, 2024 12:30:28.484348059 CEST	49726	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:30:29.546950102 CEST	49726	443	192.168.2.7	172.217.16.196
Jul 8, 2024 12:30:29.546972990 CEST	443	49726	172.217.16.196	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 8, 2024 12:29:13.100754976 CEST	53	58499	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:13.238699913 CEST	53	63539	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:14.293375015 CEST	53	58941	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:15.125983000 CEST	55307	53	192.168.2.7	1.1.1.1
Jul 8, 2024 12:29:15.126288891 CEST	61552	53	192.168.2.7	1.1.1.1
Jul 8, 2024 12:29:15.133224010 CEST	53	55307	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:15.134095907 CEST	53	61552	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:16.147476912 CEST	53559	53	192.168.2.7	1.1.1.1
Jul 8, 2024 12:29:16.147876978 CEST	64460	53	192.168.2.7	1.1.1.1
Jul 8, 2024 12:29:16.259315014 CEST	53	64460	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:16.259895086 CEST	53	53559	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:16.893033981 CEST	60398	53	192.168.2.7	1.1.1.1
Jul 8, 2024 12:29:16.893286943 CEST	54528	53	192.168.2.7	1.1.1.1
Jul 8, 2024 12:29:16.905766964 CEST	53	54528	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:16.905790091 CEST	53	60398	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:17.847199917 CEST	63746	53	192.168.2.7	1.1.1.1
Jul 8, 2024 12:29:17.847325087 CEST	58941	53	192.168.2.7	1.1.1.1
Jul 8, 2024 12:29:17.853945017 CEST	53	63746	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:17.854387999 CEST	53	58941	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:17.906162024 CEST	50680	53	192.168.2.7	1.1.1.1
Jul 8, 2024 12:29:17.906423092 CEST	53614	53	192.168.2.7	1.1.1.1
Jul 8, 2024 12:29:18.017538071 CEST	53	50680	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:18.130913019 CEST	53	53614	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:20.058250904 CEST	123	123	192.168.2.7	40.119.148.38
Jul 8, 2024 12:29:20.596189022 CEST	123	123	40.119.148.38	192.168.2.7
Jul 8, 2024 12:29:21.602339983 CEST	123	123	192.168.2.7	40.119.148.38
Jul 8, 2024 12:29:21.775648117 CEST	123	123	40.119.148.38	192.168.2.7
Jul 8, 2024 12:29:31.822607994 CEST	53	50930	1.1.1.1	192.168.2.7
Jul 8, 2024 12:29:50.634504080 CEST	53	58886	1.1.1.1	192.168.2.7
Jul 8, 2024 12:30:12.976780891 CEST	53	55665	1.1.1.1	192.168.2.7
Jul 8, 2024 12:30:13.310870886 CEST	53	57439	1.1.1.1	192.168.2.7
Jul 8, 2024 12:30:15.844163895 CEST	138	138	192.168.2.7	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 8, 2024 12:29:18.131019115 CEST	192.168.2.7	1.1.1.1	c242	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 8, 2024 12:29:15.125983000 CEST	192.168.2.7	1.1.1.1	0xa21f	Standard query (0)	m.exactag.com	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:15.126288891 CEST	192.168.2.7	1.1.1.1	0xf83e	Standard query (0)	m.exactag.com	65	IN (0x0001)	false
Jul 8, 2024 12:29:16.147476912 CEST	192.168.2.7	1.1.1.1	0xe011	Standard query (0)	ing.shalominternationalministry.com	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:16.147876978 CEST	192.168.2.7	1.1.1.1	0xce83	Standard query (0)	ing.shalominternationalministry.com	65	IN (0x0001)	false
Jul 8, 2024 12:29:16.893033981 CEST	192.168.2.7	1.1.1.1	0x977b	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:16.893286943 CEST	192.168.2.7	1.1.1.1	0x5008	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Jul 8, 2024 12:29:17.847199917 CEST	192.168.2.7	1.1.1.1	0xb371	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:17.847325087 CEST	192.168.2.7	1.1.1.1	0xabb4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 8, 2024 12:29:17.906162024 CEST	192.168.2.7	1.1.1.1	0x6a62	Standard query (0)	ing.shalominternationalministry.com	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:17.906423092 CEST	192.168.2.7	1.1.1.1	0x85ab	Standard query (0)	ing.shalominternationalministry.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 8, 2024 12:29:15.133224010 CEST	1.1.1.1	192.168.2.7	0xa21f	No error (0)	m.exactag.com	tp-emea.exactag.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 8, 2024 12:29:15.133224010 CEST	1.1.1.1	192.168.2.7	0xa21f	No error (0)	tp-emea.exactag.com		213.202.235.9	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:15.134095907 CEST	1.1.1.1	192.168.2.7	0xf83e	No error (0)	m.exactag.com	tp-emea.exactag.