Edit tour

Windows Analysis Report
https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtB

Overview

General Information

Sample URL:	https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtP
Analysis ID:	1560035
Infos:

Detection

KnowBe4

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected KnowBe4 simulated phishing

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1876,i,16783391306513579524,5699982791856897382,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7388 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_68	JoeSecurity_KnowBe4	Yara detected KnowBe4 simulated phishing	Joe Security

HTML

Source	Rule	Description	Author	Strings
1.0.pages.csv	JoeSecurity_KnowBe4	Yara detected KnowBe4 simulated phishing	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected KnowBe4 simulated phishing

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_68, type: DROPPED

Source: https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.189:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49719 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.209.189
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.209.189
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.209.189
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.209.189
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.209.189
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.209.189
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.209.189
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.209.189

Source: global traffic	HTTP traffic detected: GET /XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779 HTTP/1.1Host: cardpayment.microransom.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09 HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=rmUon3rGCBFCvfr&MD=Dlls5Rg3 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -300X-DeviceID: 01000A4109009A83X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Search-TimeZone: Bias=300; StandardBias=0; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Agent-DeviceId: 01000A4109009A83X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAeMRzuQup/5WvEKbE7YAq6XDFQ1piK9sGWgkVKizglM7gPg0iR4RjoLtM7JWgMyV%2B0aoZdOMoDhDl0VxGUveqRgpIYl6isqYhDNHvHjMBjPIgOXSrXWkNzslt3r6VkyLElBbNwIZ6LNN99r/0vJMKjZnFJCJR/aH7AwFP989ttuigT5Pody3rQmia5aKW2OAzpIuk4Xe/YJ6qyDX/amVjm8TdrrNMBSQEoIjtFSZ1G0ODI6ZAWgV6X4EYneHb0qFtSDE2yqZqGuOs3M%2B3q7RuKn/mlF7emx1hmpTlFzBiKZ4q%2Bq4Sqmu1SuTojyX%2BUmScVKp2XyMisdKCHYRAb%2BFhaAQZgAAEG2j3qNlyPkSvjJq9EYWUFCwAXqT%2BeUoLxdhRArJxjeD2BehJYEXiL44xuEZZ70rC5fWh4Fvw0RLqWlXcj6Sw6jttk3veicVusveq%2BW7Fz%2BVUm6IIxxO0FTUDWFx1%2BlD/EvrKqhb66hj46BsCDDVPStD09jK9WMw2b1NCjT1SvpSn0uW/ROTX7xZB8zaTJ7bBOq9PH5sA/A1aZc9y%2B5/FvcvlxVRS2B8ABWFx5bIfGB4q5iwROe/bZ/zSrx6OcfnlCs%2BAWvbXIaJyjMLpGs6zX6iB3KtQIGSuEEm8s/LZWzF14oo3v/geBHCIJ14IqvaCDWDvK7w2QIcsnNeSfCoC7IN33Obd%2Bw%2B2n8bkKPQe7S5VfMACFaoO5PeflxcUaw4JOBMgJ%2BIWrfPfVfd7J/09mDLF6Yac1ts3AY2X0xl/UAwJzztIjhO9/z%2BKeiy/Jtq%2BkN4QIZfeDMcDlLUa6jt/ayZElbcXeSEwIX/4HOduTg3v2MisiJ6XXeMPRe2OwESie4niCZcSq3pAS%2Bz2j58p6/z6YiP6anK1R0z%2BPT4VJRlZxCkbeS%2BLk/T1at34TFhwA4JQwC4niG7T7%2Br7PufGyQgH9cB%26p%3DX-BM-CBT: 1732181686User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 1F65C95488C14F3C98AF2CCFA1A0A48FX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=3a628620&IPMID=1707317755885; MUID=5047E5942BB2460EA35B53CCF78DDB3D; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=rmUon3rGCBFCvfr&MD=Dlls5Rg3 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: cardpayment.microransom.us
Source: global traffic	DNS traffic detected: DNS query: secure.encryptedconnection.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_66.1.dr

String found in binary or memory: https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYd

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.189:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49719 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@17/15@8/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1876,i,16783391306513579524,5699982791856897382,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1876,i,16783391306513579524,5699982791856897382,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
landing.eu.knowbe4.com	52.214.139.140	true	false	unknown
www.google.com	142.250.186.164	true	false	high
cardpayment.microransom.us	unknown	unknown	false	unknown
secure.encryptedconnection.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://secure.encryptedconnection.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css	false	high
https://secure.encryptedconnection.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js	false	high
https://secure.encryptedconnection.net/favicon.ico	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYd	chromecache_66.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
52.214.139.140	landing.eu.knowbe4.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560035
Start date and time:	2024-11-21 10:33:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@17/15@8/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.19.85.159, 142.250.185.99, 142.250.186.174, 66.102.1.84, 34.104.35.123, 142.250.185.195, 142.250.185.142
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779

