Edit tour

Windows Analysis Report
http://lphone-security.info/icloud2022-esp.php/

Overview

General Information

Sample URL:	http://lphone-security.info/icloud2022-esp.php/
Analysis ID:	1502349
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Phishing site detected (based on favicon image match)

Detected non-DNS traffic on DNS port

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2132 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2384,i,15367295168244595525,2997850873863108969,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://lphone-security.info/icloud2022-esp.php/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Suricata Signatures

ET PHISHING Possible iCloud Phishing Landing - Title over non SSL - Source IP: 93.157.106.54 - Destination IP: 192.168.2.5

Timestamp:	2024-09-01T00:46:26.302040+0200
SID:	2024385
Severity:	2
Source Port:	80
Destination Port:	49711
Protocol:	TCP
Classtype:	Possible Social Engineering Attempted

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://lphone-security.info/icloud2022-esp.php/	Avira URL Cloud: detection malicious, Label: phishing
Source: http://lphone-security.info/icloud2022-esp.php/	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Multi AV Scanner detection for domain / URL

Source: lphone-security.info

Virustotal: Detection: 7%

Perma Link

Phishing

Phishing site detected (based on favicon image match)

Source: http://lphone-security.info

Matcher: Template: apple matched with high similarity

Source: http://lphone-security.info/icloud2022-esp.php/

HTTP Parser: Base64 decoded: .document-row .icon .excel-icon{background-image:url("blob:https://www.icloud.com/ffb96c85-5d6e-4ea3-a62c-040d4599b012")}.document-row .icon .ppt-icon{background-image:url("blob:https://www.icloud.com/3ed2a0fe-a15b-47ce-a02f-3bf19d35d920")}.document-row...

Source: https://www.apple.com/icloud/	HTTP Parser: No favicon
Source: https://www.apple.com/icloud/	HTTP Parser: No favicon
Source: https://www.apple.com/icloud/	HTTP Parser: No favicon
Source: https://www.apple.com/legal/internet-services/icloud/	HTTP Parser: No favicon
Source: https://www.apple.com/legal/internet-services/icloud/	HTTP Parser: No favicon
Source: https://www.apple.com/legal/privacy/	HTTP Parser: No favicon
Source: https://www.apple.com/legal/privacy/	HTTP Parser: No favicon
Source: https://www.apple.com/airplay/	HTTP Parser: No favicon
Source: https://www.apple.com/airplay/	HTTP Parser: No favicon
Source: https://www.apple.com/airplay/	HTTP Parser: No favicon
Source: https://www.apple.com/siri/	HTTP Parser: No favicon
Source: https://www.apple.com/siri/	HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49744 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49731 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 6MB later: 46MB

Source: global traffic

TCP traffic: 192.168.2.5:61077 -> 1.1.1.1:53

Source: Network traffic

Suricata IDS: 2024385 - Severity 2 - ET PHISHING Possible iCloud Phishing Landing - Title over non SSL : 93.157.106.54:80 -> 192.168.2.5:49711

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49744 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /icloud2022-esp.php/ HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/authService.latest.min.js HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://lphone-security.info/icloud2022-esp.php/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/main.css HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://lphone-security.info/icloud2022-esp.php/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/fpo@1x.gif HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://lphone-security.info/icloud2022-esp.php/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/fc2b7d9c646c188a2aed32221a4fe795.jpg HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://lphone-security.info/icloud2022-esp.php/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/e6ffc52737977fe1700d423a10874d0b.png HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://lphone-security.info/icloud2022-esp.php/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/cb89b6112cb1d8e18fac821612c25717.png HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://lphone-security.info/icloud2022-esp.php/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/applenew2.png HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://lphone-security.info/icloud2022-esp.php/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/authService.latest.min.js HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/fc2b7d9c646c188a2aed32221a4fe795.jpg HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/e6ffc52737977fe1700d423a10874d0b.png HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/applenew2.png HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/cb89b6112cb1d8e18fac821612c25717.png HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icloud-archivos/fpo@1x.gif HTTP/1.1Host: lphone-security.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: chromecache_293.2.dr, chromecache_234.2.dr, chromecache_314.2.dr, chromecache_391.2.dr, chromecache_308.2.dr	String found in binary or memory: "https://www.facebook.com/Apple", equals www.facebook.com (Facebook)
Source: chromecache_293.2.dr, chromecache_234.2.dr, chromecache_314.2.dr, chromecache_391.2.dr, chromecache_308.2.dr	String found in binary or memory: "https://www.linkedin.com/company/apple", equals www.linkedin.com (Linkedin)
Source: chromecache_293.2.dr, chromecache_234.2.dr, chromecache_314.2.dr, chromecache_391.2.dr, chromecache_308.2.dr	String found in binary or memory: "https://www.twitter.com/Apple" equals www.twitter.com (Twitter)
Source: chromecache_293.2.dr, chromecache_234.2.dr, chromecache_314.2.dr, chromecache_391.2.dr, chromecache_308.2.dr	String found in binary or memory: "https://www.youtube.com/user/Apple", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: lphone-security.info
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ckdatabasews.icloud.com
Source: global traffic	DNS traffic detected: DNS query: cvws.icloud-content.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1725144363991&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2384,i,15367295168244595525,2997850873863108969,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://lphone-security.info/icloud2022-esp.php/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2384,i,15367295168244595525,2997850873863108969,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://lphone-security.info/icloud2022-esp.php/	100%	Avira URL Cloud	phishing
http://lphone-security.info/icloud2022-esp.php/	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
http://lphone-security.info/icloud2022-esp.php/	4%	Virustotal		Browse

Source	Detection	Scanner	Link
lphone-security.info	7%	Virustotal	Browse
cvws.apple-dns.net	0%	Virustotal	Browse
gateway.fe2.apple-dns.net	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
microsoft-10.ovslegodl.sched.ovscdns.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
k256-all.gslb.ksyuncdn.com	0%	Virustotal	Browse
ckdatabasews.fe2.apple-dns.net	0%	Virustotal	Browse
ckdatabasews.icloud.com	0%	Virustotal	Browse
cvws.icloud-content.com	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://bugs.chromium.org/p/v8/issues/detail?id=3443	0%	URL Reputation	safe
https://schema.org	0%	URL Reputation	safe
https://code.google.com/p/v8/issues/detail?id=687	0%	URL Reputation	safe
http://schema.org	0%	URL Reputation	safe
http://www.JSON.org/js.html	0%	URL Reputation	safe
http://lphone-security.info/icloud-archivos/fpo@1x.gif	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/API/ChildNode/remove#Polyfill	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#reactdom.finddomnode	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.cloneelement	0%	Avira URL Cloud	safe
http://lphone-security.info/icloud-archivos/applenew2.png	0%	Avira URL Cloud	safe
http://lphone-security.info/icloud-archivos/main.css	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/API/ChildNode/remove#Polyfill	0%	Virustotal		Browse
https://facebook.github.io/react/docs/top-level-api.html#reactdom.finddomnode	0%	Virustotal		Browse
https://html.spec.whatwg.org/multipage/syntax.html#generate-implied-end-tags	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/find	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.cloneelement	0%	Virustotal		Browse
http://paulirish.com/2011/requestanimationframe-for-smart-animating/	0%	Avira URL Cloud	safe
https://github.com/mishoo/UglifyJS2/blob/v2.4.20/lib/parse.js#L216	0%	Avira URL Cloud	safe
http://www.quirksmode.org/dom/events/tests/scroll.html	0%	Avira URL Cloud	safe
https://www.youtube.com/user/Apple	0%	Avira URL Cloud	safe
http://lphone-security.info/icloud-archivos/cb89b6112cb1d8e18fac821612c25717.png	0%	Avira URL Cloud	safe
http://www.quirksmode.org/dom/events/tests/scroll.html	0%	Virustotal		Browse
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/find	0%	Virustotal		Browse
https://github.com/facebook/react/issues/6887	0%	Avira URL Cloud	safe
http://paulirish.com/2011/requestanimationframe-for-smart-animating/	0%	Virustotal		Browse
https://github.com/mishoo/UglifyJS2/blob/v2.4.20/lib/parse.js#L216	0%	Virustotal		Browse
https://tc39.github.io/ecma262/#sec-array.prototype.includes	0%	Avira URL Cloud	safe
https://www.youtube.com/user/Apple	0%	Virustotal		Browse
https://html.spec.whatwg.org/multipage/syntax.html#special	0%	Avira URL Cloud	safe
https://html.spec.whatwg.org/multipage/syntax.html#generate-implied-end-tags	0%	Virustotal		Browse
http://schema.org/docs/gs.html	0%	Avira URL Cloud	safe
https://github.com/facebook/react/issues/6887	0%	Virustotal		Browse
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/assign)	0%	Avira URL Cloud	safe
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intable	0%	Avira URL Cloud	safe
https://html.spec.whatwg.org/multipage/syntax.html#special	0%	Virustotal		Browse
https://www.linkedin.com/company/apple	0%	Avira URL Cloud	safe
http://www.andismith.com/blog/2012/02/modernizr-prefixed/)	0%	Avira URL Cloud	safe
http://lphone-security.info/icloud-archivos/fc2b7d9c646c188a2aed32221a4fe795.jpg	0%	Avira URL Cloud	safe
https://tc39.github.io/ecma262/#sec-array.prototype.includes	0%	Virustotal		Browse
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/assign)	0%	Virustotal		Browse
http://schema.org/docs/gs.html	0%	Virustotal		Browse
https://www.linkedin.com/company/apple	0%	Virustotal		Browse
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/now#Compatibil	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/now#Compatibil	0%	Virustotal		Browse
https://fb.me/react-warning-polyfills	0%	Avira URL Cloud	safe
https://fb.me/react-warning-dont-call-proptypes	0%	Avira URL Cloud	safe
https://fb.me/react-legacyfactory	0%	Avira URL Cloud	safe
http://jsperf.com/key-missing	0%	Avira URL Cloud	safe
http://dom.spec.whatwg.org/#dom-domimplementation-hasfeature	0%	Avira URL Cloud	safe
http://www.andismith.com/blog/2012/02/modernizr-prefixed/)	0%	Virustotal		Browse
https://github.com/spicyj/innerhtml-vs-createelement-vs-clonenode.	0%	Avira URL Cloud	safe
http://jsperf.com/obj-vs-arr-iteration	0%	Avira URL Cloud	safe
http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-262.pdf)	0%	Avira URL Cloud	safe
https://bugs.chromium.org/p/v8/issues/detail?id=4118	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.children.only	0%	Avira URL Cloud	safe
https://fb.me/react-refs-must-have-owner).	0%	Avira URL Cloud	safe
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intable	0%	Virustotal		Browse
https://www.twitter.com/Apple	0%	Avira URL Cloud	safe
http://bugs.jquery.com/ticket/12385.	0%	Avira URL Cloud	safe
https://fb.me/prop-types-docs	0%	Avira URL Cloud	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=208427	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/API/AnimationEvent	0%	Avira URL Cloud	safe
https://fb.me/react-devtools	0%	Avira URL Cloud	safe
https://fb.me/react-unknown-prop%s	0%	Avira URL Cloud	safe
https://fb.me/react-minification	0%	Avira URL Cloud	safe
https://github.com/facebook/react/issues/7240	0%	Avira URL Cloud	safe
http://jsperf.com/key-exists	0%	Avira URL Cloud	safe
https://fb.me/react-controlled-components	0%	Avira URL Cloud	safe
http://my.opera.com/emoller/blog/2011/12/20/requestanimationframe-for-smart-er-animating	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.children.count	0%	Avira URL Cloud	safe
https://github.com/facebook/react/issues/708.	0%	Avira URL Cloud	safe
https://assets.adobedtm.com/extensions/EP308220a2a4c4403f97fc1960100db40f/AppMeasurement.js	0%	Avira URL Cloud	safe
http://jsperf.com/emptying-a-node	0%	Avira URL Cloud	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1276240	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent#Key_names	0%	Avira URL Cloud	safe
https://fb.me/react-dom-factories	0%	Avira URL Cloud	safe
https://github.com/paulmillr/console-polyfill	0%	Avira URL Cloud	safe
https://github.com/facebook/react/issues/7233	0%	Avira URL Cloud	safe
http://www.quirksmode.org/js/detect.html	0%	Avira URL Cloud	safe
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inhead	0%	Avira URL Cloud	safe
https://fb.me/createmixin-was-never-implemented	0%	Avira URL Cloud	safe
https://fb.me/react-special-props)	0%	Avira URL Cloud	safe
https://github.com/facebook/react/issues/3236).	0%	Avira URL Cloud	safe
http://lphone-security.info/icloud-archivos/e6ffc52737977fe1700d423a10874d0b.png	0%	Avira URL Cloud	safe
http://www.quirksmode.org/blog/archives/2008/04/delegating_the.html	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.children.foreach	0%	Avira URL Cloud	safe
https://html.spec.whatwg.org/multipage/semantics.html#the-html-element	0%	Avira URL Cloud	safe
http://lphone-security.info/icloud-archivos/authService.latest.min.js	0%	Avira URL Cloud	safe
https://fb.me/react-create-class	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/API/Element/matches#Polyfill	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.children.map	0%	Avira URL Cloud	safe
http://www.quirksmode.org/dom/events/scroll.html	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Global_Objects/Array/every	0%	Avira URL Cloud	safe
https://fb.me/react-event-pooling	0%	Avira URL Cloud	safe
https://github.com/facebook/fbjs/blob/e66ba20ad5be433eb54423f2b097d829324d9de6/packages/fbjs/src/__f	0%	Avira URL Cloud	safe
http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Global_Objects/Array/filter	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.createelement	0%	Avira URL Cloud	safe
https://github.com/facebook/react/pull/7232	0%	Avira URL Cloud	safe
http://www.wikidata.org/entity/Q312	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
k256-all.gslb.ksyuncdn.com	183.61.168.1	true	false	0%, Virustotal, Browse	unknown
lphone-security.info	93.157.106.54	true	false	7%, Virustotal, Browse	unknown
www.google.com	142.250.185.228	true	false	0%, Virustotal, Browse	unknown
gateway.fe2.apple-dns.net	17.248.209.68	true	false	0%, Virustotal, Browse	unknown
microsoft-10.ovslegodl.sched.ovscdns.com	43.175.151.230	true	false	0%, Virustotal, Browse	unknown
ckdatabasews.fe2.apple-dns.net	17.248.209.65	true	false	0%, Virustotal, Browse	unknown
cvws.apple-dns.net	17.248.209.32	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
cvws.icloud-content.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
ckdatabasews.icloud.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Name	Malicious	Antivirus Detection	Reputation
http://lphone-security.info/icloud-archivos/fpo@1x.gif	true	Avira URL Cloud: safe	unknown
http://lphone-security.info/icloud-archivos/applenew2.png	true	Avira URL Cloud: safe	unknown
http://lphone-security.info/icloud-archivos/main.css	true	Avira URL Cloud: safe	unknown
http://lphone-security.info/icloud-archivos/cb89b6112cb1d8e18fac821612c25717.png	true	Avira URL Cloud: safe	unknown
http://lphone-security.info/icloud-archivos/fc2b7d9c646c188a2aed32221a4fe795.jpg	true	Avira URL Cloud: safe	unknown
http://lphone-security.info/icloud-archivos/e6ffc52737977fe1700d423a10874d0b.png	true	Avira URL Cloud: safe	unknown
http://lphone-security.info/icloud2022-esp.php/	true		unknown
http://lphone-security.info/icloud-archivos/authService.latest.min.js	true	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://developer.mozilla.org/en-US/docs/Web/API/ChildNode/remove#Polyfill	chromecache_249.2.dr, chromecache_363.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#reactdom.finddomnode	chromecache_266.2.dr, chromecache_361.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#react.cloneelement	chromecache_266.2.dr, chromecache_361.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bugs.chromium.org/p/v8/issues/detail?id=3443	chromecache_266.2.dr, chromecache_361.2.dr	false	URL Reputation: safe	unknown
https://html.spec.whatwg.org/multipage/syntax.html#generate-implied-end-tags	chromecache_266.2.dr, chromecache_361.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/find	chromecache_249.2.dr, chromecache_363.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://paulirish.com/2011/requestanimationframe-for-smart-animating/	chromecache_249.2.dr, chromecache_363.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.quirksmode.org/dom/events/tests/scroll.html	chromecache_266.2.dr, chromecache_361.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/mishoo/UglifyJS2/blob/v2.4.20/lib/parse.js#L216	chromecache_266.2.dr, chromecache_361.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.youtube.com/user/Apple	chromecache_293.2.dr, chromecache_234.2.dr, chromecache_314.2.dr, chromecache_391.2.dr, chromecache_308.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/facebook/react/issues/6887	chromecache_266.2.dr, chromecache_361.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tc39.github.io/ecma262/#sec-array.prototype.includes	chromecache_249.2.dr, chromecache_363.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://html.spec.whatwg.org/multipage/syntax.html#special	chromecache_266.2.dr, chromecache_361.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schema.org/docs/gs.html	chromecache_266.2.dr, chromecache_361.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/assign)	chromecache_249.2.dr, chromecache_363.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intable	chromecache_266.2.dr, chromecache_361.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.linkedin.com/company/apple	chromecache_293.2.dr, chromecache_234.2.dr, chromecache_314.2.dr, chromecache_391.2.dr, chromecache_308.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.andismith.com/blog/2012/02/modernizr-prefixed/)	chromecache_266.2.dr, chromecache_361.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/now#Compatibil	chromecache_249.2.dr, chromecache_363.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://fb.me/react-warning-polyfills	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/react-warning-dont-call-proptypes	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/react-legacyfactory	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://jsperf.com/key-missing	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://dom.spec.whatwg.org/#dom-domimplementation-hasfeature	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/spicyj/innerhtml-vs-createelement-vs-clonenode.	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://jsperf.com/obj-vs-arr-iteration	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-262.pdf)	chromecache_249.2.dr, chromecache_363.2.dr	false	Avira URL Cloud: safe	unknown
https://bugs.chromium.org/p/v8/issues/detail?id=4118	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#react.children.only	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/react-refs-must-have-owner).	chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://www.twitter.com/Apple	chromecache_293.2.dr, chromecache_234.2.dr, chromecache_314.2.dr, chromecache_391.2.dr, chromecache_308.2.dr	false	Avira URL Cloud: safe	unknown
http://bugs.jquery.com/ticket/12385.	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/prop-types-docs	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=208427	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/API/AnimationEvent	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/react-devtools	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/react/issues/7240	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/react-minification	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/react-unknown-prop%s	chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://jsperf.com/key-exists	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/react-controlled-components	chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://my.opera.com/emoller/blog/2011/12/20/requestanimationframe-for-smart-er-animating	chromecache_249.2.dr, chromecache_363.2.dr	false	Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#react.children.count	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/react/issues/708.	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://assets.adobedtm.com/extensions/EP308220a2a4c4403f97fc1960100db40f/AppMeasurement.js	chromecache_387.2.dr, chromecache_365.2.dr	false	Avira URL Cloud: safe	unknown
http://jsperf.com/emptying-a-node	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1276240	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent#Key_names	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://schema.org	chromecache_391.2.dr	false	URL Reputation: safe	unknown
https://fb.me/react-dom-factories	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/paulmillr/console-polyfill	chromecache_249.2.dr, chromecache_363.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/react/issues/7233	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://www.quirksmode.org/js/detect.html	chromecache_249.2.dr, chromecache_363.2.dr	false	Avira URL Cloud: safe	unknown
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inhead	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/createmixin-was-never-implemented	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/react-special-props)	chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/react/issues/3236).	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://www.quirksmode.org/blog/archives/2008/04/delegating_the.html	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#react.children.foreach	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://html.spec.whatwg.org/multipage/semantics.html#the-html-element	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/react-create-class	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/API/Element/matches#Polyfill	chromecache_249.2.dr, chromecache_363.2.dr	false	Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#react.children.map	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://www.quirksmode.org/dom/events/scroll.html	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Global_Objects/Array/every	chromecache_249.2.dr, chromecache_363.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/react-event-pooling	chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/fbjs/blob/e66ba20ad5be433eb54423f2b097d829324d9de6/packages/fbjs/src/__f	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Global_Objects/Array/filter	chromecache_249.2.dr, chromecache_363.2.dr	false	Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#react.createelement	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/react/pull/7232	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://code.google.com/p/v8/issues/detail?id=687	chromecache_266.2.dr, chromecache_361.2.dr	false	URL Reputation: safe	unknown
http://www.wikidata.org/entity/Q312	chromecache_293.2.dr, chromecache_234.2.dr, chromecache_314.2.dr, chromecache_391.2.dr, chromecache_308.2.dr	false	Avira URL Cloud: safe	unknown
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#react.children.toarray	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intr	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/assign#Polyf	chromecache_249.2.dr, chromecache_363.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/react/issues/7253	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/react/pull/6896	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inselect	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://schema.org	chromecache_391.2.dr, chromecache_308.2.dr	false	URL Reputation: safe	unknown
https://github.com/facebook/react/issues/6731#issuecomment-254874553	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/react/issues/7253#issuecomment-236074326	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/includes	chromecache_249.2.dr, chromecache_363.2.dr	false	Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#react.isvalidelement	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/react/pull/7101	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-incaption	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://purl.eligrey.com/github/classList.js/blob/master/classList.js	chromecache_249.2.dr, chromecache_363.2.dr	false	Avira URL Cloud: safe	unknown
http://facebook.github.io/react/docs/error-decoder.html?invariant=	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/zloirock/core-js/issues/173	chromecache_266.2.dr, chromecache_361.2.dr	false	Avira URL Cloud: safe	unknown
http://www.JSON.org/js.html	chromecache_249.2.dr, chromecache_363.2.dr	false	URL Reputation: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
17.248.209.68	gateway.fe2.apple-dns.net	United States	714	APPLE-ENGINEERINGUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
17.248.209.32	cvws.apple-dns.net	United States	714	APPLE-ENGINEERINGUS	false
17.248.209.65	ckdatabasews.fe2.apple-dns.net	United States	714	APPLE-ENGINEERINGUS	false
93.157.106.54	lphone-security.info	Russian Federation	34360	OGICOMPL	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502349
Start date and time:	2024-09-01 00:45:29 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://lphone-security.info/icloud2022-esp.php/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@27/301@10/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://apple.com/icloud Browse: https://www.apple.com/legal/internet-services/icloud/ Browse: https://www.apple.com/legal/privacy/ Browse: https://www.apple.com/support/systemstatus/ Browse: https://www.apple.com/airplay/ Browse: https://www.apple.com/siri/