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 8, 2024 12:29:16.259895086 CEST	1.1.1.1	192.168.2.7	0xe011	No error (0)	ing.shalominternationalministry.com		192.185.171.24	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:16.905790091 CEST	1.1.1.1	192.168.2.7	0x977b	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:16.905790091 CEST	1.1.1.1	192.168.2.7	0x977b	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:16.905790091 CEST	1.1.1.1	192.168.2.7	0x977b	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:16.905790091 CEST	1.1.1.1	192.168.2.7	0x977b	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:17.853945017 CEST	1.1.1.1	192.168.2.7	0xb371	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:17.854387999 CEST	1.1.1.1	192.168.2.7	0xabb4	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 8, 2024 12:29:18.017538071 CEST	1.1.1.1	192.168.2.7	0x6a62	No error (0)	ing.shalominternationalministry.com		192.185.171.24	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:42.226540089 CEST	1.1.1.1	192.168.2.7	0xdf1e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:29:42.226540089 CEST	1.1.1.1	192.168.2.7	0xdf1e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:30:05.876826048 CEST	1.1.1.1	192.168.2.7	0x8f76	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:30:05.876826048 CEST	1.1.1.1	192.168.2.7	0x8f76	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:30:26.785216093 CEST	1.1.1.1	192.168.2.7	0x6ccc	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 8, 2024 12:30:26.785216093 CEST	1.1.1.1	192.168.2.7	0x6ccc	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

m.exactag.com

fs.microsoft.com

ing.shalominternationalministry.com

code.jquery.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49708	192.185.171.24	80	6412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jul 8, 2024 12:29:16.266987085 CEST	459	OUT	GET /index.xml HTTP/1.1 Host: ing.shalominternationalministry.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 8, 2024 12:29:16.782466888 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 08 Jul 2024 10:29:16 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Sat, 01 Oct 2022 13:16:54 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 4677 Keep-Alive: timeout=5, max=75 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 73 d3 c8 96 fe 0c bf e2 8c 73 67 80 aa d8 4a 26 61 76 b0 15 df 82 90 0c b9 05 24 9b 84 e5 4e 6d ed 52 6d e9 48 ea 49 ab 8f e8 6e d9 d6 4d cd fe f6 3d dd 92 5f 63 b8 70 77 0d b1 a5 7e 79 ce f3 16 ff f0 fa f2 f4 f6 f7 ab 33 28 5c a9 e0 ea c3 ab b7 17 a7 d0 eb 47 d1 c7 a3 d3 28 7a 7d fb 1a fe fe e6 f6 dd 5b 38 1c 1c c0 8d 33 32 71 51 74 f6 be 07 bd c2 b9 6a 18 45 b3 d9 6c 30 3b 1a 90 c9 a3 db eb 68 ee 51 0e fd b5 ee b1 6f c3 9d 41 ea d2 de f8 71 1c 86 cc 4b a5 ed c9 0e 80 c3 17 2f 5e b4 f7 7a fe d0 50 09 9d 9f f4 50 f7 60 f9 e4 31 50 a4 50 19 ca a4 c2 25 4a 5e 56 79 c0 98 67 3a 3a 3c e4 73 d0 7d e2 12 9d 00 7f ac 8f 9f 6b 39 3d e9 9d 92 76 a8 5d ff b6 a9 b0 07 49 fb 76 d2 73 38 77 91 1f 3e 82 a4 10 c6 a2 3b a9 5d d6 ff b5 07 d1 1a 9a 93 4e e1 f8 f8 e0 18 fa 70 f5 f2 b7 33 78 7f 79 0b e7 97 1f de bf 8e a3 76 ef f1 e3 47 fc 89 7f e8 f7 e1 65 9a c2 8d 92 29 c2 65 ed 2c f4 fb e3 76 cf 26 46 56 0e ac 49 96 02 12 4a 71 f0 c7 e7 1a 4d 33 48 a8 8c da c7 fe d1 e0 68 70 38 [TRUNCATED] Data Ascii: RmssgJ&av$NmRmHInM=_cpw~y3(\G(z}[832qQtjEl0;hQoAqK/^zPP`1PP%J^Vyg::<s}k9=v]Ivs8w>;]Np3xyvGe)e,v&FVIJqM3Hhp8(a{8jotEI.6q^>YZQH]rBis_4:Jar!c(j):{{d!5Dh4+k5yUD$wZ}YQO,5I>i6<]2XpCMe^Wh2.\|~l'\|v,sTWdG'8RFOE>8.V?\~[KJzp=4LB)YyuFMYb;Cd5[&TWRd{/_lyoY'+G;G\?zJL9*~"P,EO$}(OW<2X!SSQrxOx"#DJMAP!3-uH26?<gR;1<]9G$Vp0sBQ=f%afQmB<q
Jul 8, 2024 12:29:16.782502890 CEST	1236	IN	Data Raw: 7f 4d 5a 71 d4 a1 ce ba 30 26 a4 d2 ef d3 56 1c ef 82 80 96 ab 6b 14 93 95 8e 49 26 3b f9 fa 41 83 05 ea 7d 2a 6d a5 44 33 d4 a4 71 b1 99 49 63 79 2b 21 45 66 c8 7d ce 7e f9 e5 e0 60 b1 69 91 ef a6 ab dd a3 c9 f3 17 2f 7e 5d ec ba 42 9a b5 cd c3 Data Ascii: MZq0&VkI&;A}mD3qIcy+!Ef}~`i/~]B&/VCS{.7T81),)VRCx{k_hT!dnD3bxixqTHr2=-c/7UtoGc-'9_e$'(e66FANz=
Jul 8, 2024 12:29:16.782519102 CEST	1236	IN	Data Raw: 7e 09 ee a4 f7 b1 12 1a ac 6b 14 fa ee 29 32 c3 bd f3 f3 03 fe 8c 7a e3 85 c9 7f 5f 9a cc 0f 7c 7e cc 8d 47 d3 16 aa a5 c0 11 77 9c 06 70 2d f3 c2 71 9d 65 72 e7 67 b7 4d f9 97 a6 78 33 93 82 c8 22 5c 19 aa d0 38 89 76 00 b7 8c 58 2d df 59 8d 52 Data Ascii: ~k)2z_\|~Gwp-qergMx3"\8vX-YRv?^_Q(%Bjp:}P[_0uBTg0+\|~@('H{3jsrTMsMDk={j-o\|m4aG+.<W6CYkGm
Jul 8, 2024 12:29:16.782718897 CEST	1236	IN	Data Raw: 58 2c 9a 8f f3 8a 85 a1 e9 41 61 30 3b d9 1b bf a1 99 57 c0 35 96 59 d3 32 19 14 ae c5 80 4c 2a 8c 23 31 8e 23 06 59 f2 f0 d3 3a 38 d6 e1 50 bb de 46 46 b7 2c 79 13 c3 eb 75 2c de 42 97 c2 94 0d 7e ca ef ce d4 fc 46 da 3e 63 a3 84 03 87 6c 70 70 Data Ascii: X,Aa0;W5Y2L#1#Y:8PFF,yu,B~F>clpp)Zv^U6A-63YZ2Zsc]1Z [SiXCY^WQCbK~+n:)@UP7RpWO~b!/r@l-El
Jul 8, 2024 12:29:16.782728910 CEST	55	IN	Data Raw: f3 8a 9b 85 e6 c9 b3 81 95 de e4 76 e1 e9 b3 d1 c6 51 4e d1 b9 e6 ca 48 ed d6 b7 fe ec 9e d9 f5 30 98 c9 c5 d1 84 d2 26 3c 14 ae 64 4b ff 17 cc cb 70 7c 28 2e 00 00 Data Ascii: vQNH0&<dKp\|(.