Input	Output
URL: https://cardpayment.microransom.us Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://cardpayment.microransom.us
URL: https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlL Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "HOPPLA! SIE HABEN AUF PHISHING SIMULATION GEKLICKT", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://secure.encryptedconnection.net Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://secure.encryptedconnection.net
URL: https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlL Model: Joe Sandbox AI	{ "brands": [ "O1" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 08:34:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9821819561415954
Encrypted:	false
SSDEEP:	48:8b0dDTr/THyidAKZdA1FehwiZUklqehAy+3:88Xc/y
MD5:	46573898878C50660DF358073DBCA9EE
SHA1:	5FC5709833C86C8F1412160C59998501575E8915
SHA-256:	6717DDD576D31F71613F90D4696334EC827BBA62551129658005B7B26BC22747
SHA-512:	9F054F5405B64AC3EEE6167F7A09A51968089B50DA480CB3DBF7CC3FFE492A7DC05DF24E6DE6439BFBB5BB0B25444C2943862231FA26592943BEFB242372DC6B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IuYAL....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYJL....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYJL....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYJL..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYLL...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 08:34:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.000145411784043
Encrypted:	false
SSDEEP:	48:8HdDTr/THyidAKZdA1seh/iZUkAQkqehvy+2:8xXS9Qay
MD5:	3CE7197FFD436199BA83A219BA0D69D5
SHA1:	764E6777F85FF7F086FDCC10F2545C53680D19D6
SHA-256:	FDCB97A3E231010CA8641C0DF554AA0B919D27C564BE7D9347547EBB73F879A8
SHA-512:	4D84E4BC43D6CEAED5D814ADE58680DD443685F236EDD88E953A65CDB30A0D9ED0D40CB93B75182CC7F3DE4E2CD39DC8FC3007D7DD064CDABE43A5A425C91E92
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IuYAL....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYJL....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYJL....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYJL..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYLL...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.007916848827531
Encrypted:	false
SSDEEP:	48:83dDTr/AHyidAKZdA14meh7sFiZUkmgqeh7sZy+BX:8hXnnby
MD5:	3C4EC18B0B0B1E596518925B5B0C797A
SHA1:	49B8584674E684D03BE95A3ACDD7BD2E3B91D92F
SHA-256:	EF4CD4BA2D3A74D38F651432527D82BF19A9E86976DA524C43EF297CBBC32FA4
SHA-512:	937D8C64625AB03F600B23D61BCC0CA1C5B7CBE86F56BC6E1D042CBD63A34560949AA2E892D53CE2D0549A0CCEA44D43A5DAD523635D47138F733BC9141E09B7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IuYAL....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYJL....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYJL....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYJL..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 08:34:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9976920242507803
Encrypted:	false
SSDEEP:	48:8JdDTr/THyidAKZdA1TehDiZUkwqehTy+R:8PXJRy
MD5:	E9514C14C47C24E40D0CCA2AC804B737
SHA1:	B322F05F7D02B9D4980ED0FF6F19EA065A7862AF
SHA-256:	5B2B83C17F048B9314CD6EBD8D6E5FDAB2E4BFA4B092F3C61F0C11D2D5F2DA17
SHA-512:	2CAACE9A655C986A109E8EA6440403A1074A654B21E8E17D43600C9D342A8259BE83294EB5DF9E6441A2E8DB101381ECDCD2FD08587FBB80851EC23460D36D10
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IuYAL....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYJL....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYJL....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYJL..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYLL...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 08:34:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985408255327799
Encrypted:	false
SSDEEP:	48:8YdDTr/THyidAKZdA1dehBiZUk1W1qehFy+C:80XZ9ly
MD5:	4A9AD6BF7E22C4F30E9764C39EE7E321
SHA1:	83A4E655C0AA8AB794576AAB5E25C62B1E155BB4
SHA-256:	9AEF3810E1CFC201E8C0B1BDF486DD9CA14BE53F94FDF9AD0173AAF596896BAF
SHA-512:	FA0F6132C24E29669CABD7691AC6E8E774291B6BB47EDBFAB70E0C5BD36AF6996E68CB9215E5D167F03E1BCB4BC5136527E0B956902476E191D4F00CB6E7CE6E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IuYAL....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYJL....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYJL....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYJL..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYLL...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 08:34:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9940114545028855
Encrypted:	false
SSDEEP:	48:8EdDTr/THyidAKZdA1duTeehOuTbbiZUk5OjqehOuTbby+yT+:8wXhTfTbxWOvTbby7T
MD5:	5E821963365C413BF26070C7DC2E75EA
SHA1:	3CA25D044DB75068F1B8B4681B692E1EB654CBA1
SHA-256:	8B3465843B27C8AF7D5C13CD9251505F130F2DDF46F7EF6E001AB0B17EA6FD76
SHA-512:	63661388E7FF26F2669F0FDF76AD45CBA52B142BB0751C389C60703AA2D439520A26D12202347EC00592E4A169A0CC5217188448892DEFC94FD95269615E9EA4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IuYAL....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYJL....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYJL....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYJL..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYLL...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (496)
Category:	downloaded
Size (bytes):	550
Entropy (8bit):	5.875453743079891
Encrypted:	false
SSDEEP:	12:3R+xnunlEX9sf2CXm1lO9sSvFQ1aeDSJCyCqMk4AEdeIQL:3Eulz2aSa28WiNEkj
MD5:	35A22539976B1801FBE5725E1EC7F54B
SHA1:	3E8BE7FE91E87B984B13C870BD3CEABDD1D1299C
SHA-256:	588AA64ED82F13B257CB957B2D7523E1B61E2647FF94E179724D34CA4E668245
SHA-512:	386CB7B7A47868A13725E8F987AEE65AC1F4C0D5EE54C5D49C72ABC500731AAC52D5F9806F6F8467E20E46AD1DB48E3989D6BB0D3FCDC88AAB89267DBE5D71C7
Malicious:	false
Reputation:	low
URL:	https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779
Preview:	<html>. <head>. <script>window.location.href = 'https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09';</script>. </head>. <body>. </body>.</html>.