Input	Output
URL: http://lphone-security.info/icloud2022-esp.php/ Model: jbxai	{ "brand":["iCloud"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.apple.com/icloud/ Model: jbxai	{ "brand":["Apple"], "contains_trigger_text":false, "prominent_button_name":"Upgrade today", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.apple.com/legal/internet-services/icloud/ Model: jbxai	{ "brand":["Apple"], "contains_trigger_text":false, "prominent_button_name":"Agree", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.apple.com/support/systemstatus/ Model: jbxai	{ "brand":["Apple"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.apple.com/legal/privacy/ Model: jbxai	{ "brand":["Apple"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.apple.com/airplay/ Model: jbxai	{ "brand":["Apple"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 31 21:46:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9821480983797897
Encrypted:	false
SSDEEP:	48:8T3dWTSuHH2idAKZdA19ehwiZUklqehs5y+3:8YDcjy
MD5:	8F25AF39357328D939EFAC6DA85F7577
SHA1:	40F104962B2394263D4DF92744E57F1CEF96BC46
SHA-256:	BA13744EAEB4DDEF8A4D0B4B7F651014AA85D275A3E6C54AD92222DCE2AD89D3
SHA-512:	63C83A62690DFC57406F10536480020417838EAA4D95E51E301758E7EDA48D45E5D8F56E1C7F44DD00D031AC5F22171D1AC32C2D8A3A4C56D11B12C4DF5462DA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....a......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........k[.+.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2024 00:46:23.597769022 CEST	53	51506	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:23.623538971 CEST	53	53970	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:24.609797955 CEST	53	56487	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:25.291915894 CEST	58762	53	192.168.2.5	1.1.1.1
Sep 1, 2024 00:46:25.292293072 CEST	55555	53	192.168.2.5	1.1.1.1
Sep 1, 2024 00:46:25.353475094 CEST	53	58762	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:25.388374090 CEST	58470	53	192.168.2.5	1.1.1.1
Sep 1, 2024 00:46:25.388725042 CEST	63287	53	192.168.2.5	1.1.1.1
Sep 1, 2024 00:46:25.394881964 CEST	53	58470	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:25.395374060 CEST	53	63287	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:25.408513069 CEST	53	55555	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:26.257307053 CEST	65521	53	192.168.2.5	1.1.1.1
Sep 1, 2024 00:46:26.257539988 CEST	51465	53	192.168.2.5	1.1.1.1
Sep 1, 2024 00:46:26.257814884 CEST	58571	53	192.168.2.5	1.1.1.1
Sep 1, 2024 00:46:26.258022070 CEST	56307	53	192.168.2.5	1.1.1.1
Sep 1, 2024 00:46:26.264302015 CEST	53	65521	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:26.264455080 CEST	53	51465	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:26.264990091 CEST	53	58571	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:26.265074968 CEST	53	56307	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:27.252310038 CEST	53	50290	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:29.577987909 CEST	52852	53	192.168.2.5	1.1.1.1
Sep 1, 2024 00:46:29.578984976 CEST	53570	53	192.168.2.5	1.1.1.1
Sep 1, 2024 00:46:29.611274958 CEST	53	52852	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:29.612982035 CEST	53	53570	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:30.168515921 CEST	53	56031	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:38.042166948 CEST	53	61911	1.1.1.1	192.168.2.5
Sep 1, 2024 00:46:41.899003983 CEST	53	54650	1.1.1.1	192.168.2.5
Sep 1, 2024 00:47:01.128717899 CEST	53	56572	1.1.1.1	192.168.2.5
Sep 1, 2024 00:47:05.174772024 CEST	53	50630	1.1.1.1	192.168.2.5
Sep 1, 2024 00:47:23.394284964 CEST	53	61080	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 00:46:25.491162062 CEST	454	OUT	GET /icloud2022-esp.php/ HTTP/1.1 Host: lphone-security.info Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:26.153398037 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:26 GMT Server: Apache Content-Encoding: gzip Vary: Accept-Encoding Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 36 35 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5b 5b 73 db c8 95 7e d7 af e8 e5 24 29 29 2b 80 b8 5f 64 4b 89 47 f2 c8 f2 48 72 ec 91 ad 11 53 a9 54 e3 42 12 12 2e 0c 00 92 a2 a6 e6 c7 cc 63 1e f2 b0 b5 6f fb b8 fe 63 fb 9d 6e 80 24 24 d1 1e 8f ed ad d8 25 b2 d1 97 d3 e7 de e7 34 0e 9f fe c7 d1 ab c3 8b ab bf 3c 67 e3 3a 4b 0f b6 9e d2 17 8b 92 72 bf 97 d6 65 8f 45 bc e6 4a 35 9d 4c 8a b2 ae 94 79 1c 4c f6 7b 3d 16 a6 bc aa f6 7b d7 95 32 2c c2 69 a5 cc 92 2a 09 d2 b8 99 7e bf 9b 56 88 81 49 99 64 bc 5c 28 49 5e c7 25 0f eb a4 c8 95 ac 88 30 21 2b a6 55 bb 3c 8a 67 49 18 2b f5 62 12 2b cd 46 51 5c dd d4 c5 a4 c7 52 9e 8f f6 7b 71 a5 64 b7 bd 83 a7 e3 98 47 40 39 8b 6b 0e f4 eb 89 12 ff 63 9a cc f6 7b 61 81 0d f2 5a 80 00 b2 f2 69 bf 57 c7 b7 75 9f e8 7b c2 c2 31 2f ab b8 de 7f 7b f1 9d e2 f5 0e b6 58 f3 ef 61 43 42 6f e7 f7 a6 f5 b0 b3 40 0e e7 3c 03 11 b3 24 9e 13 9f d6 b6 9c 27 51 3d de 6f 28 12 0f bb 2c c9 93 3a e1 a9 52 85 1c bc d1 77 59 bb 4e 19 26 f5 7e 58 cc e2 72 c3 06 60 43 58 26 13 e2 [TRUNCATED] Data Ascii: 165f[[s~$))+_dKGHrSTB.cocn$$%4<g:KreEJ5LyL{={2,i~VId\(I^%0!+U<gI+b+FQ\R{qdG@9kc{aZiWu{1/{XaCBo@<$'Q=o(,:RwYN&~Xr`CX&'y&Uq9Kb/9aGq8uQQL"MQ`_{61;9biLlqnZ+.A~Vn(j$$Rv]ihNt]jXd@#GkH~>rsZXo\|$(PB>AE\}ER47@3.y^zg0"-u(6lma\|~$aeJIBae<(jQq+N8)Ip>%(_%Y-<jo@=-_W_O:n&5-qk~6C>`BI(e2Y`{x>\>eL<#ZE_~T>S!~@V'h=g\|zd7ql$B6W+C8+"Ixx3ih=<xla:wA$$WxX1>a?2S+QR!f@B".77>2-Ob`PEW&!vA.b\
Sep 1, 2024 00:46:26.153415918 CEST	1236	IN	Data Raw: 4f 6e 2c 3c 06 94 2e a4 f8 b7 2c aa aa 00 49 49 8e e0 ff e0 d3 00 45 79 45 ee 67 18 d7 e1 f8 f1 b5 e1 0d 25 0a 01 af e2 79 f5 f9 98 7c 04 da af 40 67 b6 5c a8 34 96 f2 39 e8 7c 18 da 63 e8 b4 db a4 05 c7 09 c1 ab c6 e3 7d ae 2b 99 f3 34 9d f0 49 Data Ascii: On,<.,IIEyEg%y\|@g\49\|c}+4I\u9X3f('2lU<MCO*&ne-?$$qo+86T<:,ZcLp{LwFHdIdZb7N(J55e
Sep 1, 2024 00:46:26.153426886 CEST	448	IN	Data Raw: 32 4c 42 b1 bd d2 e0 42 77 b2 0d ac fb 40 44 9e 9c 13 fa 9d b1 09 c2 a4 e5 06 74 71 1d 41 26 8a e8 45 54 51 c7 6c 08 fa 71 42 3f b2 aa 65 87 bc e1 8e cb 76 b0 2e 8a 94 6e fe 02 8e 70 b2 6c e9 6c 9e 3a 60 48 8b 5a 0a 9a 55 0c fc a0 b3 96 2e f5 ba Data Ascii: 2LBBw@DtqA&ETQlqB?ev.npll:`HZU.[75RTGF1< ;x/qB7h-2i.8RF\|&d?{>]lLn4dsS-Q4O: 0i5@1#6L(R[)$'t%R
Sep 1, 2024 00:46:26.153438091 CEST	1236	IN	Data Raw: 0d 30 72 2c d8 f7 4e 27 b8 2d 2f 1d d5 f0 5d ec 05 8c 5c 5f 51 7d d3 24 44 4c 62 a3 e9 7b 4d 5b 57 2d db 16 34 eb ae a9 a8 9e 6b 34 4d 43 b5 f4 99 e2 a8 b6 a1 b7 00 21 5f c3 12 c8 db 86 41 a4 81 0d 16 44 05 7c 5c 5b 17 4d 42 5d 53 3d 92 49 68 aa Data Ascii: 0r,N'-/]\_Q}$DLb{M[W-4k4MC!_AD\|\[MB]S=Ihq[GPii&F6S^XMgb9uBVR(icbb`)Ow,iKBB+o%$Km,1YFZsj.!YOuBU"fu
Sep 1, 2024 00:46:26.158035994 CEST	1236	IN	Data Raw: 0f e4 70 42 35 32 af b1 c8 70 e4 7d 46 92 8d 36 5c 9d 0c 27 c5 9f f5 5b 75 94 0c 57 66 a8 69 bf c7 c2 87 de b6 59 2b 01 3f 70 ae 74 99 b2 79 1f c7 18 72 cb 18 3a 9e e3 46 4e 14 45 5e 1c f0 30 8a 71 d8 78 c3 28 f0 34 f5 7a 42 ef 84 cb 50 d4 76 3d Data Ascii: pB52p}F6\'[uWfiY+?ptyr:FNE^0qx(4zBPv=D347CrB4C0v}3vJ34BNhXXrWz>wRzc,-_]bu5JFo>~VGUg+*.\V<OY_%K#5mks
Sep 1, 2024 00:46:26.158049107 CEST	591	IN	Data Raw: fa 20 86 38 dc 5a 49 94 8c 12 44 49 ff 5e 9a e8 7d 96 26 36 24 7d 7d 5d 5c 47 f3 0f ff 6e ee c6 eb 18 4a a3 75 8d 6a 91 56 3d 59 ab bf fb 66 38 1c 3e e9 56 85 d9 0f d4 72 95 f7 6a da 03 eb 5a 1a 9f e1 6a f7 3d f6 63 96 b7 3a 74 e5 c9 da 49 74 13 Data Ascii: 8ZIDI^}&6$}}]\GnJujV=Yf8>VrjZj=c:tItV>p6ei_bn>U{gP58xW?PbL'Xb!Wm(JAqX7dj~Q5As(EBBkDh, d!/>B=>H)^g
Sep 1, 2024 00:46:26.297317028 CEST	372	OUT	GET /icloud-archivos/authService.latest.min.js HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://lphone-security.info/icloud2022-esp.php/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:26.499541998 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:26 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 45564 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/javascript Data Raw: 0a 2f 2a 2a 0a 2a 20 2a 2a 41 43 4b 4e 4f 57 4c 45 44 47 45 4d 45 4e 54 53 3a 2a 2a 0a 2a 20 68 74 74 70 73 3a 2f 2f 61 70 70 6c 65 69 64 2e 63 64 6e 2d 61 70 70 6c 65 2e 63 6f 6d 2f 61 70 70 6c 65 61 75 74 68 2f 73 74 61 74 69 63 2f 6a 73 61 70 69 2f 61 63 6b 6e 6f 77 6c 65 64 67 65 6d 65 6e 74 73 2e 74 78 74 0a 2a 20 0a 2a 2f 0a 0a 77 69 6e 64 6f 77 2e 69 64 6d 73 61 70 69 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 69 29 7b 69 66 28 6e 5b 69 5d 29 72 65 74 75 72 6e 20 6e 5b 69 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6f 3d 6e 5b 69 5d 3d 7b 69 3a 69 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 69 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 74 29 2c 6f 2e 6c 3d 21 30 2c 6f 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 6e 3d 7b 7d 3b 72 65 74 75 72 6e 20 74 2e 6d 3d 65 2c 74 2e 63 3d 6e 2c 74 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 74 2e 6f 28 65 2c 6e 29 7c 7c 4f 62 6a 65 63 74 [TRUNCATED] Data Ascii: /* ACKNOWLEDGEMENTS:*** https://appleid.cdn-apple.com/appleauth/static/jsapi/acknowledgements.txt* */window.idmsapis=function(e){function t(i){if(n[i])return n[i].exports;var o=n[i]={i:i,l:!1,exports:{}};return e[i].call(o.exports,o,o.exports,t),o.l=!0,o.exports}var n={};return t.m=e,t.c=n,t.d=function(e,n,i){t.o(e,n)\|\|Object.defineProperty(e,n,{enumerable:!0,get:i})},t.r=function(e){'undefined'!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:'Module'}),Object.defineProperty(e,'__esModule',{value:!0})},t.t=function(e,n){if(1&n&&(e=t(e)),8&n)return e;if(4&n&&'object'==typeof e&&e&&e.__esModule)return e;var i=Object.create(null);if(t.r(i),Object.defineProperty(i,'default',{enumerable:!0,value:e}),2&n&&'string'!=typeof e)for(var o in e)t.d(i,o,function(t){return e[t]}.bind(null,o));return i},t.n=function(e){var n=e&&e.__esModule?function(){return e['default']}:function(){return e};return t.d(n,'a',n),n},t.o=function(e,t){return
Sep 1, 2024 00:46:26.499582052 CEST	1236	IN	Data Raw: 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 65 2c 74 29 7d 2c 74 2e 70 3d 27 27 2c 74 28 74 2e 73 3d 35 39 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 41 Data Ascii: Object.prototype.hasOwnProperty.call(e,t)},t.p='',t(t.s=59)}([function(e){var t=Array.isArray;e.exports=t},function(e,t,n){var i=n(9),o=i(Object,'create');e.exports=o},function(e,t,n){var i=n(41);e.exports=function(e,t){for(var n=e.length;n--
Sep 1, 2024 00:46:26.499592066 CEST	1236	IN	Data Raw: 6e 63 74 69 6f 6e 27 3d 3d 74 79 70 65 6f 66 20 69 3f 69 2e 63 61 6c 6c 28 74 2c 6e 2c 74 2c 65 29 3a 69 2c 21 28 6f 21 3d 3d 76 6f 69 64 20 30 26 26 28 65 2e 65 78 70 6f 72 74 73 3d 6f 29 29 29 7d 29 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: nction'==typeof i?i.call(t,n,t,e):i,!(o!==void 0&&(e.exports=o)))})(this,function(){'use strict';function e(e,t){var i,n=document.createElement(e\|\|'div');for(i in t)n[i]=t[i];return n}function t(e){for(var t=1,i=arguments.length;t<i;t++)e.appe
Sep 1, 2024 00:46:26.499602079 CEST	672	IN	Data Raw: 29 27 29 2c 64 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 69 6e 65 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 64 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 72 65 74 75 72 6e 20 61 28 6e 28 27 67 72 6f 75 70 27 2c 7b 63 6f 6f 72 64 73 69 7a 65 3a 69 2b 27 Data Ascii: )'),d.prototype.lines=function(e,d){function o(){return a(n('group',{coordsize:i+' '+i,coordorigin:-l+' '+-l}),{width:i,height:i})}function c(e,i,c){t(f,t(a(o(),{rotation:360/d.lines*e+'deg',left:~~i}),t(a(n('roundrect',{arcsize:d.corners}),{w
Sep 1, 2024 00:46:26.499865055 CEST	1236	IN	Data Raw: 3d 31 3b 75 3c 3d 64 2e 6c 69 6e 65 73 3b 75 2b 2b 29 63 28 75 29 3b 72 65 74 75 72 6e 20 74 28 65 2c 66 29 7d 2c 64 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 70 61 63 69 74 79 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 69 29 7b 76 61 72 20 6f 3d Data Ascii: =1;u<=d.lines;u++)c(u);return t(e,f)},d.prototype.opacity=function(e,t,n,i){var o=e.firstChild;i=i.shadow&&i.lines\|\|0,o&&t+i<o.childNodes.length&&(o=o.childNodes[t+i],o=o&&o.firstChild,o=o&&o.firstChild,o&&(o.opacity=n))}}var c,u,l=Math.max,p=
Sep 1, 2024 00:46:26.499916077 CEST	1236	IN	Data Raw: 65 74 75 72 6e 20 61 28 65 28 29 2c 7b 70 6f 73 69 74 69 6f 6e 3a 27 61 62 73 6f 6c 75 74 65 27 2c 77 69 64 74 68 3a 64 2e 73 63 61 6c 65 2a 28 64 2e 6c 65 6e 67 74 68 2b 64 2e 77 69 64 74 68 29 2b 27 70 78 27 2c 68 65 69 67 68 74 3a 64 2e 73 63 Data Ascii: eturn a(e(),{position:'absolute',width:d.scale(d.length+d.width)+'px',height:d.scaled.width+'px',background:t,boxShadow:n,transformOrigin:'left',transform:'rotate('+~~(360/d.linesl+d.rotate)+'deg) translate('+d.scaled.radius+'px,0)',border
Sep 1, 2024 00:46:26.642329931 CEST	444	OUT	GET /icloud-archivos/e6ffc52737977fe1700d423a10874d0b.png HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://lphone-security.info/icloud2022-esp.php/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:26.844254971 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:26 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 709570 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: image/png Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 00 00 00 02 d2 08 06 00 00 01 ad de f5 0a 00 00 01 75 69 43 43 50 6b 43 47 43 6f 6c 6f 72 53 70 61 63 65 44 69 73 70 6c 61 79 50 33 00 00 28 91 75 90 bd 4b c3 50 14 c5 4f ab 52 d0 3a 88 0e 1d 1c 32 89 43 d4 d2 0a 76 71 68 2b 14 45 30 54 05 ab 53 9a 7e 09 6d 7c 24 29 52 71 13 57 29 f8 1f 58 c1 59 70 b0 88 54 70 71 70 10 44 07 11 dd 9c 3a 29 b8 68 78 de 97 54 da 22 de c7 e5 fd 38 9c 73 b9 5c c0 1b 50 19 2b f6 02 28 e9 96 91 4c c4 a4 b5 d4 ba e4 7b 83 87 9e 53 aa 66 b2 a8 a2 2c 0a fe fd bb eb f3 d1 f5 de 4f 88 59 4d bb 76 10 d9 4f 5c 97 ce 2e 97 76 9e 02 53 7f fd 5d d5 9f c9 9a 1a fd df d4 41 8d 19 16 e0 91 89 95 6d 8b 09 de 25 1e 31 68 29 e2 aa e0 bc cb c7 82 d3 2e 9f 3b 9e 95 64 9c f8 96 58 d2 0a 6a 86 b8 49 2c a7 3b f4 7c 07 97 8a 65 ad b5 83 d8 de 9f d5 57 97 c5 1c ea 51 cc 61 13 26 18 8a 50 51 81 04 05 e1 7f fc d3 8e 3f 8e 2d 72 57 60 50 2e 8f 02 2c ca 44 49 11 13 b2 c4 f3 d0 a1 61 12 32 71 08 41 ea 90 b8 73 eb 7e 0f ad fb c9 6d 6d ef 15 98 [TRUNCATED] Data Ascii: PNGIHDRuiCCPkCGColorSpaceDisplayP3(uKPOR:2Cvqh+E0TS~m\|$)RqW)XYpTpqpD:)hxT"8s\P+(L{Sf,OYMvO\.vS]Am%1h).;dXjI,;\|eWQa&PQ?-rW`P.,DIa2qAs~mmmp/B8xnL5TGr0(a!w{{cv#+)jSA8eXIfMMi?a@IDATxU?~53YfK `!( O]IS"E@$ @B>w[]U=3I>93us=u9w4~_uVII>~k7v&~qLmrRi\|_4x1\|Hlh&LD+G7Ch<QA:S;!YBMK51ONSMoe<}(twgg_z(47(YGC^?kjr0Si~;7p0wY-}?}S2O#0zJ+4^.}:gGdkxwo2lC=)3yU4cezpAljx+t]vDy$Y3@}/u(HbAKp(Wfej*