Jul 8, 2024 12:29:16.898114920 CEST	382	OUT	GET /cgi-sys/js/simple-expand.min.js HTTP/1.1 Host: ing.shalominternationalministry.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ing.shalominternationalministry.com/index.xml Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 8, 2024 12:29:17.024084091 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 10:29:16 GMT Server: Apache Last-Modified: Sat, 01 Oct 2022 13:14:07 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1191 Keep-Alive: timeout=5, max=74 Connection: Keep-Alive Content-Type: application/javascript Data Raw: 1f 8b 08 00 00 00 00 00 00 03 95 52 4d 6f db 38 10 bd f7 57 d0 82 61 88 85 22 3b 05 f6 22 43 c8 c1 ed 62 b3 6d 92 2e 92 3d 15 3d 30 d2 d8 62 43 93 5e 72 6c 27 70 fc df 77 48 4a b6 e2 a6 dd 2e 7c b0 38 9f 6f de 7b e3 b7 6c 66 56 4f 56 2e 1a 64 e9 8c b3 77 93 f3 77 ec f6 49 6d 84 d4 ec 0f b1 04 f5 e6 b3 35 df a0 c2 82 35 88 2b 57 8c c7 0b 89 cd fa 3e af cc 72 6c a1 6e 0c 3a f5 34 76 72 b9 52 70 06 8f 2b a1 eb 37 57 97 77 ec 93 ac 40 57 70 ec b3 62 9b ff 77 ef 78 29 1c 82 1d ab d8 7e b6 94 98 e3 23 b2 b7 e3 37 e9 7c ad 2b 94 46 a7 43 be 4b d6 0e 98 43 2b 2b 4c a6 5d 82 41 ca 77 1b 61 19 94 d8 48 37 85 bc 86 b9 58 2b 74 e5 ae 91 35 5c 99 1a 8a 64 2e 6a b8 33 8b 85 82 24 6b f3 b7 20 6c d5 c4 f4 4a 58 d0 78 48 dd 09 bb 00 2c 12 02 ad 31 24 b0 b1 66 7b a3 af a4 73 52 2f da fc 60 92 3d 00 ac 6e 51 20 5c ea 99 31 0f 12 8a c1 79 56 85 af 6b a2 b2 48 5e 1c 9a ec 33 c8 1d 20 d2 0c 82 b7 cf 86 39 3c d2 82 3a 3d 86 b3 e3 01 9c be e7 52 d7 9f 60 03 ea 46 c3 7b 5a 56 1e 08 81 0c 33 cd 77 16 70 6d 89 85 50 99 22 a7 [TRUNCATED] Data Ascii: RMo8Wa";"Cbm.==0bC^rl'pwHJ.\|8o{lfVOV.dwwIm55+W>rln:4vrRp+7Ww@Wpbwx)~#7\|+FCKC++L]AwaH7X+t5\d.j3$k lJXxH,1$f{sR/`=nQ \1yVkH^3 9<:=R`F{ZV3wpmP"EdJx[T4E\^`-K-Q:<C6NEYp.MX9n{M5iH^Wo{ He_e'}WXTTOmy~+{y;wvy#[y3e56}i}7_,24X;8O{;FLHxZg$}w4P2'<O="]b.K2bo8&,gb/b2lS~-us@CKq9J%vVl$[lT_}Os$IGLC#k2e25BWz?hNV>.Jy1J^z}(DF:x&Ftd+AN-*X9KC/IN{8AE\|75Be9L-rErnB6P7iJXUlW0%LF
Jul 8, 2024 12:29:17.024149895 CEST	257	IN	Data Raw: d0 ca a7 db 46 92 72 2f 4b 5c fb 1a d0 8b ef 5b a2 a5 67 40 d0 cd 1b 92 e7 c4 70 c3 1c 1e 11 74 dd 93 9c c2 54 5f 35 50 3d 7c 24 2c 41 d4 4b 3d 0b b6 ff 6c a1 32 ba 96 7e 80 4b 79 86 39 88 aa 49 0f 33 e3 89 48 b4 61 23 1d cf 34 1d 2b 10 6d 9a d4 Data Ascii: Fr/K\[g@ptT_5P=\|$,AK=l2~Ky9I3Ha#4+mY+=E{a.Nia!uy4R;`cF_I{y&N.WZ8k2mZe3/5%T HO[d<\|oao0<XzFtadH0<=O
Jul 8, 2024 12:29:17.884733915 CEST	437	OUT	GET /cgi-sys/images/404mid.gif HTTP/1.1 Host: ing.shalominternationalministry.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ing.shalominternationalministry.com/index.xml Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 8, 2024 12:29:18.010121107 CEST	361	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 10:29:17 GMT Server: Apache Last-Modified: Sat, 01 Oct 2022 13:15:14 GMT Accept-Ranges: bytes Content-Length: 120 Keep-Alive: timeout=5, max=73 Connection: Keep-Alive Content-Type: image/gif Data Raw: 47 49 46 38 39 61 64 03 04 00 91 00 00 9a b2 c9 ff ff ff a0 b6 cc a1 b7 cd 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 04 00 00 02 49 dc 82 a9 cb ed 0f a3 9c b4 da 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a6 ea ca b6 ee 9b 00 80 01 d7 f6 8d e7 fa ce f7 fe 0f 0c 0a 87 44 8a 8c 56 4c 2a 97 cc a6 f3 09 8d 4a a7 54 cc f1 50 cd 6a b7 dc ae f7 0b 0e 8b 2d b2 02 00 3b Data Ascii: GIF89ad!,dIHDVL*JTPj-;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49709	192.185.171.24	80	6412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jul 8, 2024 12:29:16.914606094 CEST	432	OUT	GET /cgi-sys/images/x.png HTTP/1.1 Host: ing.shalominternationalministry.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ing.shalominternationalministry.com/index.xml Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 8, 2024 12:29:17.414871931 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 10:29:17 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Sat, 01 Oct 2022 13:14:06 GMT Accept-Ranges: bytes Content-Length: 2672 Keep-Alive: timeout=5, max=75 Content-Type: image/png Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 61 00 00 00 61 08 03 00 00 00 f1 d8 3f 91 00 00 00 03 73 42 49 54 08 08 08 db e1 4f e0 00 00 00 60 50 4c 54 45 66 00 00 e7 cf cf 8a 5e 5e 86 37 37 cc 00 00 7a 7a 7c bb 02 02 f9 75 75 e7 2d 26 ef 7b 57 a7 01 01 ff ff ff d9 8f 8f d4 41 2d c6 20 17 cd 33 26 e6 69 48 e8 52 42 fd b4 b2 99 00 00 e1 5c 40 bd 8f 8f bc 2f 2f f4 ef ef dc bf bf e3 15 15 db 00 00 f6 8e 60 9f a1 a3 fe 99 74 c5 5f 5f bd 13 10 33 6a 26 19 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 16 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 30 33 2f 30 34 2f 30 39 d9 8b d2 0e 00 00 00 1c 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 46 69 72 65 77 6f 72 6b 73 20 43 53 34 06 b2 d3 a0 00 00 09 5d 49 44 41 54 68 81 ad 9a 8d 7a ab ac 12 85 31 a1 48 ac c1 2a 89 88 6d e5 fe ef f2 5b 03 a2 88 9a 74 9f e7 8c c6 36 0a f3 ba 06 18 fc 09 fb fc ab 15 5d 5d d6 53 db b7 53 59 97 43 f7 e7 7a ec 4f ce eb a9 11 9c 16 2e 96 a5 ff aa 8b ff 0f a1 9b 14 e7 1c [TRUNCATED] Data Ascii: PNGIHDRaa?sBITO`PLTEf^^77zz\|uu-&{WA- 3&iHRB\@//`t__3j&pHYs~tEXtCreation Time03/04/09tEXtSoftwareAdobe Fireworks CS4]IDAThz1Hm[t6]]SSYCzO.g^tfe:0[^B19m95(pZ1E}ZQRwC;ZHj8stB0t_4MD{cU:w&qf+F.b7HPusD?nSHsuK!R;DNBA_K,]/(o}~vGke~66+#6SWNw9&}mjkW0E{8!2NTAU/kUuD_w[]%@cm(UUL_%XWU3[Tm JT9@OfbC\|Ukk/R8H>pVReEs$=@xA?$=T<`jo4Bb]hMp<z:@HyN"0TX714k$VTx^s}1/7`s+6W!!zRVIN}7}X-2T6)V