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1471
Entropy (8bit):	4.754611179426391
Encrypted:	false
SSDEEP:	24:y40r8CQo40agx40mC400XLaR404hZYmx40vGk40vG/I40vGhH40VhZ40UrCmn:xdDgCFEiBZgnTOHTn
MD5:	15E89F9684B18EC43EE51F8D62A787C3
SHA1:	9CBAAACEAE96845ECD3497F41EE3B02588ABEC11
SHA-256:	16F13E16A7EF02FB6F94250AA1931DED83DBEE5D9FAD278E33DD5792D085194F
SHA-512:	79E0110A045F28437D192290AC9789270CB0D4E676A985564746DB439992D867BA89639D7738E2A7F7D83BBF37D9A02CAA2AE1DC4E0EE2519797E5840A47FABE
Malicious:	false
Reputation:	low
URL:	https://secure.encryptedconnection.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css
Preview:	/* line 1, app/assets/stylesheets/landing-watermark.scss /..watermark {. -webkit-writing-mode: vertical-rl;. -ms-writing-mode: tb-rl;. writing-mode: vertical-rl;. text-orientation: sideways;.}../ line 4, app/assets/stylesheets/landing-watermark.scss /..watermark.left {. left: 0;.}../ line 7, app/assets/stylesheets/landing-watermark.scss /..watermark.right {. right: 0;.}../ line 10, app/assets/stylesheets/landing-watermark.scss /..watermark.top {. text-align: center;. -webkit-writing-mode: horizontal-tb;. -ms-writing-mode: lr-tb;. writing-mode: horizontal-tb;. top: -38px;.}../ line 15, app/assets/stylesheets/landing-watermark.scss /..watermark h1 {. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. user-select: none;. font-size: 15px;. color: #fdfdfa;. font-weight: bold;.}../ line 24, app/assets/stylesheets/landing-watermark.scss /.#template_sei .watermark.left {. margin-left: -10px;.}../ li

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (64724)
Category:	downloaded
Size (bytes):	189104
Entropy (8bit):	5.967854417487856
Encrypted:	false
SSDEEP:	3072:z0u0fxA7wN8s6ev7/b/zYDqSpy9IB1R098fixy8f11UE7ocvVI9bAl8G0Qw0EKmg:z0u8AUz1v7jbYDd18TfXvobAXJEm9
MD5:	A9DC97808F8E263CAAE7D9C8300A2ECE
SHA1:	DC218C46B8E6A27A015979544AC09A6489C05794
SHA-256:	92B1CE0E62E8F62F91083F1CA2553AE246014C7EC83D5C250D5E58068548FEE0
SHA-512:	240B69D6E90061DEB3D874F550AFAE0611C32EB8CD8F9C2CCC24115855D529D7F546B4CD35345CE78D0CA71F22AE309F043B86703480D20A9350EAE86E84227A
Malicious:	false
Reputation:	low
URL:	https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN". "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">. <meta name="IMPORTANT" content="This page is part of a simulated phishing attack initiated by KnowBe4 on behalf of its customers." />. <meta name="IMPORTANT" content="If you have any questions please contact support@knowbe4.com." />. <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible"/>. <meta name="robots" content="noindex, nofollow" />.. <head>. <script src="/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js"></script>.. <link rel="stylesheet" href="/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css" media="all" />.. </head>. .<img alt="" height="731" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAQ4CAYAAADo08FDAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAO3RFWHRDb21tZW50AHhyOmQ6REFGdDNZVUlXalk6NixqOjczNDAxNDQwNjAy