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 00:46:26.297885895 CEST	370	OUT	GET /icloud-archivos/main.css HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://lphone-security.info/icloud2022-esp.php/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:26.505812883 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:26 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 717690 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/css Data Raw: 2a 7b 70 61 64 64 69 6e 67 3a 30 7d 2e 63 77 2d 68 69 64 64 65 6e 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 62 75 74 74 6f 6e 2e 75 6e 73 74 79 6c 65 64 2d 62 75 74 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 62 6f 72 64 65 72 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 69 6e 6c 69 6e 65 2d 73 69 7a 65 3a 2d 77 65 62 6b 69 74 2d 66 69 74 2d 63 6f 6e 74 65 6e 74 3b 69 6e 6c 69 6e 65 2d 73 69 7a 65 3a 2d 6d 6f 7a 2d 66 69 74 2d 63 6f 6e 74 65 6e 74 3b 69 6e 6c 69 6e 65 2d 73 69 7a 65 3a 66 69 74 2d 63 6f 6e 74 65 6e 74 7d 5b 64 69 72 3d 6c 74 72 5d 20 62 75 74 74 6f 6e 2e 75 6e 73 74 79 6c 65 64 2d 62 75 74 74 6f 6e 2c 62 75 74 74 6f 6e 2e 75 6e 73 74 79 6c 65 64 2d 62 75 74 74 6f 6e 5b 64 69 72 3d 6c 74 72 5d 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 77 69 64 74 68 3a 2d 77 65 62 6b 69 74 2d 66 69 74 2d 63 6f 6e 74 65 6e 74 3b 77 69 64 74 68 3a 2d 6d 6f 7a 2d [TRUNCATED] Data Ascii: *{padding:0}.cw-hidden{display:none!important}button.unstyled-button{background:none;color:inherit;border:0;padding:0;text-align:start;inline-size:-webkit-fit-content;inline-size:-moz-fit-content;inline-size:fit-content}[dir=ltr] button.unstyled-button,button.unstyled-button[dir=ltr]{text-align:left;width:-webkit-fit-content;width:-moz-fit-content;width:fit-content}[dir=rtl] button.unstyled-button,button.unstyled-button[dir=rtl]{text-align:right;width:-webkit-fit-content;width:-moz-fit-content;width:fit-content}button.unstyled-button:not([disabled]){cursor:pointer}ol.unstyled-list,ul.unstyled-list{list-style:none;-webkit-margin-start:0;margin-inline-start:0;-webkit-padding-start:0;padding-inline-start:0}[dir=ltr] ol.unstyled-list,[dir=ltr] ul.unstyled-list,ol.unstyled-list[dir=ltr],ul.unstyled-list[dir=ltr]{margin-left:0;padding-left:0}[dir=rtl] ol.unstyled-list,[dir=rtl] ul.unstyled-list,ol.unstyled-list[dir=rtl],ul.unstyled-list[dir=rtl]{margin-right:0;padding-right:0}a.unsty
Sep 1, 2024 00:46:26.505822897 CEST	224	IN	Data Raw: 6c 65 64 2d 6c 69 6e 6b 2c 61 2e 75 6e 73 74 79 6c 65 64 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 61 2e 75 6e 73 74 79 6c 65 64 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 3a 68 6f 76 65 72 2c 61 2e 75 6e 73 74 79 6c 65 64 2d 6c 69 6e 6b 3a 66 6f 63 75 73 Data Ascii: led-link,a.unstyled-link:active,a.unstyled-link:active:hover,a.unstyled-link:focus,a.unstyled-link:hover,a.unstyled-link:visited{color:inherit;text-decoration:none}ui-button.pill{display:-webkit-box;display:-webkit-flex;disp
Sep 1, 2024 00:46:26.505832911 CEST	1236	IN	Data Raw: 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d Data Ascii: lay:-ms-flexbox;display:flex;-webkit-box-align:center;-webkit-align-items:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-webkit-justify-content:center;-ms-flex-pack:center;justify-content:center;text-align:center;whit
Sep 1, 2024 00:46:26.505845070 CEST	1236	IN	Data Raw: 6f 75 6e 64 3a 22 22 7d 75 69 2d 62 75 74 74 6f 6e 2e 73 65 63 6f 6e 64 61 72 79 2e 70 69 6c 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 38 65 38 65 64 3b 63 6f 6c 6f 72 3a 23 30 30 30 7d 75 69 2d 62 75 74 74 6f 6e 2e 73 65 63 Data Ascii: ound:""}ui-button.secondary.pill{background-color:#e8e8ed;color:#000}ui-button.secondary.pill:hover:not(:active):not(:disabled):not([aria-disabled=true]):not(.disabled){background-color:#ebebf0}ui-button.secondary.pill.active:not([aria-disable
Sep 1, 2024 00:46:26.505855083 CEST	1236	IN	Data Raw: 74 74 6f 6e 2e 70 72 69 6d 61 72 79 2e 62 6c 6f 63 6b 3a 68 6f 76 65 72 3a 6e 6f 74 28 3a 61 63 74 69 76 65 29 3a 6e 6f 74 28 3a 64 69 73 61 62 6c 65 64 29 3a 6e 6f 74 28 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 29 3a 6e 6f 74 Data Ascii: tton.primary.block:hover:not(:active):not(:disabled):not([aria-disabled=true]):not(.disabled){background-color:#0077ed}ui-button.primary.block.active:not([aria-disabled=true]):not(.disabled),ui-button.primary.block:active:hover:not([aria-disab
Sep 1, 2024 00:46:26.505867958 CEST	1236	IN	Data Raw: 2d 73 69 7a 65 3a 33 34 35 70 78 7d 2e 61 70 70 6c 69 63 61 74 69 6f 6e 2d 63 6f 6e 74 65 6e 74 5b 64 69 72 3d 6c 74 72 5d 2c 2e 61 70 70 6c 69 63 61 74 69 6f 6e 2d 63 6f 6e 74 65 6e 74 5b 64 69 72 3d 72 74 6c 5d 2c 5b 64 69 72 3d 6c 74 72 5d 20 Data Ascii: -size:345px}.application-content[dir=ltr],.application-content[dir=rtl],[dir=ltr] .application-content,[dir=rtl] .application-content{margin-left:auto;margin-right:auto;width:345px}@media (min-width:760px) and (max-width:1164px){.application-c
Sep 1, 2024 00:46:26.505878925 CEST	896	IN	Data Raw: 79 3a 30 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 2e 66 61 64 65 2d 6f 75 74 2c 2e 68 6f 6d 65 70 61 67 65 2d 76 69 65 77 70 6f 72 74 2e 66 61 64 65 2d 6f 75 74 2c 2e 72 6f 6f 74 2d 63 6f 6d 70 6f 6e 65 6e 74 20 69 66 72 61 6d 65 2e 63 68 69 Data Ascii: y:0}to{opacity:1}}.fade-out,.homepage-viewport.fade-out,.root-component iframe.child-application.fade-out{-webkit-animation:fade-out .25s ease-in-out;animation:fade-out .25s ease-in-out;-webkit-animation-fill-mode:none;animation-fill-mode:none
Sep 1, 2024 00:46:26.505889893 CEST	892	IN	Data Raw: 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d Data Ascii: s-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-webkit-align-items:center;-ms-flex-align:center;align-items:center;-webkit-box-orient:vertical;
Sep 1, 2024 00:46:26.505901098 CEST	1236	IN	Data Raw: 6b 69 74 2d 66 6c 65 78 3a 30 20 31 20 61 75 74 6f 3b 2d 6d 73 2d 66 6c 65 78 3a 30 20 31 20 61 75 74 6f 3b 66 6c 65 78 3a 30 20 31 20 61 75 74 6f 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 6d 61 72 67 69 6e 3a 32 30 70 78 3b 6f 76 Data Ascii: kit-flex:0 1 auto;-ms-flex:0 1 auto;flex:0 1 auto;border-radius:8px;margin:20px;overflow:hidden;outline:none;background:#fff;-webkit-box-shadow:0 0 15px rgba(0,0,0,.15),0 0 1px 1px rgba(0,0,0,.1);box-shadow:0 0 15px rgba(0,0,0,.15),0 0 1px 1px
Sep 1, 2024 00:46:26.505917072 CEST	224	IN	Data Raw: 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 6c 61 6e 64 73 63 61 70 65 29 7b 2e 63 72 61 73 68 2d 6d 6f 64 61 6c 2d 76 69 65 77 20 2e 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d Data Ascii: @media only screen and (orientation:landscape){.crash-modal-view .main-container{max-block-size:-webkit-calc(100vh - 160px);max-block-size:calc(100vh - 160px)}.crash-modal-view[dir=ltr] .main-container,.crash-modal-view[dir=
Sep 1, 2024 00:46:26.510790110 CEST	1236	IN	Data Raw: 72 74 6c 5d 20 2e 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 2c 5b 64 69 72 3d 6c 74 72 5d 20 2e 63 72 61 73 68 2d 6d 6f 64 61 6c 2d 76 69 65 77 20 2e 6d 61 69 6e 2d 63 6f 6e 74 61 69 6e 65 72 2c 5b 64 69 72 3d 72 74 6c 5d 20 2e 63 72 61 73 68 2d Data Ascii: rtl] .main-container,[dir=ltr] .crash-modal-view .main-container,[dir=rtl] .crash-modal-view .main-container{max-height:-webkit-calc(100vh - 160px);max-height:calc(100vh - 160px)}}.crash-modal-view .button-container{display:-webkit-box;display