Jul 8, 2024 12:29:17.414942026 CEST	1236	IN	Data Raw: ae f4 e9 f5 8f 07 88 0d 60 36 2b ed a3 59 be c9 36 74 27 22 d4 55 2f d7 23 3e 46 fa c5 38 30 cf aa 1a c7 26 f7 2f 01 48 dd dc 65 e3 47 13 0b 41 92 f7 26 01 8c da bd 88 51 5d 69 00 72 42 63 a5 d8 20 1a 29 7d 67 01 c1 68 67 9b fb bc 34 77 f5 26 46 Data Ascii: `6+Y6t'"U/#>F80&/HeGA&Q]irBc )}ghg4w&FT8ZNO8W>{Bk@QS73x+'Ou)`3J1pD(T,\|y Q *@-YG7Jr)&8GC0Uy
Jul 8, 2024 12:29:17.414947987 CEST	468	IN	Data Raw: 65 db de 91 6a d9 f5 f2 5c db 62 78 5e ae e4 1f de 71 7c 5b c7 03 12 d1 e9 93 f5 4b 50 41 15 e2 c7 23 e0 a4 67 c1 2e 57 58 f8 57 f7 e1 90 8d 45 43 9d 11 43 9b a5 57 cc 9b b7 03 17 a6 bc 0a bf c6 4d 60 94 ed bd d7 2c 9a eb db 79 6f 5e 7c dc 65 e0 Data Ascii: ej\bx^q\|[KPA#g.WXWECCWM`,yo^\|e\ ,T-,oetLX\m-\1h9R{ d?!8_N]xo{zSS}7y8o-?@Y~cwLUTxg]4gf'
Jul 8, 2024 12:29:17.882213116 CEST	439	OUT	GET /cgi-sys/images/404top_w.jpg HTTP/1.1 Host: ing.shalominternationalministry.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ing.shalominternationalministry.com/index.xml Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 8, 2024 12:29:18.011799097 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 10:29:17 GMT Server: Apache Last-Modified: Sun, 02 Oct 2022 08:41:17 GMT Accept-Ranges: bytes Content-Length: 4335 Keep-Alive: timeout=5, max=74 Connection: Keep-Alive Content-Type: image/jpeg Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 a9 03 64 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 01 01 00 02 03 01 00 00 00 00 00 00 00 00 00 00 00 01 02 04 03 07 08 05 ff c4 00 3a 10 01 00 01 03 00 07 04 07 07 04 02 03 00 00 00 00 00 01 03 07 11 02 04 06 16 17 81 c2 12 21 94 d2 31 36 46 51 74 84 91 05 13 14 61 71 b2 c3 41 56 b1 c1 26 b3 a1 d3 f0 ff c4 00 19 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 05 06 03 04 ff c4 00 27 11 01 00 03 01 00 02 02 01 03 05 01 01 00 00 00 00 00 04 15 52 01 91 a1 02 b1 05 03 11 51 12 21 31 33 d1 13 14 ff da 00 0c [TRUNCATED] Data Ascii: JFIFHHC!"$"$Cd:!16FQtaqAV&'RQ!13?X
Jul 8, 2024 12:29:18.011817932 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 8, 2024 12:29:18.011826038 CEST	1236	IN	Data Raw: fb 0a c8 b8 2c 24 68 e3 2d ca c6 37 a2 b6 3e 1a 8e 7e bd 82 b6 36 39 e7 a5 84 8d 1c 65 b9 7d 9e ed a8 ab 8f cf 56 a3 3d 05 64 5c 16 12 34 45 e5 b9 71 18 de 8a dc f5 6a 13 d0 56 45 c1 61 23 49 17 96 e5 e8 fb 51 5b 9e ad 42 7a 4a d8 d8 e7 9e 96 12 Data Ascii: ,$h-7>~69e}V=d\4EqjVEa#IQ[BzJ47Fq+cczXHg;[?GN[F2z+~+cczXHkE_CV4qj#,$hrjellsK&\,$ixrWC?_+bK8s1<
Jul 8, 2024 12:29:18.011960983 CEST	870	IN	Data Raw: c6 cb 97 9c ce d1 e6 3e 0e 8c 74 15 71 71 f6 58 48 d2 cd ec b9 79 ef da 3c fe 51 a9 d0 8e 82 ae 36 3e cb 09 1f ca 4d ec b9 73 3e b1 f2 8d 4e 8c 74 15 71 71 f6 58 48 d2 cd ec b9 7f dc 58 f9 4a 1e 42 ae 2e 3e cb 09 1a 38 d9 72 fd 1b c7 11 f2 94 3c Data Ascii: >tqqXHy<Q6>Ms>NtqqXHXJB.>8r<\\}4lx<~!We/.^;'Bz,$'.\G]RqqXHq_]NF.',!Wely,$heghF:,$if\(GAWe&\XFF:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49710	151.101.130.137	80	6412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jul 8, 2024 12:29:16.921425104 CEST	341	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ing.shalominternationalministry.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 8, 2024 12:29:17.375401020 CEST	1236	IN	HTTP/1.1 200 OK Connection: keep-alive Content-Length: 30288 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: W/"28feccc0-1538f" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Content-Encoding: gzip Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Mon, 08 Jul 2024 10:29:17 GMT Age: 3412506 X-Served-By: cache-lga13622-LGA, cache-nyc-kteb1890028-NYC X-Cache: HIT, HIT X-Cache-Hits: 13, 16885 X-Timer: S1720434557.329466,VS0,VE0 Vary: Accept-Encoding Data Raw: 1f 8b 08 00 00 00 00 00 02 03 bc bd 79 7b db 46 b2 2f fc ff fb 29 44 8c 8f 02 98 2d 4a 72 26 b9 77 40 b5 f9 38 5e 12 67 73 26 76 b6 43 31 79 20 b2 49 21 a6 00 06 00 b5 44 e4 7c f6 5b bf ea 05 0d 10 94 33 73 ee 7d 33 63 11 4b a3 d7 ea ea da eb f8 71 ef e0 f7 7f ae 55 71 77 70 fd f1 e0 e3 c1 e9 c1 e6 20 9c 46 07 5f be 3d 78 95 af b3 59 52 a5 79 76 90 64 b3 83 bc ba 54 c5 c1 34 cf aa 22 bd 58 57 79 51 52 d1 df ff c0 a7 83 bc 58 1c 2f d3 a9 ca 4a 75 f0 f8 f8 ff eb cd d7 d9 14 1f 86 4a 54 d1 7d b0 a6 c7 25 7d 36 ad 82 61 90 5f fc ae e8 42 ca ea 6e a5 f2 f9 c1 55 3e 5b 2f d5 e1 e1 9e 17 03 75 bb ca 8b aa 1c 35 6f a5 1a cc f2 e9 fa 4a 65 d5 a8 a2 66 7a 27 51 5c b7 1a dd a7 f3 b0 57 17 89 aa cb 22 bf 39 c8 d4 cd c1 cb a2 c8 8b 30 30 63 2e d4 1f eb b4 50 e5 41 72 70 93 66 33 2a 73 93 56 97 74 67 bf 0c a2 61 a1 aa 75 91 1d 50 2b d1 36 e6 bf 61 40 33 a3 e6 69 a6 66 41 cf 76 57 7f 3f d2 3f 71 75 99 96 e2 81 69 b8 4e 8a 83 4c 8e 27 a2 f0 46 22 52 f9 86 27 61 b0 50 d5 77 45 5e e5 a8 fb cd 5c e4 32 1b 94 98 60 91 [TRUNCATED] Data Ascii: y{F/)D-Jr&w@8^gs&vC1y I!D\|[3s}3cKqUqwp F_=xYRyvdT4"XWyQRX/JuJT}%}6a_BnU>[/u5oJefz'Q\W"900c.PArpf3sVtgauP+6a@3ifAvW??quiNL'F"R'aPwE^\2`4DIuy)tA[[1AeR;LduDi;B>WWdL [/TT@V\{NDYLv,<4?a%B%zT0(E@JVRws lN~$a5TlV=L0u_+fzu(~;6TxCEb>-{!MM