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
Reputation:	low
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
Reputation:	low
URL:	https://secure.encryptedconnection.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 10:34:15.945775986 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:15.945816994 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:15.945874929 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:15.945909023 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:15.945938110 CET	49700	443	192.168.2.16	40.126.31.69
Nov 21, 2024 10:34:15.945944071 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:15.945975065 CET	49700	443	192.168.2.16	40.126.31.69
Nov 21, 2024 10:34:15.945977926 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:15.946037054 CET	49700	443	192.168.2.16	40.126.31.69
Nov 21, 2024 10:34:15.952696085 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:15.952856064 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:15.952930927 CET	49700	443	192.168.2.16	40.126.31.69
Nov 21, 2024 10:34:15.961097002 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:15.961159945 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:15.961230040 CET	49700	443	192.168.2.16	40.126.31.69
Nov 21, 2024 10:34:17.740353107 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 10:34:18.055130959 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 10:34:18.657053947 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 10:34:18.913116932 CET	49673	443	192.168.2.16	204.79.197.203
Nov 21, 2024 10:34:19.857100964 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 10:34:21.908113003 CET	49707	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:21.908179045 CET	443	49707	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:21.908248901 CET	49707	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:21.908535957 CET	49707	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:21.908548117 CET	443	49707	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:21.909250021 CET	49708	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:21.909286976 CET	443	49708	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:21.909411907 CET	49708	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:21.909697056 CET	49708	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:21.909707069 CET	443	49708	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:22.203371048 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 10:34:22.267123938 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 10:34:22.510072947 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 10:34:23.112093925 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 10:34:23.932363987 CET	443	49708	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:23.932715893 CET	49708	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:23.932749987 CET	443	49708	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:23.933890104 CET	443	49708	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:23.933974028 CET	49708	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:23.934933901 CET	49708	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:23.935071945 CET	443	49708	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:23.935141087 CET	49708	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:23.975342989 CET	443	49708	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:23.987086058 CET	49708	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:23.987126112 CET	443	49708	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:23.990158081 CET	443	49707	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:23.990386963 CET	49707	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:23.990405083 CET	443	49707	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:23.991487026 CET	443	49707	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:23.991564989 CET	49707	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:23.991837978 CET	49707	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:23.991919041 CET	443	49707	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:24.035202980 CET	49708	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:24.037727118 CET	49707	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:24.037756920 CET	443	49707	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:24.084147930 CET	49707	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:24.323144913 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 10:34:24.507597923 CET	443	49708	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:24.507671118 CET	443	49708	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:24.507740974 CET	49708	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:24.508805990 CET	49708	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:24.508831978 CET	443	49708	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:24.780658960 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:24.780702114 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:24.780776024 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:24.781016111 CET	49711	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:24.781060934 CET	443	49711	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:24.781143904 CET	49711	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:24.781218052 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:24.781230927 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:24.781461954 CET	49711	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:24.781477928 CET	443	49711	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:25.748780966 CET	49712	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:34:25.748831987 CET	443	49712	142.250.186.164	192.168.2.16
Nov 21, 2024 10:34:25.748888016 CET	49712	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:34:25.749160051 CET	49712	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:34:25.749178886 CET	443	49712	142.250.186.164	192.168.2.16
Nov 21, 2024 10:34:26.730129957 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 10:34:26.808852911 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:26.809159994 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:26.809181929 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:26.809665918 CET	443	49711	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:26.809847116 CET	49711	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:26.809861898 CET	443	49711	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:26.810288906 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:26.810364962 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:26.810905933 CET	443	49711	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:26.811001062 CET	49711	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:26.811327934 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:26.811420918 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:26.811511993 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:26.811517000 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:26.811713934 CET	49711	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:26.811783075 CET	443	49711	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:26.858092070 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:26.858102083 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:26.858264923 CET	49711	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:26.858275890 CET	443	49711	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:26.906074047 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:26.909137964 CET	49711	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:27.082101107 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 10:34:27.184159040 CET	443	49712	142.250.186.164	192.168.2.16
Nov 21, 2024 10:34:27.187433958 CET	49712	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:34:27.187449932 CET	443	49712	142.250.186.164	192.168.2.16
Nov 21, 2024 10:34:27.188549995 CET	443	49712	142.250.186.164	192.168.2.16
Nov 21, 2024 10:34:27.188641071 CET	49712	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:34:27.189654112 CET	49712	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:34:27.189728022 CET	443	49712	142.250.186.164	192.168.2.16
Nov 21, 2024 10:34:27.242489100 CET	49712	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:34:27.242512941 CET	443	49712	142.250.186.164	192.168.2.16
Nov 21, 2024 10:34:27.290191889 CET	49712	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:34:28.515115976 CET	49673	443	192.168.2.16	204.79.197.203
Nov 21, 2024 10:34:28.658956051 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.658981085 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.658988953 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.659019947 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.659034014 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.659043074 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.659044981 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.659069061 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.659099102 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.659121990 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.673928022 CET	49711	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.679106951 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.679155111 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.679234028 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.679454088 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.679467916 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.715334892 CET	443	49711	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.820678949 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.820714951 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.820765018 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.820765972 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.820795059 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.820805073 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.820828915 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.820852041 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.820866108 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.866245031 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.875442982 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.875453949 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.875490904 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.875518084 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.875564098 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.875586033 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.875602007 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.875623941 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.996431112 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.996475935 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.996601105 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.996632099 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:28.996648073 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:28.996675014 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.036735058 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.036765099 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.036858082 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.036883116 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.036930084 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.073061943 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.073091984 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.073191881 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.073225021 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.073239088 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.073270082 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.079982996 CET	443	49711	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.080013990 CET	443	49711	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.080080986 CET	443	49711	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.080126047 CET	49711	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.080172062 CET	49711	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.080882072 CET	49711	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.080898046 CET	443	49711	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.104309082 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.104376078 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.104460955 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.104479074 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.104491949 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.104513884 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.197416067 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.197484970 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.197544098 