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 00:46:26.382632971 CEST	418	OUT	GET /icloud-archivos/fpo@1x.gif HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://lphone-security.info/icloud2022-esp.php/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:27.042254925 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:26 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 3465938 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/gif Data Raw: 47 49 46 38 39 61 ae 01 84 01 f7 00 00 11 7d eb 26 7c e1 25 78 de 50 96 ba 6f a9 bb 76 c6 b6 38 96 d8 2f 8f d6 33 a7 d7 09 95 ed 18 97 eb 01 85 fb 0a 84 fb 03 8b fc 0a 8e fd 09 88 f6 12 8d f9 13 86 f6 01 95 f6 0a 94 f5 00 9b f6 0b 9b f3 02 95 fa 0c 92 fd 03 9c fa 0b 9c fc 13 95 fe 19 96 fe 15 9a fd 1d 9c fe 17 9a f3 14 89 e8 28 9a e9 22 9d fd 25 97 f9 2f 91 ed 08 b9 ed 01 a3 f5 09 a4 f5 01 ac f5 02 a3 f9 0b a4 fb 03 ac fb 0b ad fe 0a aa f6 13 a4 fd 1d a3 fe 14 ad fd 1b ab fd 18 aa f5 01 b3 f6 0a b6 f3 02 ba f6 0b bb f6 03 b4 fb 0a b2 fe 03 bb fa 0b bc fc 14 bb f5 1c bc f5 13 b2 fd 1b b3 fd 13 bc fc 1c bd fd 15 b4 f6 1c a6 ec 22 a4 fe 23 aa fd 29 ab ff 29 a3 f6 24 bc f5 2b be f5 21 b3 fc 23 bd fd 2a bf fd 33 bd f9 35 ab ec 16 9c db 4c 96 d7 51 a5 d3 70 b4 d3 48 9b e9 57 b6 fd 4d ae f5 64 b7 fc 72 b6 eb 67 99 ca 02 c2 f6 0c c1 f6 02 c3 fc 0b c3 fb 05 c9 fd 0b c9 fd 0c cc f4 13 c4 f6 1c c5 f5 1b ca f6 13 c5 fb 1b c5 fc 13 c9 fd 1c cb fd 13 c9 f5 1b d2 f6 1b d3 fa 18 d3 fb 16 c8 ed 36 c6 e8 25 c1 f4 2b [TRUNCATED] Data Ascii: GIF89a}&\|%xPov8/3("%/"#))$+!#35LQpHWMdrg6%+#+#,#,3<4;4<6$,(43<:%<vIWAJDIDLET[WDDKK]T]Xycgvjldkeleu\|s\|qt{{pzrT+!NETSCAPE2.0!,H\#JH3j CI(S\0cI8s@JH*]PJJXj`Kh]pKxL+^#KL
Sep 1, 2024 00:46:27.042270899 CEST	1236	IN	Data Raw: cb 98 33 6b de cc b9 b3 e7 cf a0 43 8b 1e 4d ba b4 e9 d3 a8 53 ab 5e cd ba b5 eb d7 b0 63 cb 9e 4d bb b6 ed db b8 73 eb de cd bb b7 ef df c0 83 0b 1f 4e bc b8 f1 e3 c8 93 2b 5f ce bc b9 f3 e7 d0 a3 4b 9f 4e bd ba f5 eb d8 b3 6b df ce bd bb f7 ef Data Ascii: 3kCMS^cMsN+_KNkO_O(>X==BX*h>f`R= <$h!`C#"2<xb_)0(5(v!Ps;0 p8C
Sep 1, 2024 00:46:27.042303085 CEST	448	IN	Data Raw: eb f8 c7 14 6a 5a 03 9d b6 d3 9d 37 45 63 1a 39 e9 53 b8 d9 2e 9f 43 0b e5 33 3f 6a d4 68 1e 15 95 f3 5b 2a 49 2f 70 81 5e 6d c3 a0 56 bc 22 2e c9 39 10 26 e1 43 1e e7 38 c6 12 96 a0 03 1d 54 12 a7 5f a5 a8 3c 7d 5a cf f7 a5 15 a8 45 4b 57 51 8d Data Ascii: jZ7Ec9S.C3?jh[I/p^mV".9&C8T_<}ZEKWQiJ@)Y.k"yPX[&9cz5nh&[Y^KhyCTjj\yXv_YmQQb joSiq@;u"Ku]j7 r]W
Sep 1, 2024 00:46:27.042313099 CEST	1236	IN	Data Raw: 65 3d ef 19 84 12 68 ea 04 0e 20 05 90 4d 8d 75 06 39 92 b3 a4 0a 21 74 98 03 14 84 a0 83 87 e7 70 84 10 a3 b9 c8 6e e6 29 59 67 1b 67 21 ba ef 5c 74 e6 74 65 f1 18 63 cc 52 f9 8e a1 9e c0 05 00 ed 5e 07 25 4b 45 38 5a b5 84 18 34 32 74 cc 82 10 Data Ascii: e=h Mu9!tpn)Ygg!\ttecR^%KE8Z42ttmfZ-{4RQr~zvl7Q\|#ZF&w=q6],w1O&'<$}c@Ug=m\}dp8$NRp26
Sep 1, 2024 00:46:27.042325020 CEST	1236	IN	Data Raw: 50 9b 4a a9 08 f2 99 8b 88 29 95 6c d0 9b 45 f6 9b 15 45 87 18 89 82 92 b9 73 e7 36 71 51 68 71 ca c9 80 63 39 8f f7 d3 04 20 40 0d e9 40 48 cf 51 0f c6 22 75 a6 f7 0c ce 00 0c a6 00 97 39 c9 09 a0 80 97 a2 d0 09 1e ea a1 19 ca a1 79 e9 93 e6 69 Data Ascii: PJ)lEEs6qQhqc9 @@HQ"u9yip0k~9xi)D3Y.{l?Jc@/cXi q;VJI%Z'pk`wf9;G3CJJpI~ 3wI
Sep 1, 2024 00:46:27.042356014 CEST	1236	IN	Data Raw: 23 e6 68 e9 2c c8 62 25 41 39 63 c5 38 37 3c fc dc 73 f0 e8 cf 30 78 a0 54 ff d6 54 4b 80 0e 58 f2 a7 b0 11 a8 e2 50 0c 84 ba d0 93 db d0 2b 6b a5 1f 6a ac ad d9 ca 17 bd c0 19 7d 07 71 20 06 e7 7c 05 1e 7d 64 21 3d d2 25 7d bd 47 56 cf b1 85 cf Data Ascii: #h,b%A9c87<s0xTTKXP+kj}q \|}d!=%}GVdk/{`GC@B4%{pd0OM8uX"f$OI>=0\ts_[Wp-C7)z{ W=i^f5PW
Sep 1, 2024 00:46:27.042367935 CEST	1236	IN	Data Raw: 6d dc c5 2b e3 c4 09 19 7d f7 fe 55 a1 e2 ef 89 c0 85 05 ef 2d 8c 22 31 0a c6 8d 1d 3f 86 8c 42 e1 41 81 14 06 4e c6 ac 10 e2 66 87 05 31 54 b4 88 d1 02 c5 0a 1e cc a1 83 99 5a f5 6a d6 ad 5d bf 56 47 cb 26 ff aa 52 3a 75 f6 f4 f9 53 e8 50 a3 47 Data Ascii: m+}U-"1?BANf1TZj]VG&R:uSPG.MJWbHv\q:};X<aU(^Y}/p!gEP5s0@Knm7v8QJ(+9Do<Cc/
Sep 1, 2024 00:46:27.042377949 CEST	1236	IN	Data Raw: e0 93 96 b5 d4 a7 0a f9 69 3e 7f ea 12 7e 00 8d 44 52 f1 28 89 45 24 e2 a0 60 00 43 33 c3 f0 d0 42 8e c1 a1 54 75 66 c1 a2 86 30 b2 50 b4 3a 74 31 16 46 35 ea 22 8d 7a f4 a3 20 15 67 48 37 06 24 c6 b0 ed 51 69 a3 00 b7 ba 15 11 07 b6 d4 a5 d6 30 Data Ascii: i>~DR(E$`C3BTuf0P:t1F5"z gH7$Qi0G:dj{5wC+NSZuCCQxT&5xUN"UW7MYfGJ-BvAiA>fn5ZA\|`lrU3Xm471#bB6Qwxf;+V=Z
Sep 1, 2024 00:46:27.042397976 CEST	552	IN	Data Raw: c1 4c ea 2f 24 68 05 0a b2 92 37 84 43 31 93 c3 39 fc 08 2b a1 87 75 c0 43 67 38 3d 1b 44 bd ad f3 43 3e 48 a1 11 13 c4 7f f2 c1 42 34 c4 43 bc 83 44 f4 95 aa 71 8b d2 99 01 1d 70 44 32 b0 46 49 9c 44 a9 f2 8a bb c3 c4 4c d4 44 ea 70 18 47 82 40 Data Ascii: L/$h7C19+uCg8=DC>HB4CDqpD2FIDLDpG@OLn"u3ESPUl//rAvyi =F`c<e4jF^9(lkF1K\/oGr,jYMj1,<cyd300s8Tpv i(:_
Sep 1, 2024 00:46:27.042408943 CEST	1236	IN	Data Raw: bb c3 3b 8b aa 01 d1 0c 03 32 20 2f b2 ec 46 f4 34 d1 2a 24 c7 6e 32 ab 4a 32 b2 2c 54 2b 14 28 81 c7 e0 2f b8 42 88 8b 68 32 9e 3b 88 db a4 c9 54 c4 cf ed b3 47 de dc 16 28 5b 02 73 19 50 5b 2c d0 d6 b0 87 76 38 ca 62 60 3f 06 65 4a 08 9d 4a 13 Data Ascii: ;2 /F4$n2J2,T+(/Bh2;TG([sP[,v8b`?eJJ8#;H-6M!O#I3d"#{QQaQQOOP0#].{3_tRsT8GAR,,< B@9-Q5n,KqS+T<5(h\|
Sep 1, 2024 00:46:27.047244072 CEST	1236	IN	Data Raw: 35 68 90 f8 b2 54 d9 85 3d 76 ca 17 8e 61 89 d6 6a 3f 56 05 4a 78 66 da 53 5b 18 4a aa 49 d8 bf b6 c5 23 8e 1e a8 b4 ee e8 6c 1e 28 a6 0a 57 39 88 c4 90 06 60 60 29 69 4d e6 b6 db ed 46 30 65 0b 96 7e b4 69 f2 aa 66 09 53 c0 a5 e9 f0 b0 2f 9c 96 Data Ascii: 5hT=vaj?VJxfS[JI#l(W9``)iMF0e~ifS/gS&j[%DjPj)++dq\LVUG`_+VMhUb&VW8)O,O'[L/P;+,{/$gqG9&X^RneH&NNPG

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 00:46:26.389164925 CEST	444	OUT	GET /icloud-archivos/fc2b7d9c646c188a2aed32221a4fe795.jpg HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://lphone-security.info/icloud2022-esp.php/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:27.046727896 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:26 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 15202 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 3c 00 00 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 c4 00 00 00 88 76 75 65 64 00 00 03 4c 00 00 00 86 76 69 65 77 00 00 03 d4 00 00 00 24 6c 75 6d 69 00 00 03 f8 00 [TRUNCATED] Data Ascii: ExifII*Ducky<XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmddvuedLview$lumimeas$tech0rTRC<gTRC<bTRC<textCopyright (c) 1998 Hewlett-Packard CompanydescsRGB IEC61966-2.1sRGB IEC61966-2.1XYZ QXYZ XYZ o8XYZ bXYZ $descIEC http://www.iec.chIEC http://www.iec.chdesc.IEC 61966-2.1 Default RGB colour space - sRGB.IEC 61966-2.1 Default RGB colour space - sRGBdesc,Reference Viewing Condition in IEC61966-2.1,Reference Viewi
Sep 1, 2024 00:46:27.046749115 CEST	1236	IN	Data Raw: 6e 67 20 43 6f 6e 64 69 74 69 6f 6e 20 69 6e 20 49 45 43 36 31 39 36 36 2d 32 2e 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 76 69 65 77 00 00 00 00 00 13 a4 fe 00 14 5f 2e 00 10 cf 14 00 03 ed cc 00 04 13 0b Data Ascii: ng Condition in IEC61966-2.1view_.\XYZ LVPWmeassig CRT curv#(-27;@EJOTY^chmrw\|
Sep 1, 2024 00:46:27.046761036 CEST	448	IN	Data Raw: 3b e8 3c 27 3c 65 3c a4 3c e3 3d 22 3d 61 3d a1 3d e0 3e 20 3e 60 3e a0 3e e0 3f 21 3f 61 3f a2 3f e2 40 23 40 64 40 a6 40 e7 41 29 41 6a 41 ac 41 ee 42 30 42 72 42 b5 42 f7 43 3a 43 7d 43 c0 44 03 44 47 44 8a 44 ce 45 12 45 55 45 9a 45 de 46 22 Data Ascii: ;<'<e<<="=a==> >`>>?!?a??@#@d@@A)AjAAB0BrBBC:C}CDDGDDEEUEEF"FgFFG5G{GHHKHHIIcIIJ7J}JKKSKKL*LrLMMJMMN%NnNOOIOOP'PqPQQPQQR1R\|RSS_SSTBTTU(UuUVV\VVWDWWX/X}XYYiYZZVZZ[E[[\5\\]']x]
Sep 1, 2024 00:46:27.046849966 CEST	1236	IN	Data Raw: 81 cd 82 30 82 92 82 f4 83 57 83 ba 84 1d 84 80 84 e3 85 47 85 ab 86 0e 86 72 86 d7 87 3b 87 9f 88 04 88 69 88 ce 89 33 89 99 89 fe 8a 64 8a ca 8b 30 8b 96 8b fc 8c 63 8c ca 8d 31 8d 98 8d ff 8e 66 8e ce 8f 36 8f 9e 90 06 90 6e 90 d6 91 3f 91 a8 Data Ascii: 0WGr;i3d0c1f6n?zM _4uL$hBd@iG&vV8nR7u\D-u`K8%
Sep 1, 2024 00:46:27.046863079 CEST	1236	IN	Data Raw: b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a Data Ascii: Wb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb
Sep 1, 2024 00:46:27.046874046 CEST	1236	IN	Data Raw: ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 a9 7e af Data Ascii: Wb]vUWb]vUWb]vUWb]vUWb]v*UWb~i:D>rDOQ\M@[FHG>svP'k7aDoxo60F\|}SuMKq(G3wMDg7F_w\s!ZpiV,8Rk{yg(y-]1F
Sep 1, 2024 00:46:27.046885967 CEST	1236	IN	Data Raw: ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a e2 40 15 3b 01 df 14 5a 83 6a 16 0a 68 d7 31 03 e0 5d 47 f1 cb 06 29 77 16 a3 a9 c6 39 ca 3f 30 ba 2b bb 59 4d 22 9a 39 Data Ascii: Wb]vUWb]vUWb]v*@;Zjh1]G)w9?0+YM"9?0G4%U6;asL>sq?%gG{g]\|8#>LaEYw8^pq0a,9&KN8Y-8RJ-RKGVVC6\oXKKKD+e>c!
Sep 1, 2024 00:46:27.046897888 CEST	1236	IN	Data Raw: 9a 0f 93 83 f7 e7 1f ed 0e 9f 87 20 c8 3f 8b ef 1f b1 ef 3d 97 d5 71 e2 38 cf 38 1d bd c7 f6 bd 1b 39 d7 a8 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 aa 77 13 a4 10 49 33 Data Ascii: ?=q889vUWb]vUWb]v*UWbwI3$jX(DkB&G`WW\I<nCS@DPxdySG8V/5M`Kv76VmSj~~}#aJ-jy57%b )ZFKd-8RR,
Sep 1, 2024 00:46:27.046911001 CEST	552	IN	Data Raw: cb 40 d7 d3 fd 02 e2 93 8f b5 6b 2d 12 61 fe c6 a6 a3 dd 49 19 ce 6a fb 3f 2e 03 eb 1b 77 8e 4f 61 a1 ed 4c 1a 91 e8 3b f7 1e 7f 8f 72 77 98 4e c5 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a 92 6a da a9 25 Data Ascii: @k-aIj?.wOaL;rwNWb]vUWb]vj%m#3p`]FY~RNp)&?fZ} f]n>\|K\KLExLq-i8:UAfL}GltA%`hy N-.tm*>1'0fKYLs2c;XX
Sep 1, 2024 00:46:27.046924114 CEST	1236	IN	Data Raw: 80 f7 84 a6 99 94 ea 1b 46 64 60 cb b1 1d 31 22 d9 46 66 26 c2 3f d7 12 45 cc 6d e2 3c 0e 51 c3 46 9d 87 8a 25 1b 40 39 ab 13 97 87 5c 4d 95 87 24 ab 4e 14 ac 38 59 2d 38 52 b4 8c 29 5a 46 16 4b 4e 14 ad 23 0a 56 91 85 2b 4e 16 4b 0e 14 ac 6d f2 Data Ascii: Fd`1"Ff&?Em<QF%@9\M$N8Y-8R)ZFKN#V+NKmL0ZF)ZF,+HbNr1I1Bu\\Bdejs&;'ot{cDz_avF,y{g]v*UWb]Y</+9(01
Sep 1, 2024 00:46:27.051748037 CEST	1236	IN	Data Raw: ca f7 ea 3e 79 6c 0d 17 13 38 e2 14 91 39 62 c7 97 51 db 33 c3 ce 48 92 77 58 70 a1 69 c2 96 8e 2a b7 0a 5a 38 52 b4 e1 4a d3 85 2d 1c 52 d1 c2 95 87 0a 56 9c 2c 96 9c 29 5a 46 16 4b 08 c9 25 69 c5 2d 11 85 2b 48 c2 95 a4 61 4b 44 62 94 65 8c 3c Data Ascii: >yl89bQ3HwXpiZ8RJ-RV,)ZFK%i-+HaKDbe<AGaC+sBdT$JMHy``b+H.J^A$`xRA!?SvN^;;vUWb]lg<xUUP,JrLJrASceMH5
Sep 1, 2024 00:46:27.158405066 CEST	421	OUT	GET /icloud-archivos/applenew2.png HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://lphone-security.info/icloud2022-esp.php/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:27.360769033 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:27 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 43453 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: image/png Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 5e 00 00 01 4d 08 06 00 00 00 48 69 07 2f 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 26 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 30 20 37 39 2e 31 36 30 34 35 31 2c 20 32 30 31 37 2f 30 35 2f 30 36 2d 30 31 3a 30 38 3a 32 31 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDR^MHi/tEXtSoftwareAdobe ImageReadyqe<&iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 Macintosh" xmpMM:InstanceID="xmp.iid:42E7546F3C3611EC91678B866C151C0E" xmpMM:DocumentID="xmp.did:42E754703C3611EC91678B866C151C0E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:42E7546D3C3611EC91678B866C151C0E" stRef:documentID="xmp.did:42E7546E3C3611EC91678B866C151C0E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>K31-IDATx}@U9{("(.Zf6YS6f3olujk)4l1G3DWDADYd;bd)\|

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://lphone-security.info/icloud2022-esp.php/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 233