Jul 8, 2024 12:29:17.375417948 CEST	826	IN	Data Raw: 37 5b f1 4e 1e ff 3a 3e 2f cf d7 af 5e be 7a 75 7e fb ec 64 d2 df b4 ee 1f 1d 2f 86 f8 4c de 0c 56 16 f6 e4 bd de e1 b1 6d 92 60 8f 40 78 3d a5 fd 1f df 88 a5 ca 16 d5 65 7c 22 aa fc 59 51 24 77 f5 16 74 9d c9 f5 78 b0 1f a8 1b 04 d7 8d 6d da 9a Data Ascii: 7[N:>/^zu~d/LVm`@x=e\|"YQ$wtxm,pNF>~IMJUb**x#-MU%j+T2oBb+UW1n,~$pMqeF,2,SD>V9syN#UO2y)Qt"}yzR
Jul 8, 2024 12:29:17.375430107 CEST	1236	IN	Data Raw: ef 4f 64 45 73 e8 26 cf 94 91 a9 a0 79 5c d0 f4 ec f4 ca 36 40 68 11 f4 69 4e 75 27 ae 6e 42 50 bd 6c 98 9f 25 c3 9c 1a 20 0c d3 a3 69 19 e7 54 2c 8a 08 e8 cb c3 c3 94 71 3f 3f 74 1b 3b 6d 9f 96 35 ed c6 c8 97 9a 28 a9 2d 07 55 0c 16 f5 78 f2 b3 Data Ascii: OdEs&y\6@hiNu'nBPl% iT,q??t;m5(-Ux3/M>m4:2D:\j;wW<AZ"R(>L7hB%#Z^{Z]1i8(xMYBU?DyR*:C~^1=
Jul 8, 2024 12:29:17.375538111 CEST	1236	IN	Data Raw: d1 83 20 d6 c5 b7 a2 50 3e 3f bc 02 63 9d 2a 79 a5 c2 5d ca ba 87 33 9d 4e 56 73 88 e0 c4 a7 a3 ec 8a 49 04 3a e9 97 c9 85 5a 06 fa 4c 17 f7 b3 b4 88 83 5a 5a 16 d0 c8 08 90 89 aa 58 10 63 17 10 e5 51 15 77 f7 5f 1b 92 eb 99 fc 42 d3 bc 37 03 de Data Ascii: P>?cy]3NVsI:ZLZZXcQw_B7=VTIEdkyLQsJ0aZh(PG!MKJlB\1$%HyL/jB2 (yCNL!n4ThuZ_t&
Jul 8, 2024 12:29:17.375545025 CEST	1236	IN	Data Raw: 09 7b 3b a7 70 97 54 02 c6 db 12 93 44 4d 64 b3 66 03 38 b0 40 88 75 6c d9 36 31 4c 54 4f 8d cd 5b c4 6d dd a5 6c 34 ce a0 15 dd 6e a3 f8 7f 3e 28 dd dc 5e 84 e2 c6 a9 71 fb ee 33 3d 7e d7 37 10 c5 d7 c9 72 ad fe 6f cf 88 16 f2 76 ce 0b f8 0d ae Data Ascii: {;pTDMdf8@ul61LTO[ml4n>(^q3=~7rov\|O#ca*"0Y\0D/w>vhr/1~RVV,'oT5 S@aoehK^X(W605?_Dc5~?Q[{Ymfh,GBj
Jul 8, 2024 12:29:17.375557899 CEST	400	IN	Data Raw: b5 36 17 24 0c 5e 84 2f 22 31 b7 5c 17 f1 fc e3 1c 5c 17 9f 31 c4 7d b2 cc cb b0 5c 79 14 79 b2 76 65 ac 9f 59 ec 28 08 45 5a 14 c4 42 7c 58 fc a5 90 e1 d1 e4 bf 83 23 44 87 e1 95 0c 02 c6 95 b9 77 54 d7 dc 38 f8 be 7c b3 f9 87 fe 39 e5 5b cd ab Data Ascii: 6$^/"1\\1}\yyveY(EZB\|X#DwT8\|9[B1d#7if`I/l7#X-\=osU-:"YL)=NwZT1R,PKvA}==Nui_mbQ\|2]2DOS
Jul 8, 2024 12:29:17.375890017 CEST	1236	IN	Data Raw: 78 4c 74 e9 cf ba 38 74 38 04 c2 49 98 c1 b5 4d df 38 2f af 90 b8 6d a7 8e 38 aa a2 23 7b 1d f1 c2 9c a0 de 93 7a 0e 2b 8c 98 1a cb bc 27 fe 6a 7d 4c c4 2e c0 59 03 10 4c b1 3e 28 77 ec 54 48 19 71 d1 68 c7 ab a3 d7 90 43 79 62 57 ab 5c 00 0e ec Data Ascii: xLt8t8IM8/m8#{z+'j}L.YL>(wTHqhCybW\uKAw'DWWgGEl0/HrK-h5" q!sg -a:>z@f-1J{\|%O-qNS"TAR
Jul 8, 2024 12:29:17.375895977 CEST	224	IN	Data Raw: cc fa f2 49 a4 da 66 09 8a be 27 46 ff a1 cf 4f 3f f0 f9 b2 ea ea a8 f3 99 95 ae af c3 a3 23 50 30 43 5b 4d d1 a8 66 f1 97 ab e9 f7 0b ea 50 67 2d 84 16 1d 7c 13 7f 23 3d 68 ff c3 79 7e df 17 c9 2c cd e1 0b cf 7b ff 22 bf c5 35 31 fb 1c 64 65 45 Data Ascii: If'FO?#P0C[MfPg-\|#=hy~,{"51deE<M^p^%TU5sgU(Q@W5tANy1ESYAN1~L} $*[aS'`m"yh,Q#}(#@;$hpMR
Jul 8, 2024 12:29:17.375909090 CEST	1236	IN	Data Raw: b0 06 44 d4 04 aa e1 37 57 03 f6 17 b1 d4 c6 18 5c e4 ba f8 bd 11 6f 0b 8e 77 c3 95 7a 04 d8 01 1b 28 d4 8d 3a 9e 5a af 44 02 07 5a 3b 8d 11 3a fc 23 91 85 5e 9f 97 74 ab 47 82 ab 30 e5 71 7c b0 17 89 30 ba 17 a2 1f f7 b4 0e d5 58 66 5c f8 dd 0c Data Ascii: D7W\owz(:ZDZ;:#^tG0q\|0Xf\[2(~OK{{?{:U}byQH5`P j=O1y514ji-e+O81Z*Rmt4BgicEDYl[UMMG
Jul 8, 2024 12:29:17.375916004 CEST	1236	IN	Data Raw: e5 ca 35 83 53 88 0f 3d a8 c4 68 98 a7 2c 87 32 88 9e b1 d0 5a ce 40 76 cd 3c e5 af f3 dd 7d fa 84 28 e0 d7 2f 80 07 08 b2 d7 d0 46 1b ee ff 1f 2d df ca 05 36 90 c3 42 6b 56 d4 33 16 d2 1e df 95 0c 9d 0b 48 b8 b4 38 cd e7 5f b4 7c b4 8a ac b2 22 Data Ascii: 5S=h,2Z@v<}(/F-6BkV3H8_\|"X-{};m.Q1O1vZ&FCH1Q=dK=sr+}.w{m\FG:[BGn#@T"gEu0"8Zaj;D5Th