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.197570086 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.197591066 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.197611094 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.220247984 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.220303059 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.220374107 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.220391989 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.220422029 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.220439911 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.241620064 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.241673946 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.241761923 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.241776943 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.241827965 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.253463984 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.253520966 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.253563881 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.253571987 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.253617048 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.261193991 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.261234045 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.261288881 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.261295080 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.261308908 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:29.261333942 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.261360884 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.261621952 CET	49710	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:29.261636972 CET	443	49710	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.095948935 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.096232891 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:30.096257925 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.096673965 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.097016096 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:30.097091913 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.097177982 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:30.139329910 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.209184885 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:30.209223986 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:30.209306002 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:30.211180925 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:30.211194038 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:30.822797060 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.822829962 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.822848082 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.822927952 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:30.822959900 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.823013067 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:30.877146959 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.877181053 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.877233028 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:30.877258062 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:30.877285957 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:30.877301931 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.038073063 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.038100004 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.038160086 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.038184881 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.038218021 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.038233995 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.068962097 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.068988085 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.069053888 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.069072008 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.069108009 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.069118023 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.095868111 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.095895052 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.095946074 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.095974922 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.095994949 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.096021891 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.224879980 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.224908113 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.224968910 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.224994898 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.225012064 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.225044966 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.245584965 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.245606899 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.245676994 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.245704889 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.245976925 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.262984991 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.263051987 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.263101101 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.263129950 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.263170004 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.263197899 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.283261061 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.283354998 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.283365011 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.283385038 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.283432961 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.283432961 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.427378893 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.427448988 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.427485943 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.427515030 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.427531004 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.427562952 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.443970919 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.444027901 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.444092989 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.444101095 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.444154978 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.458559990 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.458620071 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.458653927 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.458662987 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.458717108 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.474791050 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.474816084 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.474870920 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.474884033 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.474910975 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.474927902 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.491257906 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.491276979 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.491362095 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.491375923 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.491513968 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.506647110 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.506664038 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.506730080 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.506757021 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.507282972 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.523317099 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.523345947 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.523416996 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.523443937 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.523489952 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.538398027 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 10:34:31.627583981 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.627609968 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.627692938 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.627718925 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.627796888 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.640305996 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.640333891 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.640386105 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.640399933 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.640412092 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.640465021 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.652790070 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.652842999 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.652878046 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.652887106 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.652916908 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.652926922 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.663121939 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.663175106 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.663204908 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.663213968 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.663235903 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.663253069 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.674875975 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.674926996 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.674967051 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.674974918 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.675005913 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.675026894 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.685940027 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.686018944 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.686043024 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.686049938 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.686098099 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.697453976 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.697487116 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.697529078 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.697536945 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.697565079 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.697580099 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.700746059 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.700819969 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.700826883 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.700850010 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.700898886 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.701010942 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.701028109 CET	443	49713	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.701036930 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.701248884 CET	49713	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.734754086 CET	49715	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.734795094 CET	443	49715	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.734893084 CET	49715	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.735100031 CET	49715	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.735110044 CET	443	49715	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.994415998 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.994457960 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:31.994564056 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.994788885 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:31.994801998 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:32.024092913 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.024178028 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:32.026958942 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:32.026969910 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.027280092 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.081116915 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:32.092535973 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:32.135328054 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.738012075 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.738040924 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.738049030 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.738074064 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.738089085 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.738096952 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.738163948 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:32.738178015 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.738205910 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:32.738224983 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:32.758913994 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.759013891 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.759108067 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:32.759108067 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:32.759188890 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:32.759188890 CET	49714	443	192.168.2.16	4.175.87.197