Chrome Cache Entry: 234

Chrome Cache Entry: 235

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 240

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 243

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 249

Chrome Cache Entry: 250

Chrome Cache Entry: 251

Windows Analysis Report
http://lphone-security.info/icloud2022-esp.php/

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 00:46:26.648507118 CEST	444	OUT	GET /icloud-archivos/cb89b6112cb1d8e18fac821612c25717.png HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://lphone-security.info/icloud2022-esp.php/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:27.307955027 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:27 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 496147 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/png Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 2c 00 00 03 b6 08 06 00 00 01 95 c1 e9 6d 00 00 01 75 69 43 43 50 6b 43 47 43 6f 6c 6f 72 53 70 61 63 65 44 69 73 70 6c 61 79 50 33 00 00 28 91 75 90 bd 4b c3 50 14 c5 4f ab 52 d0 3a 88 0e 1d 1c 32 89 43 d4 d2 0a 76 71 68 2b 14 45 30 54 05 ab 53 9a 7e 09 6d 7c 24 29 52 71 13 57 29 f8 1f 58 c1 59 70 b0 88 54 70 71 70 10 44 07 11 dd 9c 3a 29 b8 68 78 de 97 54 da 22 de c7 e5 fd 38 9c 73 b9 5c c0 1b 50 19 2b f6 02 28 e9 96 91 4c c4 a4 b5 d4 ba e4 7b 83 87 9e 53 aa 66 b2 a8 a2 2c 0a fe fd bb eb f3 d1 f5 de 4f 88 59 4d bb 76 10 d9 4f 5c 97 ce 2e 97 76 9e 02 53 7f fd 5d d5 9f c9 9a 1a fd df d4 41 8d 19 16 e0 91 89 95 6d 8b 09 de 25 1e 31 68 29 e2 aa e0 bc cb c7 82 d3 2e 9f 3b 9e 95 64 9c f8 96 58 d2 0a 6a 86 b8 49 2c a7 3b f4 7c 07 97 8a 65 ad b5 83 d8 de 9f d5 57 97 c5 1c ea 51 cc 61 13 26 18 8a 50 51 81 04 05 e1 7f fc d3 8e 3f 8e 2d 72 57 60 50 2e 8f 02 2c ca 44 49 11 13 b2 c4 f3 d0 a1 61 12 32 71 08 41 ea 90 b8 73 eb 7e 0f ad fb c9 6d 6d ef 15 98 [TRUNCATED] Data Ascii: PNGIHDR,muiCCPkCGColorSpaceDisplayP3(uKPOR:2Cvqh+E0TS~m\|$)RqW)XYpTpqpD:)hxT"8s\P+(L{Sf,OYMvO\.vS]Am%1h).;dXjI,;\|eWQa&PQ?-rW`P.,DIa2qAs~mmmp/B8xnL5TGr0(a!w{{cv#+)jSA8eXIfMMi,&~a@IDATxeEu/\|M44"8DcPYDq2b= $/DMdj&M%(M7=>uso{UjUv)gFy*jB,J2I=xh}oHRCkX?Ek\1`h $WKj8U?6BO]>N.ui6F@&XD[X>cF2(5SVyR'MHvI-)0(BZ5ARG~Fjc$#rBz&=N"}#?djkQHy@Vumc_!vQ-CV=z<J$]bZB}&^%Z@nX
Sep 1, 2024 00:46:27.307974100 CEST	1236	IN	Data Raw: 02 af dd ac 9a 71 ba 89 3e 30 20 c5 fe 83 a4 ba 98 26 49 59 ab e8 7d 76 b3 06 42 2d 89 a5 9e ec f0 0e 19 6f e4 62 40 0c 6e 69 55 94 71 a0 76 11 7d 78 58 c6 b3 0f 49 df cb ae 92 0a c7 9f 28 5f d7 cf e0 83 ea 6b 36 cc 72 76 99 96 bc 05 5a f2 60 68 Data Ascii: q>0 &IY}vB-ob@niUqv}xXI(_k6rvZ`htkf*"ypC.Fzv(7t_WEPr](fLmH4\ZQzLkL@GzGY<(#BrE
Sep 1, 2024 00:46:27.307986975 CEST	1236	IN	Data Raw: 01 3d 05 50 a2 7c 0d 68 cb 46 16 bc 08 50 87 47 32 c4 65 5a 2f 55 86 e6 44 90 ee a9 a1 c3 1b d2 23 00 33 dc ae 65 48 cf e5 e5 57 d8 ed 92 a5 22 61 db 59 1d cd 95 bd 60 1a 93 6b 94 28 54 26 5b 94 02 27 21 1c c3 19 10 c3 51 8c 81 67 9a 74 24 23 57 Data Ascii: =P\|hFPG2eZ/UD#3eHW"aY`k(T&['!Qgt$#WdTcbjjR#'vFU}UI.s N:'F^nA\|Xd"y;:(L\(I+\jy5/X3u@}5%wJVW
Sep 1, 2024 00:46:27.308099985 CEST	672	IN	Data Raw: 89 e6 ec 2f 36 2a 88 5f 24 e5 b4 7f 6e 0c 9d 76 75 63 e7 6d 1f 48 1d 06 6f b4 d7 32 4c b5 e1 03 69 e1 45 60 2a cc d9 4d db c5 30 bb 98 1b c2 29 73 a8 55 10 da 62 48 8f 8c 77 b7 84 79 e2 5f 9c 02 47 48 87 bb a5 3e 22 26 de 91 44 f7 e9 e3 51 23 7f Data Ascii: /6_$nvucmHo2LiE`M0)sUbHwy_GH>"&DQ#OqoK-ti?gg7+pn'HV2LYn^NZ'NXiSfr}k8/S\RH&%OU[e&~Hn@<!'LNeTs
Sep 1, 2024 00:46:27.308111906 CEST	1236	IN	Data Raw: f2 6a c5 87 82 b2 11 02 ba d6 37 fd 08 6f 01 87 31 60 f4 c0 1d b2 8a bb 27 a6 77 c3 0b cc ed 99 eb a4 26 2e 67 98 27 dd 69 0c 35 08 3e 0d a7 3c a1 31 3f 6c 3a 99 d9 ad ef 0d 23 38 f7 5b be e4 d2 4f 10 26 48 3f 31 15 42 02 ba f1 4f 8c 37 45 a0 69 Data Ascii: j7o1`'w&.g'i5><1?l:#8[O&H?1BO7EiKoy2OAy?P(1~M*-i%z4?g.7+){\3aqB`78}}40Sx33<W-W?kidrbo6K4
Sep 1, 2024 00:46:27.308126926 CEST	1236	IN	Data Raw: b0 d5 1f a7 53 e3 31 b1 69 be 38 3d 96 7e 78 37 16 fd 39 b6 44 b8 be f8 8b b4 2c 1b 59 ec b5 01 1f cb 8e bc 94 67 3b c6 96 e7 0c f2 8f 40 f9 77 c8 c4 67 18 4d 84 3c 3f 86 47 6d c6 30 d4 8f 9a 39 a4 f3 fb 49 03 32 bd 8f ac 4e 00 a6 0a f9 90 64 fa Data Ascii: S1i8=~x79D,Yg;@wgM<?Gm09I2NdVi8oC .8a;FidVas%xV\|W8'Q\QiM`fFyB$lqLI(>O\|8n;)`fa{&^'[(/i-
Sep 1, 2024 00:46:27.308137894 CEST	1236	IN	Data Raw: 45 dd bf dc e5 0b 18 69 a3 58 81 ad 80 49 74 eb a6 c9 fe ce 4b 9b 95 c5 34 b7 5c ec 32 e5 09 15 f4 33 bd 19 fa 69 2c 9c 5a 8d 13 1d d3 70 ef 07 18 fb 30 39 ea ef 41 1c 00 96 e3 cd ad bf 49 cb b6 47 71 79 fb 69 d8 43 c3 d8 4b 49 de 48 4f ed ca ee Data Ascii: EiXItK4\23i,Zp09AIGqyiCKIHOn^Z:6q2Ktj%'Ao2+aeEts/pgK.&m2_@nFO@03Ft0]-==Q0vkqJ
Sep 1, 2024 00:46:27.308150053 CEST	1236	IN	Data Raw: 01 4a f6 89 dc a5 ce f1 a6 ca 8f 20 ed 16 63 4c ad 6c 2a 5e 54 53 cd 48 f3 49 67 b9 6c f2 a0 b2 1a 08 10 6e f5 17 c9 43 59 13 e8 4d c9 9b 2e 2e c5 31 dd a9 5f 68 86 b5 73 29 28 11 d7 96 f9 e2 f1 a6 ca 7f 2a 7a 09 2d b3 6b 8b 4a 0e ac 61 6a 7e af Data Ascii: J cLl^TSHIglnCYM..1_hs)(z-kJaj~Tq3IX@f}\v~h+Jrm(o,APNes8xmu\c9Ow`V}E'[@#50\|8< Yr`c\|ikhef@g]V
Sep 1, 2024 00:46:27.308160067 CEST	1236	IN	Data Raw: 3d 1f 26 30 e3 79 46 5e f2 09 cd 6c d3 59 76 f2 f7 75 10 95 8b 7e 12 fc 15 95 d3 fc 21 dd cb c7 21 13 e3 25 1d 51 e3 a3 24 5b 48 a3 79 31 bb 38 ff a4 14 8c 1f e6 ef d3 87 61 e6 1e fd ad 5c 57 c0 e4 1b bb d9 75 c0 85 64 cc 24 d5 58 8f 40 bc 7f 51 Data Ascii: =&0yF^lYvu~!!%Q$[Hy18a\Wud$X@QK\|jI5a(7!Et6Av.h3s7y<!#Q,2rw-n]9ky!1'G5}x2t\|'RA
Sep 1, 2024 00:46:27.308171988 CEST	1236	IN	Data Raw: 7f d6 8a 0f 49 15 a7 e3 95 eb 19 cc e2 73 00 e9 a0 e4 31 6a cf a5 ab 92 db f6 b0 dc 84 62 df 9a aa 4a a6 9a 91 0c 66 95 e9 b5 c7 c9 05 d8 93 f0 b1 88 b7 af 17 fa 03 67 44 46 4e bf da f4 5f f2 0e 28 40 7e 78 a2 8e 9f 5a 16 b3 d7 46 9e 5f 75 97 dc Data Ascii: Is1jbJfgDFN_(@~xZF_uH~$$V(RZYJJ,5Qd_i]Y!},%fkjap`~D>MRc8!^@J{\|3q7Mp(Yk^ON
Sep 1, 2024 00:46:27.312891006 CEST	1236	IN	Data Raw: fc 08 6c f1 cf 01 fd f1 7b e5 45 1c db 03 94 1c db 77 ac 1c 5a e4 52 e1 27 f9 e1 b8 86 64 8e 39 75 e7 4d 4a 0a 95 3d d2 8b 41 7c 2f 3e ae de 73 c8 2b e5 67 36 c8 6e c7 66 ae e9 4f fc 40 5e 8c 7d 94 63 a8 8c d1 72 46 46 d7 16 64 7c 3b ba 8d f5 68 Data Ascii: l{EwZR'd9uMJ=A\|/>s+g6nfO@^}crFFd\|;h)uvqFSK_6/hgT&Dg^m\|uFuLV1LDUzpoI73[t>vc<zGRs#zhL4]

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 00:46:29.620317936 CEST	314	OUT	GET /icloud-archivos/authService.latest.min.js HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:30.300327063 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:30 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 45564 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/javascript Data Raw: 0a 2f 2a 2a 0a 2a 20 2a 2a 41 43 4b 4e 4f 57 4c 45 44 47 45 4d 45 4e 54 53 3a 2a 2a 0a 2a 20 68 74 74 70 73 3a 2f 2f 61 70 70 6c 65 69 64 2e 63 64 6e 2d 61 70 70 6c 65 2e 63 6f 6d 2f 61 70 70 6c 65 61 75 74 68 2f 73 74 61 74 69 63 2f 6a 73 61 70 69 2f 61 63 6b 6e 6f 77 6c 65 64 67 65 6d 65 6e 74 73 2e 74 78 74 0a 2a 20 0a 2a 2f 0a 0a 77 69 6e 64 6f 77 2e 69 64 6d 73 61 70 69 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 69 29 7b 69 66 28 6e 5b 69 5d 29 72 65 74 75 72 6e 20 6e 5b 69 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6f 3d 6e 5b 69 5d 3d 7b 69 3a 69 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 69 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 74 29 2c 6f 2e 6c 3d 21 30 2c 6f 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 6e 3d 7b 7d 3b 72 65 74 75 72 6e 20 74 2e 6d 3d 65 2c 74 2e 63 3d 6e 2c 74 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 74 2e 6f 28 65 2c 6e 29 7c 7c 4f 62 6a 65 63 74 [TRUNCATED] Data Ascii: /* ACKNOWLEDGEMENTS:*** https://appleid.cdn-apple.com/appleauth/static/jsapi/acknowledgements.txt* */window.idmsapis=function(e){function t(i){if(n[i])return n[i].exports;var o=n[i]={i:i,l:!1,exports:{}};return e[i].call(o.exports,o,o.exports,t),o.l=!0,o.exports}var n={};return t.m=e,t.c=n,t.d=function(e,n,i){t.o(e,n)\|\|Object.defineProperty(e,n,{enumerable:!0,get:i})},t.r=function(e){'undefined'!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:'Module'}),Object.defineProperty(e,'__esModule',{value:!0})},t.t=function(e,n){if(1&n&&(e=t(e)),8&n)return e;if(4&n&&'object'==typeof e&&e&&e.__esModule)return e;var i=Object.create(null);if(t.r(i),Object.defineProperty(i,'default',{enumerable:!0,value:e}),2&n&&'string'!=typeof e)for(var o in e)t.d(i,o,function(t){return e[t]}.bind(null,o));return i},t.n=function(e){var n=e&&e.__esModule?function(){return e['default']}:function(){return e};return t.d(n,'a',n),n},t.o=function(e,t){retur
Sep 1, 2024 00:46:30.300335884 CEST	224	IN	Data Raw: 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 65 2c 74 29 7d 2c 74 2e 70 3d 27 27 2c 74 28 74 2e 73 3d 35 39 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d Data Ascii: n Object.prototype.hasOwnProperty.call(e,t)},t.p='',t(t.s=59)}([function(e){var t=Array.isArray;e.exports=t},function(e,t,n){var i=n(9),o=i(Object,'create');e.exports=o},function(e,t,n){var i=n(41);e.exports=function(e,t){fo
Sep 1, 2024 00:46:30.300344944 CEST	1236	IN	Data Raw: 72 28 76 61 72 20 6e 3d 65 2e 6c 65 6e 67 74 68 3b 6e 2d 2d 3b 29 69 66 28 69 28 65 5b 6e 5d 5b 30 5d 2c 74 29 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 69 3d 6e 28 Data Ascii: r(var n=e.length;n--;)if(i(e[n][0],t))return n;return-1}},function(e,t,n){var i=n(47);e.exports=function(e,t){var n=e.__data__;return i(t)?n['string'==typeof t?'string':'hash']:n.map}},function(e,t,n){var i=n(5),o=n(8);e.exports=function(e){re
Sep 1, 2024 00:46:30.300349951 CEST	1236	IN	Data Raw: 65 6e 67 74 68 3b 74 3c 69 3b 74 2b 2b 29 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 72 67 75 6d 65 6e 74 73 5b 74 5d 29 3b 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 2c 74 2c 6e 2c 69 29 7b 76 61 72 20 6f 3d 5b 27 6f 70 61 Data Ascii: ength;t<i;t++)e.appendChild(arguments[t]);return e}function n(e,t,n,i){var o=['opacity',t,~~(100e),n,i].join('-'),a=.01+100(n/i),r=l(1-(1-e)/t*(100-a),e),s=c.substring(0,c.indexOf('Animation')).toLowerCase();return f[o]\|\|(u.insertRule('@'+(s
Sep 1, 2024 00:46:30.300359964 CEST	1236	IN	Data Raw: 63 73 69 7a 65 3a 64 2e 63 6f 72 6e 65 72 73 7d 29 2c 7b 77 69 64 74 68 3a 6c 2c 68 65 69 67 68 74 3a 64 2e 73 63 61 6c 65 2a 64 2e 77 69 64 74 68 2c 6c 65 66 74 3a 64 2e 73 63 61 6c 65 2a 64 2e 72 61 64 69 75 73 2c 74 6f 70 3a 2d 64 2e 73 63 61 Data Ascii: csize:d.corners}),{width:l,height:d.scaled.width,left:d.scaled.radius,top:-d.scaled.width>>1,filter:c}),n('fill',{color:s(d.color,e),opacity:d.opacity}),n('stroke',{opacity:0}))))}var u,l=d.scale(d.length+d.width),i=2d.scalel,p=2*(-(d.wi
Sep 1, 2024 00:46:30.300369978 CEST	1236	IN	Data Raw: 21 63 29 7b 76 61 72 20 73 2c 64 3d 30 2c 69 3d 28 72 2e 6c 69 6e 65 73 2d 31 29 2a 28 31 2d 72 2e 64 69 72 65 63 74 69 6f 6e 29 2f 32 2c 75 3d 72 2e 66 70 73 2c 70 3d 75 2f 72 2e 73 70 65 65 64 2c 66 3d 28 31 2d 72 2e 6f 70 61 63 69 74 79 29 2f Data Ascii: !c){var s,d=0,i=(r.lines-1)(1-r.direction)/2,u=r.fps,p=u/r.speed,f=(1-r.opacity)/(pr.trail/100),m=p/r.lines;(function e(){d++;for(var t=0;t<r.lines;t++)s=l(1-(d+(r.lines-t)m)%pf,r.opacity),n.opacity(o,t*r.direction+i,s,r);n.timeout=n.el&&s
Sep 1, 2024 00:46:30.300374985 CEST	896	IN	Data Raw: 63 75 6d 65 6e 74 29 7b 75 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 65 28 27 73 74 79 6c 65 27 2c 7b 74 79 70 65 3a 27 74 65 78 74 2f 63 73 73 27 7d 29 3b 72 65 74 75 72 6e 20 74 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 Data Ascii: cument){u=function(){var n=e('style',{type:'text/css'});return t(document.getElementsByTagName('head')[0],n),n.sheet\|\|n.styleSheet}();var g=a(e('group'),{behavior:'url(#default#VML)'});!i(g,'transform')&&g.adj?o():c=i(g,'animation')}return d})
Sep 1, 2024 00:46:30.300379992 CEST	1236	IN	Data Raw: 79 6d 62 6f 6c 27 3d 3d 6e 7c 7c 27 62 6f 6f 6c 65 61 6e 27 3d 3d 6e 7c 7c 6e 75 6c 6c 3d 3d 65 7c 7c 61 28 65 29 29 7c 7c 73 2e 74 65 73 74 28 65 29 7c 7c 21 72 2e 74 65 73 74 28 65 29 7c 7c 6e 75 6c 6c 21 3d 74 26 26 65 20 69 6e 20 4f 62 6a 65 Data Ascii: ymbol'==n\|\|'boolean'==n\|\|null==e\|\|a(e))\|\|s.test(e)\|\|!r.test(e)\|\|null!=t&&e in Object(t)}var o=n(0),a=n(4),r=/\.\|\[(?:[^[\]]\|(["'])(?:(?!\1)[^\\]\|\\.)?\1)\]/,s=/^\w*$/;e.exports=i},function(e,t,n){(function(t){var n='object'==typeof t&&t&&t.O
Sep 1, 2024 00:46:30.300385952 CEST	1236	IN	Data Raw: 69 6f 6e 27 21 3d 74 79 70 65 6f 66 20 74 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 61 29 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 69 3d 61 72 67 75 6d 65 6e 74 73 2c 6f 3d 74 3f 74 2e 61 70 70 6c 79 Data Ascii: ion'!=typeof t)throw new TypeError(a);var n=function(){var i=arguments,o=t?t.apply(this,i):i[0],a=n.cache;if(a.has(o))return a.get(o);var r=e.apply(this,i);return n.cache=a.set(o,r)\|\|a,r};return n.cache=new(i.Cache\|\|o),n}var o=n(24),a='Expecte
Sep 1, 2024 00:46:30.300398111 CEST	1236	IN	Data Raw: 5e 27 2b 6c 2e 63 61 6c 6c 28 70 29 2e 72 65 70 6c 61 63 65 28 73 2c 27 5c 5c 24 26 27 29 2e 72 65 70 6c 61 63 65 28 2f 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 7c 28 66 75 6e 63 74 69 6f 6e 29 2e 2a 3f 28 3f 3d 5c 5c 5c 28 29 7c 20 66 6f 72 20 Data Ascii: ^'+l.call(p).replace(s,'\\$&').replace(/hasOwnProperty\|(function).?(?=\\\()\| for .+?(?=\\\])/g,'$1.?')+'$');e.exports=function(e){if(!a(e)\|\|o(e))return!1;var t=i(e)?f:d;return t.test(r(e))}},function(e,t,n){var i=n(5),o=n(10);e.exports=funct
Sep 1, 2024 00:46:30.305301905 CEST	1236	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 5f 5f 64 61 74 61 5f 5f 3b 72 65 74 75 72 6e 20 69 3f 74 5b 65 5d 21 3d 3d 76 6f 69 64 20 30 3a 61 2e 63 61 6c 6c 28 74 2c 65 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e Data Ascii: unction(e){var t=this.__data__;return i?t[e]!==void 0:a.call(t,e)}},function(e,t,n){var i=n(1);e.exports=function(e,t){var n=this.__data__;return this.size+=this.has(e)?0:1,n[e]=i&&void 0===t?'__lodash_hash_undefined__':t,this}},function(e,t,n