Jul 8, 2024 12:29:17.380479097 CEST	1236	IN	Data Raw: 4b e5 c7 8b 6f 06 83 36 58 d4 e2 54 e8 c1 60 5a b9 83 50 35 ad c1 bb d0 ed 7e 86 21 27 41 af f1 21 42 16 43 b8 0b c2 61 d8 f2 84 e2 00 5a ce 22 e0 14 b2 d1 64 94 68 1b 13 63 42 da 76 50 df 73 fc 70 84 e6 e8 3e 77 8a de a6 5e ab 1d 70 df 29 1b 1a Data Ascii: Ko6XT`ZP5~!'A!BCaZ"dhcBvPsp>w^p)hB6;-&F\|P`#E;E#^pRD2lwGl+F@XAvRzq+~dtWi5&}A-._>N4^Gf?wM_r?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49712	192.185.171.24	80	6412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jul 8, 2024 12:29:17.891387939 CEST	440	OUT	GET /cgi-sys/images/404bottom.gif HTTP/1.1 Host: ing.shalominternationalministry.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ing.shalominternationalministry.com/index.xml Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 8, 2024 12:29:18.397700071 CEST	804	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 10:29:18 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Sat, 01 Oct 2022 13:14:37 GMT Accept-Ranges: bytes Content-Length: 537 Keep-Alive: timeout=5, max=75 Content-Type: image/gif Data Raw: 47 49 46 38 39 61 64 03 0e 00 d5 00 00 36 65 94 f7 f9 fb ad c0 d4 9d b4 cb cd d9 e4 7c 9b b9 a2 b8 ce 6d 8f b1 e6 ec f2 5c 82 a9 8c a7 c2 bd cd dc 4e 77 a1 f2 f5 f8 b0 c3 d5 85 a2 be dc e4 ec 93 ad c6 ff ff ff 58 7f a6 73 94 b5 a7 bc d0 c5 d2 e0 64 89 ad 81 9e bc d1 dc e7 ea ef f4 f6 f8 fa b3 c5 d7 7b 94 b5 7e 9d bb 8c ad c5 6b 94 b5 8c a5 bd 63 87 ac 59 80 a7 d4 de e8 ed f1 f5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 0e 00 00 06 ff 40 83 41 42 2c 1a 8f c8 a4 72 c9 6c 3a 9f d0 a8 74 4a ad 5a af d8 ac 76 cb ed 7a bf e0 b0 78 4c 2e 9b cf e8 b4 7a 5d 54 08 87 ec b8 7c 4e af db ef f8 bc 7e cf ef fb ff 80 4f 6e 42 81 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 55 6e 15 03 91 96 97 98 99 9a 9b 9c 9d 9e 9f 53 1e 0e 0e 11 a0 a6 a7 a8 a9 aa ab ac ad 9e a2 16 18 ae b3 b4 b5 b6 b7 b8 [TRUNCATED] Data Ascii: GIF89ad6e\|m\NwXsd{~kcY!,d@AB,rl:tJZvzxL.z]T\|N~OnBUnSfDfD#pEH2@# CI(S\0cI8s6*d(phDC8ZXj`KS9X Q"I;
Jul 8, 2024 12:29:18.583923101 CEST	423	OUT	GET /favicon.ico HTTP/1.1 Host: ing.shalominternationalministry.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ing.shalominternationalministry.com/index.xml Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 8, 2024 12:29:18.711273909 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 08 Jul 2024 10:29:18 GMT Server: Apache Last-Modified: Sat, 01 Oct 2022 13:16:54 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 4677 Keep-Alive: timeout=5, max=74 Connection: Keep-Alive Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 73 d3 c8 96 fe 0c bf e2 8c 73 67 80 aa d8 4a 26 61 76 b0 15 df 82 90 0c b9 05 24 9b 84 e5 4e 6d ed 52 6d e9 48 ea 49 ab 8f e8 6e d9 d6 4d cd fe f6 3d dd 92 5f 63 b8 70 77 0d b1 a5 7e 79 ce f3 16 ff f0 fa f2 f4 f6 f7 ab 33 28 5c a9 e0 ea c3 ab b7 17 a7 d0 eb 47 d1 c7 a3 d3 28 7a 7d fb 1a fe fe e6 f6 dd 5b 38 1c 1c c0 8d 33 32 71 51 74 f6 be 07 bd c2 b9 6a 18 45 b3 d9 6c 30 3b 1a 90 c9 a3 db eb 68 ee 51 0e fd b5 ee b1 6f c3 9d 41 ea d2 de f8 71 1c 86 cc 4b a5 ed c9 0e 80 c3 17 2f 5e b4 f7 7a fe d0 50 09 9d 9f f4 50 f7 60 f9 e4 31 50 a4 50 19 ca a4 c2 25 4a 5e 56 79 c0 98 67 3a 3a 3c e4 73 d0 7d e2 12 9d 00 7f ac 8f 9f 6b 39 3d e9 9d 92 76 a8 5d ff b6 a9 b0 07 49 fb 76 d2 73 38 77 91 1f 3e 82 a4 10 c6 a2 3b a9 5d d6 ff b5 07 d1 1a 9a 93 4e e1 f8 f8 e0 18 fa 70 f5 f2 b7 33 78 7f 79 0b e7 97 1f de bf 8e a3 76 ef f1 e3 47 fc 89 7f e8 f7 e1 65 9a c2 8d 92 29 c2 65 ed 2c f4 fb e3 76 cf 26 46 56 0e ac 49 96 02 12 4a 71 f0 c7 e7 1a 4d 33 48 a8 8c da c7 fe d1 e0 68 70 38 [TRUNCATED] Data Ascii: RmssgJ&av$NmRmHInM=_cpw~y3(\G(z}[832qQtjEl0;hQoAqK/^zPP`1PP%J^Vyg::<s}k9=v]Ivs8w>;]Np3xyvGe)e,v&FVIJqM3Hhp8(a{8jotEI.6q^>YZQH]rBis_4:Jar!c(j):{{d!5Dh4+k5yUD$wZ}YQO,5I>i6<]2XpCMe^Wh2.\|~l'\|v,sTWdG'8RFOE>8.V?\~[KJzp=4LB)YyuFMYb;Cd5[&TWRd{/_lyoY'+G;G\?zJL9*~"P,EO$}(OW<2X!SSQrxOx"#DJMAP!3-uH26?<gR;1<]9G$Vp0sBQ=f%afQmB<qMZq0&Vk
Jul 8, 2024 12:29:18.711327076 CEST	224	IN	Data Raw: 49 26 3b f9 fa 41 83 05 ea 7d 2a 6d a5 44 33 d4 a4 71 b1 99 49 63 79 2b 21 45 66 c8 7d ce 7e f9 e5 e0 60 b1 69 91 ef a6 ab dd a3 c9 f3 17 2f 7e 5d ec ba 42 9a b5 cd c3 17 bf 26 87 2f 56 43 53 84 7b 98 88 e4 2e 37 54 eb b4 bf 38 87 cf fd bf 11 0b Data Ascii: I&;A}mD3qIcy+!Ef}~`i/~]B&/VCS{.7T81),)VRCx{k_hT!dnD3bxixqTHr2=-c/7UtoGc-'9_e$'(e66FANz=8
Jul 8, 2024 12:29:18.711339951 CEST	1236	IN	Data Raw: a4 e5 36 1a 43 c6 47 d8 1b 9f 5d 5f 5f 5e 83 af 67 1f ae 5e fe 76 06 ef 2f 6f e1 fc f2 c3 fb d7 5b d8 5b 10 99 f8 fc 69 dd 8b 47 fe b3 da 5e 36 7c b9 f5 68 b9 37 2b 9a c5 2a df 28 8e c6 b1 80 44 09 6b 99 d8 bc 12 9a 33 ee 41 61 30 3b d9 1b 7f 2c Data Ascii: 6CG]__^g^v/o[[iG^6\|h7+*(Dk3Aa0;,%\Errk;Y,Qh0TA3SdR$RLWwA7-JR40im%d@:,5Hea2<DAUq\/Y+'<Tm^cx)<7$`%
Jul 8, 2024 12:29:18.711354017 CEST	1236	IN	Data Raw: fc 54 b8 52 6d cf d9 8e e4 3d 39 99 74 f1 b5 4d 6a 3d 3b 15 37 b8 34 d0 d7 4f 96 15 19 27 b4 f3 03 d6 79 0c e0 92 27 2a e1 32 32 a5 6d 91 90 3d 33 0c 9b 08 8b 7d 8b da 4a 27 a7 d2 35 4b f8 a0 73 81 ee bd 5d 6c 54 3a 5f db 30 18 1a e1 89 59 df 32 Data Ascii: TRm=9tMj=;74O'y'*22m=3}J'5Ks]lT:_0Y26F8InG.6_dzUZq4"s5R4=(f'{c83C\|$^J}gHplI[j[/G56#Bq$pN5-N60047a[a9ya4B0(