Nov 21, 2024 10:34:32.759207010 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:32.759217978 CET	443	49714	4.175.87.197	192.168.2.16
Nov 21, 2024 10:34:33.192534924 CET	443	49715	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.192828894 CET	49715	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.192854881 CET	443	49715	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.193226099 CET	443	49715	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.193591118 CET	49715	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.193653107 CET	443	49715	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.193730116 CET	49715	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.235333920 CET	443	49715	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.359348059 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.359711885 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.359733105 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.361285925 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.361670971 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.361670971 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.361821890 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.361825943 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.403331995 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.417104959 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.417128086 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.465502024 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.725636959 CET	443	49715	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.725723982 CET	443	49715	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.725905895 CET	49715	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.726366043 CET	49715	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.726387978 CET	443	49715	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.726407051 CET	49715	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.726448059 CET	49715	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.729309082 CET	49717	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.729348898 CET	443	49717	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:33.729418993 CET	49717	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.729623079 CET	49717	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:33.729633093 CET	443	49717	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.065630913 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.065664053 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.065673113 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.065691948 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.065710068 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.065718889 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.065735102 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.065758944 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.065772057 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.065777063 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.065814972 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.120126009 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.123173952 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.123188972 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.123209000 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.123224020 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.123234034 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.123244047 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.123251915 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.123321056 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.123327971 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.123838902 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.265183926 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.265202999 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.265239000 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.265249968 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.265285015 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.265311956 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.265341997 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.265362024 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.298957109 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.299019098 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.299062014 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.299083948 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.299149990 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.299149990 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.325495005 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.325517893 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.325601101 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.325628042 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.325644016 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.325680017 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.449595928 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.449621916 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.449703932 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.449721098 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.449759007 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.467153072 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.467175961 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.467251062 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.467271090 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.467324018 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.482697010 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.482722998 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.482800007 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.482810974 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.482845068 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.500655890 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.500679970 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.500746965 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.500756979 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.500821114 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.514853954 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.514877081 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.514961958 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.514966965 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.515022993 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.527542114 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.527565956 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.527630091 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.527635098 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.527662039 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.527682066 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.648924112 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.648961067 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.649039984 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.649060965 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.649120092 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.659421921 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.659446955 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.659516096 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.659521103 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.659553051 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.669796944 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.669816971 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.669889927 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.669897079 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.669940948 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.678977966 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.678997993 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.679096937 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.679101944 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.679153919 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.688713074 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.688740969 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.688821077 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.688831091 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.688874006 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.699222088 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.699245930 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.699285984 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.699290991 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.699328899 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.709646940 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.709667921 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.709737062 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.709742069 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.709784985 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.835661888 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.835688114 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.837064028 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.837074041 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.838963032 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.843487978 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.843508005 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.843600035 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.843600035 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.843610048 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.845063925 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.852550983 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.852572918 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.852832079 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.852840900 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.853065968 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.861424923 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.861449957 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.861828089 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.861834049 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.865062952 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.869244099 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.869267941 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.869338989 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.869344950 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.870639086 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.872334957 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.872419119 CET	443	49716	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:34.872426033 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.872576952 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.872576952 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:34.872674942 CET	49716	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:35.142740965 CET	443	49717	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:35.143057108 CET	49717	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:35.143085957 CET	443	49717	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:35.143440008 CET	443	49717	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:35.143737078 CET	49717	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:35.143790960 CET	443	49717	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:35.143861055 CET	49717	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:35.187338114 CET	443	49717	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:35.667609930 CET	443	49717	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:35.667794943 CET	443	49717	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:35.667865992 CET	49717	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:35.668374062 CET	49717	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:35.668374062 CET	49717	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:35.668405056 CET	443	49717	52.214.139.140	192.168.2.16