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 00:46:29.767972946 CEST	325	OUT	GET /icloud-archivos/fc2b7d9c646c188a2aed32221a4fe795.jpg HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:30.447195053 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:30 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 15202 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 3c 00 00 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 c4 00 00 00 88 76 75 65 64 00 00 03 4c 00 00 00 86 76 69 65 77 00 00 03 d4 00 00 00 24 6c 75 6d 69 00 00 03 f8 00 [TRUNCATED] Data Ascii: ExifII*Ducky<XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmddvuedLview$lumimeas$tech0rTRC<gTRC<bTRC<textCopyright (c) 1998 Hewlett-Packard CompanydescsRGB IEC61966-2.1sRGB IEC61966-2.1XYZ QXYZ XYZ o8XYZ bXYZ $descIEC http://www.iec.chIEC http://www.iec.chdesc.IEC 61966-2.1 Default RGB colour space - sRGB.IEC 61966-2.1 Default RGB colour space - sRGBdesc,Reference Viewing Condition in IEC61966-2.1,Reference Viewi
Sep 1, 2024 00:46:30.447246075 CEST	1236	IN	Data Raw: 6e 67 20 43 6f 6e 64 69 74 69 6f 6e 20 69 6e 20 49 45 43 36 31 39 36 36 2d 32 2e 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 76 69 65 77 00 00 00 00 00 13 a4 fe 00 14 5f 2e 00 10 cf 14 00 03 ed cc 00 04 13 0b Data Ascii: ng Condition in IEC61966-2.1view_.\XYZ LVPWmeassig CRT curv#(-27;@EJOTY^chmrw\|
Sep 1, 2024 00:46:30.447252035 CEST	448	IN	Data Raw: 3b e8 3c 27 3c 65 3c a4 3c e3 3d 22 3d 61 3d a1 3d e0 3e 20 3e 60 3e a0 3e e0 3f 21 3f 61 3f a2 3f e2 40 23 40 64 40 a6 40 e7 41 29 41 6a 41 ac 41 ee 42 30 42 72 42 b5 42 f7 43 3a 43 7d 43 c0 44 03 44 47 44 8a 44 ce 45 12 45 55 45 9a 45 de 46 22 Data Ascii: ;<'<e<<="=a==> >`>>?!?a??@#@d@@A)AjAAB0BrBBC:C}CDDGDDEEUEEF"FgFFG5G{GHHKHHIIcIIJ7J}JKKSKKL*LrLMMJMMN%NnNOOIOOP'PqPQQPQQR1R\|RSS_SSTBTTU(UuUVV\VVWDWWX/X}XYYiYZZVZZ[E[[\5\\]']x]
Sep 1, 2024 00:46:30.447264910 CEST	1236	IN	Data Raw: 81 cd 82 30 82 92 82 f4 83 57 83 ba 84 1d 84 80 84 e3 85 47 85 ab 86 0e 86 72 86 d7 87 3b 87 9f 88 04 88 69 88 ce 89 33 89 99 89 fe 8a 64 8a ca 8b 30 8b 96 8b fc 8c 63 8c ca 8d 31 8d 98 8d ff 8e 66 8e ce 8f 36 8f 9e 90 06 90 6e 90 d6 91 3f 91 a8 Data Ascii: 0WGr;i3d0c1f6n?zM _4uL$hBd@iG&vV8nR7u\D-u`K8%
Sep 1, 2024 00:46:30.447269917 CEST	1236	IN	Data Raw: b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a Data Ascii: Wb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb
Sep 1, 2024 00:46:30.447276115 CEST	1236	IN	Data Raw: ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 a9 7e af Data Ascii: Wb]vUWb]vUWb]vUWb]vUWb]v*UWb~i:D>rDOQ\M@[FHG>svP'k7aDoxo60F\|}SuMKq(G3wMDg7F_w\s!ZpiV,8Rk{yg(y-]1F
Sep 1, 2024 00:46:30.447292089 CEST	672	IN	Data Raw: ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a e2 40 15 3b 01 df 14 5a 83 6a 16 0a 68 d7 31 03 e0 5d 47 f1 cb 06 29 77 16 a3 a9 c6 39 ca 3f 30 ba 2b bb 59 4d 22 9a 39 Data Ascii: Wb]vUWb]vUWb]v*@;Zjh1]G)w9?0+YM"9?0G4%U6;asL>sq?%gG{g]\|8#>LaEYw8^pq0a,9&KN8Y-8RJ-RKGVVC6\oXKKKD+e>c!
Sep 1, 2024 00:46:30.447298050 CEST	1236	IN	Data Raw: ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 a9 0e b7 e6 11 09 6b 6b 42 0c bd 1e 5e cb ec 3d f3 3b 4f a5 bf 54 b9 3a 6d 7f 69 70 fa 21 cf bf b9 8b 3b 33 b1 77 25 99 8d 59 8e e4 9c d9 81 4f 3d 22 49 b3 cd 61 c9 31 2b 4e 16 25 69 c2 85 Data Ascii: Wb]v*UWbkkB^=;OT:mip!;3w%YO="Ia1+N%i]N/mKe5ki=HX;F]8-O/}#51'oP263)]Nf\pFIZpXF$iad)ZqJ-)ZqJ-baWb3Qu{f
Sep 1, 2024 00:46:30.447335005 CEST	1236	IN	Data Raw: bb d0 e9 80 8d 97 91 ed 7d 69 9e 40 23 c8 06 38 f2 4d 21 ac 8e 5b e6 73 60 00 1c 9d 31 91 3c dc a9 86 d4 45 51 63 c8 92 cc 05 45 4c 8d a4 05 e1 30 5b 2a 56 49 25 5e 8c 69 e0 77 c8 90 19 89 10 89 8e e0 1d 9c 53 dc 65 66 0d d1 c9 de c4 f5 c2 1f 55 Data Ascii: }i@#8M![s`1<EQcEL0[VI%^iwSefU@fM0+K ES0Zp9&KN8R,+NKHaJ1J)hRiK4!tm(5"FA1dyxWb]vUWb]vU
Sep 1, 2024 00:46:30.447340012 CEST	1236	IN	Data Raw: 9a 42 0a 75 cb a2 5c 5c b0 42 b1 cb 1a 02 9b 1c 90 64 1e 8f f9 65 f9 8c f6 12 c5 a2 6a f2 f2 b0 73 c6 d2 e5 c9 26 16 3b 04 27 f9 0f 6f e5 f9 74 e7 7b 63 b2 44 c1 cb 8c 7a ba 8e ff 00 db f7 bd 5f 61 76 c9 c6 46 2c a7 d1 d0 f7 79 7b be e7 b3 67 1c Data Ascii: Bu\\Bdejs&;'ot{cDz_avF,y{g]vUWb]Y</+9(01FyyW5g5""g##n-b0N!ZT"VB6Z\]L(ZpZN%,`D>dFohc=9xf_8.LMX
Sep 1, 2024 00:46:30.452145100 CEST	1236	IN	Data Raw: 87 91 2b 93 05 ac c1 48 2e 4a d8 08 b3 df c9 ab ff 00 ab f9 bf ea e4 d0 5e 41 24 60 78 b2 52 41 f8 21 cd 17 b4 18 b8 b4 f7 fc d2 3f 53 d0 76 06 4e 1c f5 fc e1 fb 5e eb 9c 3b da 3b 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a ad 90 91 1b 11 d4 03 fa Data Ascii: +H.J^A$`xRA!?SvN^;;v*UWb]lg<xUUP,JrLJrASceMH5$RsD;diP%$<Fec;SD]NZ-)[+NqKXRJ0iV0iY5VZ8R}GMq$~Pf;I

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 00:46:29.770256042 CEST	325	OUT	GET /icloud-archivos/e6ffc52737977fe1700d423a10874d0b.png HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:30.430459976 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:30 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 709570 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/png Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 00 00 00 02 d2 08 06 00 00 01 ad de f5 0a 00 00 01 75 69 43 43 50 6b 43 47 43 6f 6c 6f 72 53 70 61 63 65 44 69 73 70 6c 61 79 50 33 00 00 28 91 75 90 bd 4b c3 50 14 c5 4f ab 52 d0 3a 88 0e 1d 1c 32 89 43 d4 d2 0a 76 71 68 2b 14 45 30 54 05 ab 53 9a 7e 09 6d 7c 24 29 52 71 13 57 29 f8 1f 58 c1 59 70 b0 88 54 70 71 70 10 44 07 11 dd 9c 3a 29 b8 68 78 de 97 54 da 22 de c7 e5 fd 38 9c 73 b9 5c c0 1b 50 19 2b f6 02 28 e9 96 91 4c c4 a4 b5 d4 ba e4 7b 83 87 9e 53 aa 66 b2 a8 a2 2c 0a fe fd bb eb f3 d1 f5 de 4f 88 59 4d bb 76 10 d9 4f 5c 97 ce 2e 97 76 9e 02 53 7f fd 5d d5 9f c9 9a 1a fd df d4 41 8d 19 16 e0 91 89 95 6d 8b 09 de 25 1e 31 68 29 e2 aa e0 bc cb c7 82 d3 2e 9f 3b 9e 95 64 9c f8 96 58 d2 0a 6a 86 b8 49 2c a7 3b f4 7c 07 97 8a 65 ad b5 83 d8 de 9f d5 57 97 c5 1c ea 51 cc 61 13 26 18 8a 50 51 81 04 05 e1 7f fc d3 8e 3f 8e 2d 72 57 60 50 2e 8f 02 2c ca 44 49 11 13 b2 c4 f3 d0 a1 61 12 32 71 08 41 ea 90 b8 73 eb 7e 0f ad fb c9 6d 6d ef 15 98 [TRUNCATED] Data Ascii: PNGIHDRuiCCPkCGColorSpaceDisplayP3(uKPOR:2Cvqh+E0TS~m\|$)RqW)XYpTpqpD:)hxT"8s\P+(L{Sf,OYMvO\.vS]Am%1h).;dXjI,;\|eWQa&PQ?-rW`P.,DIa2qAs~mmmp/B8xnL5TGr0(a!w{{cv#+)jSA8eXIfMMi?a@IDATxU?~53YfK `!( O]IS"E@$ @B>w[]U=3I>93us=u9w4~_uVII>~k7v&~qLmrRi\|_4x1\|Hlh&LD+G7Ch<QA:S;!YBMK51ONSMoe<}(twgg_z(47(YGC^?kjr0Si~;7p0wY-}?}S2O#0zJ+4^.}:gGdkxwo2lC=)3yU4cezpAljx+t]vDy$Y3@}/u(HbAKp(Wfej*
Sep 1, 2024 00:46:30.430526018 CEST	1236	IN	Data Raw: b3 ef af 56 99 9d 15 87 cd 81 75 ff 98 36 53 4e 9c 8c 96 6b 99 f0 9d 77 ef 08 dc 34 e7 eb c9 72 f9 06 59 1a df 1a dc 77 2f 33 89 1d 82 16 89 44 e6 56 57 57 bf 04 e2 1e 92 c8 4f 76 b1 69 ea ef 3d 1f 8b a0 ad 12 c8 0f 19 99 27 cd d4 fe 38 f9 3f 02 Data Ascii: Vu6SNkw4rYw/3DVWWOvi='8?_^id2yal4nHrVm\|/b\|J#o2\HB4I}I2Kn1._K._ MY/GFH?Ek$>G.i4OG0TZvevY23
Sep 1, 2024 00:46:30.430531979 CEST	448	IN	Data Raw: ca ba a8 b0 f3 a2 89 ce 89 54 a1 05 14 4f c5 24 34 6d 86 6c 38 e5 48 e9 9f d8 2a cc 65 f6 03 47 fd f9 21 08 22 a0 9a 9c a4 a1 99 16 e9 f7 4f 3f 41 7a a6 ef 53 c9 24 22 65 9d 50 4a 10 ac 9f a3 27 25 1a da 55 9a 9f 7c 31 02 f2 3a 14 6f 52 cd 07 f7 Data Ascii: TO$4ml8HeG!"O?AzS$"ePJ'%U\|1:oRorTnC{!Ijj&hB}]b&E]uRnoYRw5hWvZe6,[xCT0>yW\|9VzAr/="}0@`szC,lt&iXP7d[
Sep 1, 2024 00:46:30.430660963 CEST	1236	IN	Data Raw: 6b a8 2c bf e4 e4 fc c2 db c5 68 72 fc 0c dd e5 69 80 ab c6 a0 1b dd a6 fb d3 25 fa 7f 4c be 39 c4 d7 2b 86 f8 b6 d7 a5 ba 75 bb 84 67 a6 65 c1 7e 0d 72 fd fa af 89 6f dc af c4 d4 aa a4 1f b5 7c 9d 4b 76 1d 39 c9 2f f7 ac 2a 61 80 a2 57 05 6a fa Data Ascii: k,hri%L9+uge~ro\|Kv9/*aWj\|,LYZW~^C .x\95'3ttiOc`fI0<[X7E}kiy[;jzg<cLmto}%<z&J;aFxQ}RI?Oj6JwMFes<
Sep 1, 2024 00:46:30.430669069 CEST	1236	IN	Data Raw: 17 30 dc 8b 8a 0d d7 2d 4d fa 55 02 6c 7e 6e 09 af 57 96 85 75 2d b9 3b 88 54 05 b1 da 05 56 a7 56 76 42 27 6c e3 9b 91 38 48 16 4c 3c 41 fe f6 a6 29 9f f8 9e 2e 47 5c a3 c9 a5 f7 9a 52 57 d5 20 ff 35 e3 67 30 d0 38 6b 33 c4 d5 55 1c d2 e8 8f f4 Data Ascii: 0-MUl~nWu-;TVVvB'l8HL<A).G\RW 5g08k3U[`JPQJ.3O\YYy]?.nDKIsqmS~+Ji~k5kE=K[o<=S_\|h%_W84>W_-4V,VF!ON=Q>Ny
Sep 1, 2024 00:46:30.430680990 CEST	1236	IN	Data Raw: 33 c0 22 a5 72 89 f1 cb 57 a2 32 b5 c9 90 53 f6 c8 6f 03 8f c5 64 e9 fd 9f af 73 89 91 f3 da 0d 46 78 d1 bc 90 7c e1 7e 18 21 0c d6 86 72 d2 b5 71 4b dd 6b a5 0a 3b 81 b0 85 07 c6 e2 04 ac ef 71 3e c2 ad 89 81 25 a6 ff 6f f9 57 e5 97 73 7e 27 4f Data Ascii: 3"rW2SodsFx\|~!rqKk;q>%oWs~'O]JwZ"+V](U\N.bV0jAvEs3"p(2/"eL^M[nE(4>NC?_Rw2#2Z)\9cpC.f~R{U#sVH
Sep 1, 2024 00:46:30.430685997 CEST	1236	IN	Data Raw: a0 d5 e6 37 75 68 34 c3 75 b9 26 68 15 33 1e 41 d6 e4 b9 bd 17 6f b0 77 9b f8 60 e3 db f1 d0 7a e9 b1 69 95 ba 9f 75 d6 59 9e 1d 31 e6 29 07 55 b8 13 82 ab 5e ca 01 ea d4 05 17 5c a0 46 3a dd f0 ed a9 89 b7 df 7e db 2d 38 cf 4f d5 80 a1 51 cd a6 Data Ascii: 7uh4u&h3Aow`ziuY1)U^\F:~-8OQ: jl`mLcO!4`~iR9`<F!5PxuaDg/[#{oLD%$ZT tIIo<.]"gbF6XK-B8i
Sep 1, 2024 00:46:30.430701971 CEST	1236	IN	Data Raw: dd 88 d3 25 10 e8 f4 c5 13 fd ab 56 cd 2c 65 80 2c fd 98 01 3c d1 79 96 2b b1 11 f4 04 0f 7b 91 17 5c 4a 29 dc 92 a6 92 1b cd 75 51 1c 31 d6 ad 07 cd ed 13 e7 d5 5c cd 5d 23 3b e3 da e3 e4 c6 af a3 a8 eb c4 09 51 dd e1 b1 4a 86 34 34 2f a0 ac 13 Data Ascii: %V,e,<y+{\J)uQ1\]#;QJ44/=kuCfad+1>S<//GEZR*-O0Yqi-=vFwK;;:0 Zuj,EFB1%NkgBETjq(w
Sep 1, 2024 00:46:30.430707932 CEST	1236	IN	Data Raw: 01 95 19 1f 3d d4 67 1d 24 fe 2d 7a 57 95 11 f1 57 49 a8 3a 98 4a c7 02 3e 23 68 24 b4 b8 ce 43 7c 89 0c 13 ac 48 39 b8 b2 85 f1 b8 ec 0d 7d a5 b4 9e c2 a7 2f f5 60 5c a2 fd b1 54 55 22 32 36 5d 1f 99 39 45 12 68 28 0f 34 87 46 32 79 40 be 97 2c Data Ascii: =g$-zWWI:J>#h$C\|H9}/`\TU"26]9Eh(4F2y@,[bv~\|30cHv9t,fxJ}xM\|K0YqA_Rh?h2rj\|>E% B*=%6@[1ts`-MxMK ?N9:tBt?m^j_M,V
Sep 1, 2024 00:46:30.430720091 CEST	776	IN	Data Raw: 60 5b 0e 1f ed 2a d2 0e 73 a0 14 78 b9 3e 92 54 53 2a b8 60 6b 70 f4 fd e0 8d 85 87 67 56 b1 f0 90 a5 0b 7d 29 43 6e 2f bb 2d ec 9a ea d0 3d fb 9a 27 f5 86 6f 3e 07 5b 89 cc e4 40 46 d8 d5 d5 f5 c9 c1 a4 d8 fb f8 65 ea 13 04 6e 71 b7 df b5 40 46 Data Ascii: `[sx>TS`kpgV})Cn/-='o>[@Fenq@F}nPFHzqXvEsCe.~QX6*9jYaFPYXA\~8K3,]\|c7&}04<4\Gg)BU5wvo[1=GH-98F~P^";O
Sep 1, 2024 00:46:30.435473919 CEST	1236	IN	Data Raw: 1a 64 02 8e 6e c5 99 09 30 42 65 51 6c 1d 24 3e 00 81 0b 60 84 3f 2b 26 6c f9 50 87 4b 35 43 a9 7c 01 75 96 88 17 05 2f 7f af bc 19 c8 7f a0 70 2b 3d c5 b7 6d 80 14 ae ed f6 62 47 f9 bf f2 e2 cb ea 03 27 07 cc 3d c8 3a 35 ba c0 b8 26 ef b6 5b 36 Data Ascii: dn0BeQl$>`?+&lPK5C\|u/p+=mbG'=:5&[6//9;-UHe:y+r\|`v_7U2]b)0iGlT<%Lssp1/#Mcv(sVapA\z2srOG[_#Mg{qttBp8PxWy,/C