Jul 8, 2024 12:29:18.711365938 CEST	1041	IN	Data Raw: b5 db 67 c9 06 a6 de f8 da b2 59 c2 7a 4b 6f 0b 46 b7 18 66 b3 4b 6c 96 5d 04 b7 44 0d 58 3e bf 2b a1 91 35 4f 6a 07 9a 1c cc 3c 97 75 1e 13 2e 4b 21 74 8e e9 e0 e9 ef 5b 1c b9 45 b6 56 0e 88 11 0d 87 e3 64 a2 70 11 9c e5 bc 93 10 8a 69 15 4a cd Data Ascii: gYzKoFfKl]DX>+5Oj<u.K!t[EVdpiJ<8)3~(9szG\|o(X\v#S3fuHpi"S)f.Tr#'eR7as UT[7-6-Y-BE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49713	192.185.171.24	80	6412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jul 8, 2024 12:29:18.056509972 CEST	308	OUT	GET /cgi-sys/images/x.png HTTP/1.1 Host: ing.shalominternationalministry.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 8, 2024 12:29:18.571089029 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 10:29:18 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Sat, 01 Oct 2022 13:14:06 GMT Accept-Ranges: bytes Content-Length: 2672 Keep-Alive: timeout=5, max=75 Content-Type: image/png Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 61 00 00 00 61 08 03 00 00 00 f1 d8 3f 91 00 00 00 03 73 42 49 54 08 08 08 db e1 4f e0 00 00 00 60 50 4c 54 45 66 00 00 e7 cf cf 8a 5e 5e 86 37 37 cc 00 00 7a 7a 7c bb 02 02 f9 75 75 e7 2d 26 ef 7b 57 a7 01 01 ff ff ff d9 8f 8f d4 41 2d c6 20 17 cd 33 26 e6 69 48 e8 52 42 fd b4 b2 99 00 00 e1 5c 40 bd 8f 8f bc 2f 2f f4 ef ef dc bf bf e3 15 15 db 00 00 f6 8e 60 9f a1 a3 fe 99 74 c5 5f 5f bd 13 10 33 6a 26 19 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 16 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 30 33 2f 30 34 2f 30 39 d9 8b d2 0e 00 00 00 1c 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 46 69 72 65 77 6f 72 6b 73 20 43 53 34 06 b2 d3 a0 00 00 09 5d 49 44 41 54 68 81 ad 9a 8d 7a ab ac 12 85 31 a1 48 ac c1 2a 89 88 6d e5 fe ef f2 5b 03 a2 88 9a 74 9f e7 8c c6 36 0a f3 ba 06 18 fc 09 fb fc ab 15 5d 5d d6 53 db b7 53 59 97 43 f7 e7 7a ec 4f ce eb a9 11 9c 16 2e 96 a5 ff aa 8b ff 0f a1 9b 14 e7 1c [TRUNCATED] Data Ascii: PNGIHDRaa?sBITO`PLTEf^^77zz\|uu-&{WA- 3&iHRB\@//`t__3j&pHYs~tEXtCreation Time03/04/09tEXtSoftwareAdobe Fireworks CS4]IDAThz1Hm[t6]]SSYCzO.g^tfe:0[^B19m95(pZ1E}ZQRwC;ZHj8stB0t_4MD{cU:w&qf+F.b7HPusD?nSHsuK!R;DNBA_K,]/(o}~vGke~66+#6SWNw9&}mjkW0E{8!2NTAU/kUuD_w[]%@cm(UUL_%XWU3[Tm JT9@OfbC\|Ukk/R8H>pVReEs$=@xA?$=T<`jo4Bb]hMp<z:@HyN"0TX714k$VTx^s}1/7`s+6W!!zRVIN}7}X-2T6)V
Jul 8, 2024 12:29:18.571109056 CEST	1236	IN	Data Raw: ae f4 e9 f5 8f 07 88 0d 60 36 2b ed a3 59 be c9 36 74 27 22 d4 55 2f d7 23 3e 46 fa c5 38 30 cf aa 1a c7 26 f7 2f 01 48 dd dc 65 e3 47 13 0b 41 92 f7 26 01 8c da bd 88 51 5d 69 00 72 42 63 a5 d8 20 1a 29 7d 67 01 c1 68 67 9b fb bc 34 77 f5 26 46 Data Ascii: `6+Y6t'"U/#>F80&/HeGA&Q]irBc )}ghg4w&FT8ZNO8W>{Bk@QS73x+'Ou)`3J1pD(T,\|y Q *@-YG7Jr)&8GC0Uy
Jul 8, 2024 12:29:18.571120977 CEST	468	IN	Data Raw: 65 db de 91 6a d9 f5 f2 5c db 62 78 5e ae e4 1f de 71 7c 5b c7 03 12 d1 e9 93 f5 4b 50 41 15 e2 c7 23 e0 a4 67 c1 2e 57 58 f8 57 f7 e1 90 8d 45 43 9d 11 43 9b a5 57 cc 9b b7 03 17 a6 bc 0a bf c6 4d 60 94 ed bd d7 2c 9a eb db 79 6f 5e 7c dc 65 e0 Data Ascii: ej\bx^q\|[KPA#g.WXWECCWM`,yo^\|e\ ,T-,oetLX\m-\1h9R{ d?!8_N]xo{zSS}7y8o-?@Y~cwLUTxg]4gf'
Jul 8, 2024 12:29:18.772933006 CEST	313	OUT	GET /cgi-sys/images/404mid.gif HTTP/1.1 Host: ing.shalominternationalministry.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 8, 2024 12:29:18.902034044 CEST	361	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 10:29:18 GMT Server: Apache Last-Modified: Sat, 01 Oct 2022 13:15:14 GMT Accept-Ranges: bytes Content-Length: 120 Keep-Alive: timeout=5, max=74 Connection: Keep-Alive Content-Type: image/gif Data Raw: 47 49 46 38 39 61 64 03 04 00 91 00 00 9a b2 c9 ff ff ff a0 b6 cc a1 b7 cd 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 04 00 00 02 49 dc 82 a9 cb ed 0f a3 9c b4 da 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a6 ea ca b6 ee 9b 00 80 01 d7 f6 8d e7 fa ce f7 fe 0f 0c 0a 87 44 8a 8c 56 4c 2a 97 cc a6 f3 09 8d 4a a7 54 cc f1 50 cd 6a b7 dc ae f7 0b 0e 8b 2d b2 02 00 3b Data Ascii: GIF89ad!,dIHDVL*JTPj-;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49715	192.185.171.24	80	6412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jul 8, 2024 12:29:18.780472040 CEST	315	OUT	GET /cgi-sys/images/404top_w.jpg HTTP/1.1 Host: ing.shalominternationalministry.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 8, 2024 12:29:19.267360926 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 10:29:19 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Sun, 02 Oct 2022 08:41:17 GMT Accept-Ranges: bytes Content-Length: 4335 Keep-Alive: timeout=5, max=75 Content-Type: image/jpeg Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 a9 03 64 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 01 01 00 02 03 01 00 00 00 00 00 00 00 00 00 00 00 01 02 04 03 07 08 05 ff c4 00 3a 10 01 00 01 03 00 07 04 07 07 04 02 03 00 00 00 00 00 01 03 07 11 02 04 06 16 17 81 c2 12 21 94 d2 31 36 46 51 74 84 91 05 13 14 61 71 b2 c3 41 56 b1 c1 26 b3 a1 d3 f0 ff c4 00 19 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 05 06 03 04 ff c4 00 27 11 01 00 03 01 00 02 02 01 03 05 01 01 00 00 00 00 00 04 15 52 01 91 a1 02 b1 05 03 11 51 12 21 31 33 d1 13 14 ff da 00 0c [TRUNCATED] Data Ascii: JFIFHHC!"$"$Cd:!16FQtaqAV&'RQ!13?X