Nov 21, 2024 10:34:35.668456078 CET	49717	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:34:36.690232038 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 10:34:36.978246927 CET	443	49712	142.250.186.164	192.168.2.16
Nov 21, 2024 10:34:36.978334904 CET	443	49712	142.250.186.164	192.168.2.16
Nov 21, 2024 10:34:36.978909016 CET	49712	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:34:36.979855061 CET	49712	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:34:36.979872942 CET	443	49712	142.250.186.164	192.168.2.16
Nov 21, 2024 10:34:41.140146971 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 10:34:46.754846096 CET	49700	443	192.168.2.16	40.126.31.69
Nov 21, 2024 10:34:46.756397009 CET	49700	443	192.168.2.16	40.126.31.69
Nov 21, 2024 10:34:46.874499083 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:46.875936031 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:46.875978947 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:46.875998020 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:46.876154900 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:47.299205065 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:47.299267054 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:47.299336910 CET	49700	443	192.168.2.16	40.126.31.69
Nov 21, 2024 10:34:47.303271055 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:47.303399086 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:47.303473949 CET	49700	443	192.168.2.16	40.126.31.69
Nov 21, 2024 10:34:47.311619997 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:47.311705112 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:47.311770916 CET	49700	443	192.168.2.16	40.126.31.69
Nov 21, 2024 10:34:47.320135117 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:47.320231915 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:47.320286036 CET	49700	443	192.168.2.16	40.126.31.69
Nov 21, 2024 10:34:47.328428030 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:47.328483105 CET	443	49700	40.126.31.69	192.168.2.16
Nov 21, 2024 10:34:47.328541994 CET	49700	443	192.168.2.16	40.126.31.69
Nov 21, 2024 10:34:47.665827990 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:47.665883064 CET	443	49718	2.23.209.189	192.168.2.16
Nov 21, 2024 10:34:47.665967941 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:47.667952061 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:47.667967081 CET	443	49718	2.23.209.189	192.168.2.16
Nov 21, 2024 10:34:49.163306952 CET	443	49718	2.23.209.189	192.168.2.16
Nov 21, 2024 10:34:49.163408995 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:49.171247959 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:49.171278954 CET	443	49718	2.23.209.189	192.168.2.16
Nov 21, 2024 10:34:49.171657085 CET	443	49718	2.23.209.189	192.168.2.16
Nov 21, 2024 10:34:49.173152924 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:49.173468113 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:49.173494101 CET	443	49718	2.23.209.189	192.168.2.16
Nov 21, 2024 10:34:49.790879965 CET	443	49718	2.23.209.189	192.168.2.16
Nov 21, 2024 10:34:49.790919065 CET	443	49718	2.23.209.189	192.168.2.16
Nov 21, 2024 10:34:49.790998936 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:49.791022062 CET	443	49718	2.23.209.189	192.168.2.16
Nov 21, 2024 10:34:49.791146994 CET	443	49718	2.23.209.189	192.168.2.16
Nov 21, 2024 10:34:49.791168928 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:49.791168928 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:49.791198015 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:49.795619011 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:49.795649052 CET	443	49718	2.23.209.189	192.168.2.16
Nov 21, 2024 10:34:49.795665026 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:34:49.795701981 CET	49718	443	192.168.2.16	2.23.209.189
Nov 21, 2024 10:35:09.053253889 CET	49707	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:35:09.053292036 CET	443	49707	52.214.139.140	192.168.2.16
Nov 21, 2024 10:35:09.416423082 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:09.416496992 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:09.416593075 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:09.416989088 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:09.417010069 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:11.294495106 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:11.294584036 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:11.295948982 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:11.295962095 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:11.296226025 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:11.297707081 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:11.343337059 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:12.033991098 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:12.034019947 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:12.034037113 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:12.034156084 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:12.034195900 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:12.034333944 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:12.071413040 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:12.071459055 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:12.071518898 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:12.071537971 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:12.071746111 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:12.071746111 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:12.071746111 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:12.375257969 CET	49719	443	192.168.2.16	52.149.20.212
Nov 21, 2024 10:35:12.375310898 CET	443	49719	52.149.20.212	192.168.2.16
Nov 21, 2024 10:35:12.647437096 CET	49697	80	192.168.2.16	199.232.210.172
Nov 21, 2024 10:35:12.767703056 CET	80	49697	199.232.210.172	192.168.2.16
Nov 21, 2024 10:35:12.767791986 CET	49697	80	192.168.2.16	199.232.210.172
Nov 21, 2024 10:35:18.158370972 CET	443	49707	52.214.139.140	192.168.2.16
Nov 21, 2024 10:35:18.158560038 CET	443	49707	52.214.139.140	192.168.2.16
Nov 21, 2024 10:35:18.158674002 CET	49707	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:35:18.975795984 CET	49707	443	192.168.2.16	52.214.139.140
Nov 21, 2024 10:35:18.975881100 CET	443	49707	52.214.139.140	192.168.2.16
Nov 21, 2024 10:35:25.580585003 CET	49721	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:35:25.580641985 CET	443	49721	142.250.186.164	192.168.2.16
Nov 21, 2024 10:35:25.580738068 CET	49721	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:35:25.581031084 CET	49721	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:35:25.581043005 CET	443	49721	142.250.186.164	192.168.2.16
Nov 21, 2024 10:35:27.054974079 CET	443	49721	142.250.186.164	192.168.2.16
Nov 21, 2024 10:35:27.055360079 CET	49721	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:35:27.055412054 CET	443	49721	142.250.186.164	192.168.2.16
Nov 21, 2024 10:35:27.056694984 CET	443	49721	142.250.186.164	192.168.2.16
Nov 21, 2024 10:35:27.057017088 CET	49721	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:35:27.057226896 CET	443	49721	142.250.186.164	192.168.2.16
Nov 21, 2024 10:35:27.099302053 CET	49721	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:35:36.851502895 CET	443	49721	142.250.186.164	192.168.2.16
Nov 21, 2024 10:35:36.851671934 CET	443	49721	142.250.186.164	192.168.2.16
Nov 21, 2024 10:35:36.851862907 CET	49721	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:35:36.988221884 CET	49721	443	192.168.2.16	142.250.186.164
Nov 21, 2024 10:35:36.988255024 CET	443	49721	142.250.186.164	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 10:34:20.939178944 CET	53	53199	1.1.1.1	192.168.2.16
Nov 21, 2024 10:34:21.008769035 CET	53	59123	1.1.1.1	192.168.2.16
Nov 21, 2024 10:34:21.613945961 CET	58900	53	192.168.2.16	1.1.1.1
Nov 21, 2024 10:34:21.614183903 CET	49176	53	192.168.2.16	1.1.1.1
Nov 21, 2024 10:34:21.863899946 CET	53	49176	1.1.1.1	192.168.2.16
Nov 21, 2024 10:34:21.907295942 CET	53	58900	1.1.1.1	192.168.2.16
Nov 21, 2024 10:34:23.248986959 CET	53	51260	1.1.1.1	192.168.2.16
Nov 21, 2024 10:34:24.539273977 CET	65216	53	192.168.2.16	1.1.1.1
Nov 21, 2024 10:34:24.539450884 CET	55894	53	192.168.2.16	1.1.1.1
Nov 21, 2024 10:34:24.779736042 CET	53	65216	1.1.1.1	192.168.2.16
Nov 21, 2024 10:34:24.780091047 CET	53	55894	1.1.1.1	192.168.2.16
Nov 21, 2024 10:34:25.518539906 CET	65080	53	192.168.2.16	1.1.1.1
Nov 21, 2024 10:34:25.518599033 CET	64876	53	192.168.2.16	1.1.1.1
Nov 21, 2024 10:34:25.744568110 CET	53	65080	1.1.1.1	192.168.2.16
Nov 21, 2024 10:34:25.744652033 CET	53	64876	1.1.1.1	192.168.2.16
Nov 21, 2024 10:34:31.705008030 CET	55088	53	192.168.2.16	1.1.1.1
Nov 21, 2024 10:34:31.705274105 CET	60956	53	192.168.2.16	1.1.1.1
Nov 21, 2024 10:34:31.958758116 CET	53	55088	1.1.1.1	192.168.2.16
Nov 21, 2024 10:34:31.993648052 CET	53	60956	1.1.1.1	192.168.2.16
Nov 21, 2024 10:34:40.157252073 CET	53	64791	1.1.1.1	192.168.2.16
Nov 21, 2024 10:34:59.093034983 CET	53	58258	1.1.1.1	192.168.2.16
Nov 21, 2024 10:35:19.793473959 CET	138	138	192.168.2.16	192.168.2.255
Nov 21, 2024 10:35:20.882061958 CET	53	63707	1.1.1.1	192.168.2.16
Nov 21, 2024 10:35:22.125569105 CET	53	61904	1.1.1.1	192.168.2.16
Nov 21, 2024 10:35:51.031637907 CET	53	64101	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 10:34:21.613945961 CET	192.168.2.16	1.1.1.1	0x365f	Standard query (0)	cardpayment.microransom.us	A (IP address)	IN (0x0001)	false
Nov 21, 2024 10:34:21.614183903 CET	192.168.2.16	1.1.1.1	0xd97	Standard query (0)	cardpayment.microransom.us	65	IN (0x0001)	false
Nov 21, 2024 10:34:24.539273977 CET	192.168.2.16	1.1.1.1	0x8e33	Standard query (0)	secure.encryptedconnection.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 10:34:24.539450884 CET	192.168.2.16	1.1.1.1	0xa696	Standard query (0)	secure.encryptedconnection.net	65	IN (0x0001)	false
Nov 21, 2024 10:34:25.518539906 CET	192.168.2.16	1.1.1.1	0x2c0e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 10:34:25.518599033 CET	192.168.2.16	1.1.1.1	0xa024	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 10:34:31.705008030 CET	192.168.2.16	1.1.1.1	0x489d	Standard query (0)	secure.encryptedconnection.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 10:34:31.705274105 CET	192.168.2.16	1.1.1.1	0x4f28	Standard query (0)	secure.encryptedconnection.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 10:34:21.863899946 CET	1.1.1.1	192.168.2.16	0xd97	No error (0)	cardpayment.microransom.us	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 10:34:21.907295942 CET	1.1.1.1	192.168.2.16	0x365f	No error (0)	cardpayment.microransom.us	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 10:34:21.907295942 CET	1.1.1.1	192.168.2.16	0x365f	No error (0)	landing.eu.knowbe4.com		52.214.139.140	A (IP address)	IN (0x0001)	false
Nov 21, 2024 10:34:21.907295942 CET	1.1.1.1	192.168.2.16	0x365f	No error (0)	landing.eu.knowbe4.com		54.194.166.37	A (IP address)	IN (0x0001)	false
Nov 21, 2024 10:34:24.779736042 CET	1.1.1.1	192.168.2.16	0x8e33	No error (0)	secure.encryptedconnection.net	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 10:34:24.779736042 CET	1.1.1.1	192.168.2.16	0x8e33	No error (0)	landing.eu.knowbe4.com		52.214.139.140	A (IP address)	IN (0x0001)	false
Nov 21, 2024 10:34:24.779736042 CET	1.1.1.1	192.168.2.16	0x8e33	No error (0)	landing.eu.knowbe4.com		54.194.166.37	A (IP address)	IN (0x0001)	false
Nov 21, 2024 10:34:24.780091047 CET	1.1.1.1	192.168.2.16	0xa696	No error (0)	secure.encryptedconnection.net	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 10:34:25.744568110 CET	1.1.1.1	192.168.2.16	0x2c0e	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Nov 21, 2024 10:34:25.744652033 CET	1.1.1.1	192.168.2.16	0xa024	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 10:34:31.958758116 CET	1.1.1.1	192.168.2.16	0x489d	No error (0)	secure.encryptedconnection.net	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 10:34:31.958758116 CET	1.1.1.1	192.168.2.16	0x489d	No error (0)	landing.eu.knowbe4.com		52.214.139.140	A (IP address)	IN (0x0001)	false
Nov 21, 2024 10:34:31.958758116 CET	1.1.1.1	192.168.2.16	0x489d	No error (0)	landing.eu.knowbe4.com		54.194.166.37	A (IP address)	IN (0x0001)	false
Nov 21, 2024 10:34:31.993648052 CET	1.1.1.1	192.168.2.16	0x4f28	No error (0)	secure.encryptedconnection.net	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