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 00:46:29.770664930 CEST	302	OUT	GET /icloud-archivos/applenew2.png HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:30.430726051 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:30 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 43453 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/png Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 5e 00 00 01 4d 08 06 00 00 00 48 69 07 2f 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 26 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 30 20 37 39 2e 31 36 30 34 35 31 2c 20 32 30 31 37 2f 30 35 2f 30 36 2d 30 31 3a 30 38 3a 32 31 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 [TRUNCATED] Data Ascii: PNGIHDR^MHi/tEXtSoftwareAdobe ImageReadyqe<&iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 Macintosh" xmpMM:InstanceID="xmp.iid:42E7546F3C3611EC91678B866C151C0E" xmpMM:DocumentID="xmp.did:42E754703C3611EC91678B866C151C0E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:42E7546D3C3611EC91678B866C151C0E" stRef:documentID="xmp.did:42E7546E3C3611EC91678B866C151C0E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>K31-IDATx}@U9{("(.Zf6YS6f3olujk)4l1G3DWDADYd;bd)\|
Sep 1, 2024 00:46:30.430732965 CEST	1236	IN	Data Raw: f9 ce 79 ce 7b de f3 be ef 03 09 21 40 41 41 41 41 a1 ed 80 54 13 28 28 28 28 28 e2 55 50 50 50 50 c4 ab a0 a0 a0 a0 a0 88 57 41 41 41 41 11 af 82 82 82 82 82 22 5e 05 05 05 05 45 bc 0a 0a 0a 0a 0a 8a 78 15 14 14 14 14 f1 2a 28 28 28 28 e2 55 50 Data Ascii: y{!@AAAAT(((((UPPPPWAAAA"^Ex*((((UPPPPPaj@UK+p?vueG%[XzRUEE7X2N(WGu>63fqPsn9^Etf>Ag?VOP"^vf
Sep 1, 2024 00:46:30.430738926 CEST	448	IN	Data Raw: ec f2 ca c0 b7 d3 73 9f 77 61 7d ae ce 7c 0a b4 7f 62 52 4f ba 80 3b 43 b8 6f fa d3 50 3f 6b e9 eb e3 e2 ee 6e 8b eb fa b9 dc 15 77 57 46 ed 57 0e 4c 2c 3a 04 31 82 70 e9 44 05 e5 ec c0 57 07 a0 38 39 44 db b2 7c 78 e0 0d aa c7 2b e2 55 c4 eb 03 Data Ascii: swa}\|bRO;CoP?knwWFWL,:1pDW89D\|x+UwkDXt/Hn+z6m~T,%:j^F\0umV\|?8hC1E'\v\|)#bikF"K3+#RuKz"^E?X<
Sep 1, 2024 00:46:30.430749893 CEST	1236	IN	Data Raw: a6 59 ca b9 be 8e 94 52 f7 38 13 04 b1 6e b6 4c 11 e1 6b 40 d7 65 c2 09 12 e4 cb 43 f3 10 30 02 f4 ba 2e ca 75 bc 02 78 95 37 85 f6 06 15 4e d6 01 50 55 74 38 90 ad 2a d8 22 1e f3 e2 33 44 a4 e4 ca 38 54 f6 94 85 ab 41 c6 a6 f2 2f 08 6a ab cb 23 Data Ascii: YR8nLk@eC0.ux7NPUt8*"3D8TA/j#U{l<#@@$bQY3uNR>,n"[Fm%)]QP'XvqPQqpViS5(fZ,"uV^SaYG($#^t'AGW/.I,1
Sep 1, 2024 00:46:30.430753946 CEST	224	IN	Data Raw: 07 d7 f5 b0 ae 53 3d bb fd 13 af 0a 27 eb c0 e8 39 f8 92 66 97 81 cc cf df db 35 f7 f0 9e 60 4a 36 2b 31 cf a4 12 d5 c5 a0 e1 7b 44 22 de 94 12 f2 57 85 45 c7 2e a3 9f b4 38 f1 86 fa fb 97 94 d5 d5 89 8d fe 33 ac 5c 51 34 46 13 e5 1c b1 14 b4 a0 Data Ascii: S='9f5`J6+1{D"WE.83\Q4F2=1JNtl6q=M9O@N_4)_?R]@m).Jr);6m X$-}R 9At#,aJOmyvQ"mz
Sep 1, 2024 00:46:30.430758953 CEST	1236	IN	Data Raw: b1 d0 3d 19 6c cb 92 54 72 6b 3d f1 aa f7 28 28 e2 55 68 12 9c 0e a7 0d 9e d1 59 98 65 a7 99 20 8f 17 86 32 dc 89 10 41 c6 94 8b be ad 73 d4 b6 b8 66 da 88 98 98 bc a8 90 4e b9 10 33 0b 52 44 32 b0 53 6b ec 1a 90 70 84 d2 d7 47 03 cc a6 9a 1b 07 Data Ascii: =lTrk=((UhYe 2AsfN3RD2SkpG[:kNbyFX7{S2W(d=xx,8Xsw!E[J6IIuv?5.gleopGz#EbH!`"]y)qtqL!=r=G
Sep 1, 2024 00:46:30.430766106 CEST	1236	IN	Data Raw: 21 e4 e4 4b 2a 8f 5f 16 1a a2 88 57 b9 1a ce 09 b0 bb b6 13 cf ea 32 14 5a a0 18 d0 5c 9c 1b 0a 2b 17 78 b5 d6 81 78 b5 57 34 29 d1 a0 2a 6f 57 4c c1 e6 77 66 9d da b3 7e d6 c9 8c f5 b5 45 7b be 9c 7d e4 9b 37 e6 16 ee 5e 3b a9 bd b4 d7 da 6d 1b Data Ascii: !K_W2Z\+xxW4)oWLwf~E{}7^;m'$3&V>BM;Yp/-%2`JE}n1MF3ezH*pwsO?z=U,l[.(AI'HdB$xz>#erT#8XF
Sep 1, 2024 00:46:30.430771112 CEST	1236	IN	Data Raw: ef 4f 9f 4c cd 3d b8 79 fa c9 13 59 47 8e 1d 49 9f f8 f3 96 8f a7 ed 4d fb 6e 74 4b b7 53 62 ef f8 12 b3 19 39 e8 db ab e9 04 04 0c bf 03 82 c6 d2 96 5b 59 37 87 05 04 94 b4 f4 b9 c7 47 85 ae a5 8d f3 02 31 6c 3a d6 68 6c d9 8e e4 46 15 e2 2e 88 Data Ascii: OL=yYGIMntKSb9[Y7G1l:hlF.w%\OU\|@OQ^J+Rj6o(v.1Z54w{8.]j.Hm7\|\|<lP#_%>\YF>'xD2{~=e~A^x
Sep 1, 2024 00:46:30.430782080 CEST	104	IN	Data Raw: dc 3a 67 93 06 46 8b ea dc fa 3d 6f fe bc e7 ae b9 17 0c 59 e2 2b cf aa 8b d5 54 40 67 b7 4d 94 74 27 0a dd 20 91 f8 a2 1b d1 1b 46 16 02 81 20 d0 8c 6a 54 ef 3e 7f a0 a2 1a da 33 09 37 83 74 19 7a 0e 9a 94 0a 35 96 e0 0c 79 3d 09 0d c9 cc 24 24 Data Ascii: :gF=oY+T@gMt' F jT>37tz5y=$$kuD%s_k.
Sep 1, 2024 00:46:30.430785894 CEST	1236	IN	Data Raw: e2 de 85 42 e0 92 4f 0c a2 4e 06 58 e4 c6 d8 bc 26 2b 77 72 4b 9e 33 a7 b2 ce b6 ad a4 26 61 47 a9 a3 d1 aa c1 4c a5 c1 1f 81 3a 6f e4 81 74 17 6a c8 88 f1 96 c9 0a 04 6c 9f dc d9 f4 89 ea d1 ca e2 55 38 4f 60 0b ee 9a 57 53 55 72 03 b5 70 3f 21 Data Ascii: BONX&+wrK3&aGL:otjlU8O`WSUrp?!28#{lrlE%qiL-a<O#{5H'w3nx]G`e<Flk\HNz,Z'L0\|7[,^C=S\|F4pM
Sep 1, 2024 00:46:30.435672045 CEST	1236	IN	Data Raw: 12 fd da cb ea 43 8c 0d 33 6d ba b3 b7 e5 e1 86 a4 14 27 6f a9 da 53 87 c1 60 be 76 31 a2 5b 84 5f 5b f4 69 91 e9 98 77 59 17 d3 97 0b 07 04 dc d3 dc 6b ce ac d4 43 97 e5 bb 9e d8 55 e6 1e 0b 11 62 f5 d6 b4 58 1b c8 fa 4b 8c 65 c1 f8 ce 8d 9b 34 Data Ascii: C3m'oS`v1[_[iwYkCUbXKe4Z7T&6oC# j6[T\nG4'\o:\-qqw*-3oW?!-rvW@M\|aU`I"dU3L`S