Jul 8, 2024 12:29:19.267378092 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 8, 2024 12:29:19.267391920 CEST	1236	IN	Data Raw: dc a9 f4 ed 45 6e 5a b5 18 e8 2b 22 e0 b0 91 a2 6f 2d cb 98 c6 f4 55 f0 b4 73 fb 0a c8 b8 2c 24 68 e3 2d ca c6 37 a2 b6 3e 1a 8e 7e bd 82 b6 36 39 e7 a5 84 8d 1c 65 b9 7d 9e ed a8 ab 8f cf 56 a3 3d 05 64 5c 16 12 34 45 e5 b9 71 18 de 8a dc f5 6a Data Ascii: EnZ+"o-Us,$h-7>~69e}V=d\4EqjVEa#IQ[BzJ47Fq+cczXHg;[?GN[F2z+~+cczXHkE_CV4qj#,$hrjellsK&\,$ix
Jul 8, 2024 12:29:19.267643929 CEST	896	IN	Data Raw: 3a 3e 42 ae 36 3e cb 09 1a 38 d9 72 f3 9d e3 cf c9 d1 f2 15 71 b1 f6 58 48 d1 c6 cb 97 9c ce d1 e6 3e 0e 8c 74 15 71 71 f6 58 48 d2 cd ec b9 79 ef da 3c fe 51 a9 d0 8e 82 ae 36 3e cb 09 1f ca 4d ec b9 73 3e b1 f2 8d 4e 8c 74 15 71 71 f6 58 48 d2 Data Ascii: :>B6>8rqXH>tqqXHy<Q6>Ms>NtqqXHXJB.>8r<\\}4lx<~!We/.^;'Bz,$'.\G]RqqXHq_]NF.',!Wely,$heghF:,$if\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49716	192.185.171.24	80	6412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jul 8, 2024 12:29:18.780572891 CEST	316	OUT	GET /cgi-sys/images/404bottom.gif HTTP/1.1 Host: ing.shalominternationalministry.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 8, 2024 12:29:19.285070896 CEST	804	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 10:29:19 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Sat, 01 Oct 2022 13:14:37 GMT Accept-Ranges: bytes Content-Length: 537 Keep-Alive: timeout=5, max=75 Content-Type: image/gif Data Raw: 47 49 46 38 39 61 64 03 0e 00 d5 00 00 36 65 94 f7 f9 fb ad c0 d4 9d b4 cb cd d9 e4 7c 9b b9 a2 b8 ce 6d 8f b1 e6 ec f2 5c 82 a9 8c a7 c2 bd cd dc 4e 77 a1 f2 f5 f8 b0 c3 d5 85 a2 be dc e4 ec 93 ad c6 ff ff ff 58 7f a6 73 94 b5 a7 bc d0 c5 d2 e0 64 89 ad 81 9e bc d1 dc e7 ea ef f4 f6 f8 fa b3 c5 d7 7b 94 b5 7e 9d bb 8c ad c5 6b 94 b5 8c a5 bd 63 87 ac 59 80 a7 d4 de e8 ed f1 f5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 0e 00 00 06 ff 40 83 41 42 2c 1a 8f c8 a4 72 c9 6c 3a 9f d0 a8 74 4a ad 5a af d8 ac 76 cb ed 7a bf e0 b0 78 4c 2e 9b cf e8 b4 7a 5d 54 08 87 ec b8 7c 4e af db ef f8 bc 7e cf ef fb ff 80 4f 6e 42 81 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 55 6e 15 03 91 96 97 98 99 9a 9b 9c 9d 9e 9f 53 1e 0e 0e 11 a0 a6 a7 a8 a9 aa ab ac ad 9e a2 16 18 ae b3 b4 b5 b6 b7 b8 [TRUNCATED] Data Ascii: GIF89ad6e\|m\NwXsd{~kcY!,d@AB,rl:tJZvzxL.z]T\|N~OnBUnSfDfD#pEH2@# CI(S\0cI8s6*d(phDC8ZXj`KS9X Q"I;

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	213.202.235.9	443	6412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-08 10:29:15 UTC	814	OUT	GET /ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t HTTP/1.1 Host: m.exactag.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-08 10:29:16 UTC	723	IN	HTTP/1.1 302 Found Connection: close Date: Mon, 08 Jul 2024 10:29:15 GMT Content-Type: text/html; charset=utf-8 Cache-Control: max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Transfer-Encoding: chunked Expires: Mon, 26 Jul 1997 05:00:00 GMT Last-Modified: Mo, 08 Jul 2024 10:29:16 GMT Location: http:ING.shalominternationalministry.com/index.xml#?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR" X-ET-Code: 20 X-ET-Camp: 0 X-ET-Monitoring: 1 Strict-Transport-Security: max-age=31536000 cross-origin-resource-policy: cross-origin X-Xss-Protection: 0 X-Content-Type-Options: nosniff
2024-07-08 10:29:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49714	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-08 10:29:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-08 10:29:19 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=193260 Date: Mon, 08 Jul 2024 10:29:19 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49718	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-08 10:29:20 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-08 10:29:20 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=193192 Date: Mon, 08 Jul 2024 10:29:20 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-08 10:29:20 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 400, Parent PID: 5504

General

Target ID:	0
Start time:	06:29:07
Start date:	08/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6412, Parent PID: 400

General

Target ID:	2
Start time:	06:29:12
Start date:	08/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2216,i,13896716818182238996,1355087275924318838,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 2692, Parent PID: 5504

General

Target ID:	3
Start time:	06:29:14
Start date:	08/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 49

Chrome Cache Entry: 50

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Windows Analysis Report
https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t