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 00:46:29.808654070 CEST	325	OUT	GET /icloud-archivos/cb89b6112cb1d8e18fac821612c25717.png HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:30.454699039 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:30 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 496147 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/png Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 2c 00 00 03 b6 08 06 00 00 01 95 c1 e9 6d 00 00 01 75 69 43 43 50 6b 43 47 43 6f 6c 6f 72 53 70 61 63 65 44 69 73 70 6c 61 79 50 33 00 00 28 91 75 90 bd 4b c3 50 14 c5 4f ab 52 d0 3a 88 0e 1d 1c 32 89 43 d4 d2 0a 76 71 68 2b 14 45 30 54 05 ab 53 9a 7e 09 6d 7c 24 29 52 71 13 57 29 f8 1f 58 c1 59 70 b0 88 54 70 71 70 10 44 07 11 dd 9c 3a 29 b8 68 78 de 97 54 da 22 de c7 e5 fd 38 9c 73 b9 5c c0 1b 50 19 2b f6 02 28 e9 96 91 4c c4 a4 b5 d4 ba e4 7b 83 87 9e 53 aa 66 b2 a8 a2 2c 0a fe fd bb eb f3 d1 f5 de 4f 88 59 4d bb 76 10 d9 4f 5c 97 ce 2e 97 76 9e 02 53 7f fd 5d d5 9f c9 9a 1a fd df d4 41 8d 19 16 e0 91 89 95 6d 8b 09 de 25 1e 31 68 29 e2 aa e0 bc cb c7 82 d3 2e 9f 3b 9e 95 64 9c f8 96 58 d2 0a 6a 86 b8 49 2c a7 3b f4 7c 07 97 8a 65 ad b5 83 d8 de 9f d5 57 97 c5 1c ea 51 cc 61 13 26 18 8a 50 51 81 04 05 e1 7f fc d3 8e 3f 8e 2d 72 57 60 50 2e 8f 02 2c ca 44 49 11 13 b2 c4 f3 d0 a1 61 12 32 71 08 41 ea 90 b8 73 eb 7e 0f ad fb c9 6d 6d ef 15 98 [TRUNCATED] Data Ascii: PNGIHDR,muiCCPkCGColorSpaceDisplayP3(uKPOR:2Cvqh+E0TS~m\|$)RqW)XYpTpqpD:)hxT"8s\P+(L{Sf,OYMvO\.vS]Am%1h).;dXjI,;\|eWQa&PQ?-rW`P.,DIa2qAs~mmmp/B8xnL5TGr0(a!w{{cv#+)jSA8eXIfMMi,&~a@IDATxeEu/\|M44"8DcPYDq2b= $/DMdj&M%(M7=>uso{UjUv)gFy*jB,J2I=xh}oHRCkX?Ek\1`h $WKj8U?6BO]>N.ui6F@&XD[X>cF2(5SVyR'MHvI-)0(BZ5ARG~Fjc$#rBz&=N"}#?djkQHy@Vumc_!vQ-CV=z<J$]bZB}&^%Z@nX
Sep 1, 2024 00:46:30.454715967 CEST	1236	IN	Data Raw: 02 af dd ac 9a 71 ba 89 3e 30 20 c5 fe 83 a4 ba 98 26 49 59 ab e8 7d 76 b3 06 42 2d 89 a5 9e ec f0 0e 19 6f e4 62 40 0c 6e 69 55 94 71 a0 76 11 7d 78 58 c6 b3 0f 49 df cb ae 92 0a c7 9f 28 5f d7 cf e0 83 ea 6b 36 cc 72 76 99 96 bc 05 5a f2 60 68 Data Ascii: q>0 &IY}vB-ob@niUqv}xXI(_k6rvZ`htkf*"ypC.Fzv(7t_WEPr](fLmH4\ZQzLkL@GzGY<(#BrE
Sep 1, 2024 00:46:30.454721928 CEST	1236	IN	Data Raw: 01 3d 05 50 a2 7c 0d 68 cb 46 16 bc 08 50 87 47 32 c4 65 5a 2f 55 86 e6 44 90 ee a9 a1 c3 1b d2 23 00 33 dc ae 65 48 cf e5 e5 57 d8 ed 92 a5 22 61 db 59 1d cd 95 bd 60 1a 93 6b 94 28 54 26 5b 94 02 27 21 1c c3 19 10 c3 51 8c 81 67 9a 74 24 23 57 Data Ascii: =P\|hFPG2eZ/UD#3eHW"aY`k(T&['!Qgt$#WdTcbjjR#'vFU}UI.s N:'F^nA\|Xd"y;:(L\(I+\jy5/X3u@}5%wJVW
Sep 1, 2024 00:46:30.454813004 CEST	1236	IN	Data Raw: 89 e6 ec 2f 36 2a 88 5f 24 e5 b4 7f 6e 0c 9d 76 75 63 e7 6d 1f 48 1d 06 6f b4 d7 32 4c b5 e1 03 69 e1 45 60 2a cc d9 4d db c5 30 bb 98 1b c2 29 73 a8 55 10 da 62 48 8f 8c 77 b7 84 79 e2 5f 9c 02 47 48 87 bb a5 3e 22 26 de 91 44 f7 e9 e3 51 23 7f Data Ascii: /6_$nvucmHo2LiE`M0)sUbHwy_GH>"&DQ#OqoK-ti?gg7+pn'HV2LYn^NZ'NXiSfr}k8/S\RH&%OU[e&~Hn@<!'LNeTs
Sep 1, 2024 00:46:30.454828024 CEST	1236	IN	Data Raw: 4f 46 e7 03 14 3e 48 c1 03 95 ff e0 3a 36 57 6a 66 03 a0 53 76 e5 1b 5d 73 b9 d3 d1 20 23 8d 16 94 02 a3 c0 2a b8 73 ea 93 92 49 e9 19 52 91 8c 38 b3 02 33 80 6e 1a 45 b5 e3 ef d9 2b e9 5f 1f 13 f9 d7 c7 90 a8 0d 3d 9e 9e ac a2 0a 55 0f fc 6c ec Data Ascii: OF>H:6WjfSv]s #*sIR83nE+_=Ul#"yLD.38[}A0}7 YGv,E?jAI>ZJd\|-9mg>#H`#s:tdJu(96+F=`f\|3i&iG
Sep 1, 2024 00:46:30.454833984 CEST	1236	IN	Data Raw: 21 8d 36 02 a3 f2 f2 7e b5 e1 57 f9 4c ce 36 74 ed be c1 9b f9 84 e9 5d 4d f8 5f cf 8b 3e ab 87 ae a2 43 18 de 30 83 58 9f d4 06 61 59 83 4b eb c1 97 bf 9b e8 40 e6 88 1c 3e f9 39 48 91 c6 64 37 0e 14 a7 d3 15 1c d9 57 90 4b b4 50 5e 4d b0 7d e8 Data Ascii: !6~WL6t]M_>C0XaYK@>9Hd7WKP^M}4c$]k$r#Wc/xPX*Qo\LibZ3J%e`kh$&ldjlm-P!(C@o:glz/6"lO^twdN4
Sep 1, 2024 00:46:30.454839945 CEST	776	IN	Data Raw: 67 c9 6b 59 48 36 58 92 b1 f2 b6 a3 5b 1a cd dc 3c 09 76 1c a8 71 7f 3c 49 74 d8 40 90 71 92 f6 8b 2a 27 60 c0 24 0c a7 96 a1 82 8d cb 66 2c 59 36 73 07 c9 a3 b0 6e a0 53 ae 70 ed 98 c2 11 70 2c 13 2f 73 47 b2 06 61 a4 7f fb 52 ac 1b 63 42 3a 9b Data Ascii: gkYH6X[<vq<It@q*'`$f,Y6snSpp,/sGaRcB:@L>-yl]C0C!EmaDZ2(rEOb\^'mK?Q>PtZ32g\|,[.k\?pO(K?4 /Tee/YsN^:]"Hfa!
Sep 1, 2024 00:46:30.454847097 CEST	1236	IN	Data Raw: ad 76 98 fe 9f 7e ec 68 1b de ed 2b 17 de 90 1e 82 85 fc 08 4a a3 b7 72 6d fa 8c 9e 28 bf 6f 2c bd 41 00 50 4e 86 ea 15 a4 f5 65 73 83 38 78 ad b1 8d 6d 17 d0 75 5c cc 9b ca 97 81 e5 63 39 cc 4f 77 0b 60 13 e8 56 9c b8 7d db 45 8e 17 27 96 ed cc Data Ascii: v~h+Jrm(o,APNes8xmu\c9Ow`V}E'[@#50\|8< Y*r`c\|ikhef@g]VMB#vj>GlB(#@e}Xa](:]>UK <QA\,KB7KFO
Sep 1, 2024 00:46:30.454853058 CEST	1236	IN	Data Raw: 45 ce fd 96 a5 74 36 41 76 03 2e b5 cf 83 1b 97 ce 94 83 68 a4 33 9f 73 82 b4 8c f7 99 37 79 b9 82 b8 e6 3c c7 0f 21 a6 23 1f cb 87 9e e2 cf f1 ae 51 a9 b7 2c a5 c2 e1 32 8a e5 89 e1 72 1f 8e c7 c9 c8 d0 e3 77 cb b1 2d 8d 6e 95 cb fa 88 5d 0a 8a Data Ascii: Et6Av.h3s7y<!#Q,2rw-n]9ky!1'G5}x2t\|'RACJ6%eVJ~(Nl`fad<\|+_VMeRYcA'~$h^5t
Sep 1, 2024 00:46:30.454859972 CEST	1236	IN	Data Raw: 9c ac 52 5a 59 95 4a bc c7 4a 2c 87 8d 35 51 89 85 e1 11 e9 cb 17 64 05 ee ce 5f 69 e1 5d f9 59 d6 a6 21 17 10 17 0b 7d cb 03 f2 82 2c b4 25 a4 66 d7 1b 8d 6b 9a 05 9a da 15 6a d0 df e0 0b 61 07 94 70 60 04 ce 7e 82 e6 cc 02 44 d9 a1 3e 9c 9a 87 Data Ascii: RZYJJ,5Qd_i]Y!},%fkjap`~D>MRc8!^@J{\|3q7Mp(Yk^ONn>r!hlc^/?<+sd&QcR;`^8]z`1!J/?)CO
Sep 1, 2024 00:46:30.459728956 CEST	1236	IN	Data Raw: 5f 36 2f bd 68 b1 81 67 bf 54 ee 26 02 b5 ee 91 d8 94 44 18 16 ba 67 83 5e 1b 93 cf 6d fd b9 7c 86 ed 80 75 af 11 f6 b4 1c 46 75 aa 1c a6 05 4c 56 88 81 93 03 ef e1 ad 92 1d 1c c3 a3 b8 31 4c fc b3 f8 e0 44 55 7a b0 0b bc 70 d8 ab 84 6f 17 ab 49 Data Ascii: _6/hgT&Dg^m\|uFuLV1LDUzpoI73[t>vc<zGRs#zhL4]JiBBw;:/>5?VwpaMj[E R0E^HXYt;F!i#y%;

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 00:46:30.170692921 CEST	299	OUT	GET /icloud-archivos/fpo@1x.gif HTTP/1.1 Host: lphone-security.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 1, 2024 00:46:30.839960098 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 22:46:30 GMT Server: Apache Last-Modified: Fri, 21 Jun 2024 04:00:48 GMT Accept-Ranges: bytes Content-Length: 3465938 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/gif Data Raw: 47 49 46 38 39 61 ae 01 84 01 f7 00 00 11 7d eb 26 7c e1 25 78 de 50 96 ba 6f a9 bb 76 c6 b6 38 96 d8 2f 8f d6 33 a7 d7 09 95 ed 18 97 eb 01 85 fb 0a 84 fb 03 8b fc 0a 8e fd 09 88 f6 12 8d f9 13 86 f6 01 95 f6 0a 94 f5 00 9b f6 0b 9b f3 02 95 fa 0c 92 fd 03 9c fa 0b 9c fc 13 95 fe 19 96 fe 15 9a fd 1d 9c fe 17 9a f3 14 89 e8 28 9a e9 22 9d fd 25 97 f9 2f 91 ed 08 b9 ed 01 a3 f5 09 a4 f5 01 ac f5 02 a3 f9 0b a4 fb 03 ac fb 0b ad fe 0a aa f6 13 a4 fd 1d a3 fe 14 ad fd 1b ab fd 18 aa f5 01 b3 f6 0a b6 f3 02 ba f6 0b bb f6 03 b4 fb 0a b2 fe 03 bb fa 0b bc fc 14 bb f5 1c bc f5 13 b2 fd 1b b3 fd 13 bc fc 1c bd fd 15 b4 f6 1c a6 ec 22 a4 fe 23 aa fd 29 ab ff 29 a3 f6 24 bc f5 2b be f5 21 b3 fc 23 bd fd 2a bf fd 33 bd f9 35 ab ec 16 9c db 4c 96 d7 51 a5 d3 70 b4 d3 48 9b e9 57 b6 fd 4d ae f5 64 b7 fc 72 b6 eb 67 99 ca 02 c2 f6 0c c1 f6 02 c3 fc 0b c3 fb 05 c9 fd 0b c9 fd 0c cc f4 13 c4 f6 1c c5 f5 1b ca f6 13 c5 fb 1b c5 fc 13 c9 fd 1c cb fd 13 c9 f5 1b d2 f6 1b d3 fa 18 d3 fb 16 c8 ed 36 c6 e8 25 c1 f4 2b [TRUNCATED] Data Ascii: GIF89a}&\|%xPov8/3("%/"#))$+!#35LQpHWMdrg6%+#+#,#,3<4;4<6$,(43<:%<vIWAJDIDLET[WDDKK]T]Xycgvjldkeleu\|s\|qt{{pzrT+!NETSCAPE2.0!,H\#JH3j CI(S\0cI8s@JH*]PJJXj`Kh]pKxL+^#KL
Sep 1, 2024 00:46:30.839966059 CEST	224	IN	Data Raw: cb 98 33 6b de cc b9 b3 e7 cf a0 43 8b 1e 4d ba b4 e9 d3 a8 53 ab 5e cd ba b5 eb d7 b0 63 cb 9e 4d bb b6 ed db b8 73 eb de cd bb b7 ef df c0 83 0b 1f 4e bc b8 f1 e3 c8 93 2b 5f ce bc b9 f3 e7 d0 a3 4b 9f 4e bd ba f5 eb d8 b3 6b df ce bd bb f7 ef Data Ascii: 3kCMS^cMsN+_KNkO_O(>X==BX*h>f`R= <$h!`C#"2<xb_)0(5(v!Ps
Sep 1, 2024 00:46:30.839972973 CEST	1236	IN	Data Raw: e6 a0 93 8e 3b f6 30 c4 20 92 70 e9 38 90 83 03 b5 43 ce 37 dc c8 62 a6 99 50 a4 99 e6 20 83 c8 62 8b 2d bb ec 52 0c 35 e3 90 c3 8e 3d 15 12 54 23 97 6e 41 f8 ce 3b e8 94 03 4d 30 97 54 a2 88 1d 2c 24 aa e8 a2 2c a4 e0 e8 a3 26 44 1a 44 10 45 14 Data Ascii: ;0 p8C7bP b-R5=T#nA;M0T,$,&DDEdX39lg[cL-Pj6)x`k p@L>>^y >XS'B>(KkV@kM5'8:N? B,0(DBF
Sep 1, 2024 00:46:30.840024948 CEST	1236	IN	Data Raw: 75 5d fb da 8a 6a 37 a3 dd bd 20 0a 72 fb 5d b7 8e 57 9a e5 3d af 05 ee 38 01 09 38 81 17 ec 68 c7 d4 46 44 b5 e4 2a 97 59 f5 a0 47 3f 9e 01 85 39 cc 81 0d 47 30 42 75 0d 7b 53 9c 4e d4 bf c6 6c 6c 80 87 08 3c ef 16 f8 c0 a8 4c b0 82 ef 98 bf 21 Data Ascii: u]j7 r]W=88hFDYG?9G0Bu{SNll<L!Owo#M>B06W]\`oQB2B'w <6A#AXxLZwv.Y2j@p;)@[5I~v,F,e=h Mu9
Sep 1, 2024 00:46:30.840029955 CEST	1236	IN	Data Raw: 63 77 8c 95 e7 91 1f 29 8f 9a d7 80 45 77 47 d8 70 0d 8d 68 1d c7 f2 21 ff 58 0c bb 70 0b b6 30 0a a7 70 0a a1 60 93 a0 70 93 3a b9 93 a2 e0 93 3d 09 94 38 f9 26 bb 70 0c ed 70 72 47 99 94 4b d9 94 4f c9 86 b3 36 95 6b 60 8e 56 79 7d b4 a7 8e eb Data Ascii: cw)EwGph!Xp0p`p:=8&pprGKO6k`Vy}X`~Etgp\|0uyx;i.VfwD;wLA<G_Ygw@d%CEiP@0OPJ)lEE
Sep 1, 2024 00:46:30.840074062 CEST	1236	IN	Data Raw: f5 c1 2c e6 6b 17 7b 9c 4e 8b c2 52 0b 42 17 30 01 b2 60 0e 02 c1 99 b7 31 32 f4 80 0d c3 e0 b5 6f 0c c0 35 79 c3 38 6c 9a 75 bc b9 9c fb c3 0b cc ac 37 8b 07 6b 80 05 80 bc c1 1c 4c 4c 95 04 04 3a 40 5d 4f 6c a3 db 3a 51 9b c4 c1 b0 8b c5 80 ab Data Ascii: ,k{NRB0`12o5y8lu7kLL:@]Ol:Q[)l0~0@0@,0nXp2pSrXXEdeS]\|Qi39nxP12 ^;;\|Yy'm`\|Ubr8L]#h,b%A9c87<s
Sep 1, 2024 00:46:30.840080023 CEST	1236	IN	Data Raw: 3e 84 33 3d 33 f9 19 a4 e4 9b e6 6e 5c 8f 8c b0 aa 54 9b 2f f6 16 ee 01 45 a0 52 b2 b1 0f f6 00 0f a3 0f c0 71 ff 69 fa a7 bc f3 6f af a1 fd 5a ed 07 3c a2 af 7d 09 af 8f f7 43 5f fb ec 8f fb b8 3f f8 bf 3c c5 f4 4c 3e 3d fe fb 8f 4d 3e 51 cf 46 Data Ascii: >3=3n\T/ERqioZ<}C_?<L>=M>QF>6V`D#lA@(D>\|hA`^u}RH%MDRJ-],R5kSB}'E9T)(QM&mTO*r-]`KekE[cm\sm+}U
Sep 1, 2024 00:46:30.840090990 CEST	1236	IN	Data Raw: 25 c5 29 52 f1 5b 13 b9 62 16 e9 26 91 74 a4 a3 82 56 12 63 2a 57 a6 b7 90 58 69 1a b6 b8 9e f9 50 88 06 37 c2 d1 96 71 64 21 1d 75 99 3e 3b 46 62 86 96 a0 a1 27 32 e1 08 3f 6a 05 90 9e 2b 64 57 0a b9 cc 30 84 c1 87 89 54 64 d6 84 78 3a b9 14 ff Data Ascii: %)R[b&tVcWXiP7qd!u>;Fb'2?j+dW0Tdx:q;4aFur%h"SR<Ur\|e>K(9/$KG4":HxAch0!2bw,o;$ q2""t0;OeH6v1>i>~DR
Sep 1, 2024 00:46:30.840140104 CEST	1236	IN	Data Raw: 49 bc 9e 5b bc c6 73 bc 87 88 bc 15 88 bc 7c 53 0f cb c8 0f 49 00 38 7b f0 ab f1 bb b5 f2 a3 12 56 b2 12 7d f0 07 63 58 3f 66 70 bf f7 c3 ba f8 9b 3f 36 c2 25 d7 7b bd 65 93 bd fd 03 c2 ed f2 03 39 40 bb 1e ba 8e 00 ec bd 02 44 b4 d1 52 c0 05 cc Data Ascii: I[s\|SI8{V}cX?fp?6%{e9@DR;;`aJ $>zptlH+8/j#?'Sgs#; !B702C;76=)4k2- CL/$h7C19
Sep 1, 2024 00:46:30.840143919 CEST	108	IN	Data Raw: 2b 40 a5 cb 87 50 80 60 95 b0 86 25 d0 7f 84 d8 7b 38 15 71 18 07 07 6d d4 ac 9b 56 d4 93 56 4d 00 04 8f ed 83 b2 85 1f 8f fd d8 cc ec 56 91 65 5b eb 09 d7 71 3d 59 4f 4d 59 ea 50 2f 74 3d 4d 97 3d 55 be 8b d9 fc 61 18 47 e2 44 72 bb 59 25 12 b2 Data Ascii: +@P`%{8qmVVMVe[q=YOMYP/t=M=UaGDrY%$r"uLMZ:XT
Sep 1, 2024 00:46:30.844954967 CEST	1236	IN	Data Raw: 35 09 50 00 10 98 c5 be a2 5a 64 4d 56 65 b5 07 75 18 07 0c eb 5a 27 4d 05 55 80 04 48 30 5b 3f e8 83 b1 2d 5b d9 9b bd 0a f5 d6 45 90 dd b6 25 59 b8 2d d7 27 5c cd b9 a8 db 33 c5 5b ff b5 d3 db bd 0d d3 78 45 51 4f 6c 53 1a b9 57 4a 82 51 9e 9d Data Ascii: 5PZdMVeuZ'MUH0[?-[E%Y-'\3[xEQOlSWJQPX\Ha\X-XOZj@ZTeqPI-.Y]H<p--^FW^s]MmvS^K:} _+Qc0CVi}Pj5k

Timestamp	Bytes transferred	Direction	Data
2024-08-31 22:46:30 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 22:46:30 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=237550 Date: Sat, 31 Aug 2024 22:46:30 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-08-31 22:46:31 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 22:46:31 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=237549 Date: Sat, 31 Aug 2024 22:46:31 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-31 22:46:31 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-08-31 22:46:37 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1725144363991&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-08-31 22:46:37 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-08-31 22:46:37 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-08-31 22:46:37 UTC	479	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 7AAC4856D41E41499BD946ED3E70BFFE Ref B: LAX311000109031 Ref C: 2024-08-31T22:46:37Z Date: Sat, 31 Aug 2024 22:46:37 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.56ed0117.1725144397.6fbe57f