cardpayment.microransom.us

https:

secure.encryptedconnection.net

slscr.update.microsoft.com

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49708	52.214.139.140	443	2456	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 09:34:23 UTC	1052	OUT	GET /XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779 HTTP/1.1 Host: cardpayment.microransom.us Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 09:34:24 UTC	574	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 09:34:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 550 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade ETag: W/"588aa64ed82f13b257cb957b2d7523e1" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: 7f0359bb-6d72-4662-a0c3-59c743246eff X-Runtime: 0.037726 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-21 09:34:24 UTC	550	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 2e 65 6e 63 72 79 70 74 65 64 63 6f 6e 6e 65 63 74 69 6f 6e 2e 6e 65 74 2f 70 61 67 65 73 2f 33 30 36 61 34 33 66 34 65 34 39 34 31 65 35 38 62 37 38 35 35 32 37 32 36 37 65 30 37 61 30 64 2f 58 59 6d 64 4b 52 30 30 34 63 32 70 72 64 54 51 33 65 46 52 59 64 54 5a 6c 55 6c 41 77 53 47 68 73 63 6c 55 32 56 33 4a 6e 4d 57 70 75 5a 32 68 33 4e 6a 67 32 65 6d 56 30 55 33 5a 4c 59 31 5a 34 52 6b 70 4e 5a 6d 39 48 62 6b 70 48 63 6b 39 53 4e 6a 46 48 62 30 31 59 65 6d 35 6a 53 44 56 53 62 32 52 6d 61 58 52 49 57 55 4e 76 4e 32 67 31 55 48 52 34 4e 6c 4e 7a 4d 30 Data Ascii: <html> <head> <script>window.location.href = 'https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49710	52.214.139.140	443	2456	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 09:34:26 UTC	1496	OUT	GET /pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09 HTTP/1.1 Host: secure.encryptedconnection.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 09:34:28 UTC	834	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 09:34:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 189104 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Link: </assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css>; rel=preload; as=style; nopush,</assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js>; rel=preload; as=script; nopush ETag: W/"92b1ce0e62e8f62f91083f1ca2553ae2" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: 5cdc6d84-69e5-4a6c-b492-c3578e0d5ae3 X-Runtime: 1.238040 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-21 09:34:28 UTC	15550	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 49 4d 50 4f 52 54 41 4e 54 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 70 61 67 65 20 69 73 20 70 61 72 74 20 6f 66 20 61 20 73 69 6d 75 6c 61 74 65 64 20 70 68 69 73 68 69 6e 67 20 61 74 74 61 63 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"> <meta name="IMPORTANT" content="This page is part of a simulated phishing attac
2024-11-21 09:34:28 UTC	16384	IN	Data Raw: 67 6d 4a 61 51 70 6b 47 4f 6a 77 47 67 49 68 42 77 4c 44 4a 57 75 46 46 6a 49 56 6d 6c 72 74 78 37 6f 41 52 68 72 56 37 52 31 62 64 55 44 4b 42 55 72 72 56 70 31 32 72 53 74 42 36 31 71 70 65 36 79 75 31 69 68 55 7a 65 31 44 56 6d 6c 45 53 36 43 68 4c 30 4c 35 49 43 30 62 6b 31 53 4a 33 2f 48 66 72 31 75 37 59 75 76 2f 66 78 39 38 65 6a 74 37 2b 38 6e 41 41 4d 41 41 4a 79 6d 65 65 33 74 32 62 58 37 6a 73 79 5a 4d 79 65 4a 4c 57 44 47 31 39 79 4c 35 6d 62 4c 74 75 33 70 37 4f 79 71 39 79 67 41 41 41 42 63 77 41 52 67 41 41 43 41 30 31 52 56 56 64 62 66 38 4a 59 4d 44 51 2b 6e 77 59 59 6d 34 36 51 6f 69 6a 51 31 4e 57 64 34 33 5a 75 7a 66 73 50 47 4e 44 59 31 31 58 73 6b 41 41 41 41 4c 6d 41 43 4d 41 41 41 77 42 6d 59 4e 58 74 32 44 72 37 6a 6e 6c 79 79 72 Data Ascii: gmJaQpkGOjwGgIhBwLDJWuFFjIVmlrtx7oARhrV7R1bdUDKBUrrVp12rStB61qpe6yu1ihUze1DVmlES6ChL0L5IC0bk1SJ3/Hfr1u7Yuv/fx98ejt7+8nAAMAAJymee3t2bX7jsyZMyeJLWDG19yL5mbLtu3p7Oyq9ygAAABcwARgAACA01RVVdbf8JYMDQ+nwYYm46QoijQ1NWd43ZuzfsPGNDY11XskAAAALmACMAAAwBmYNXt2Dr7jnlyyr
2024-11-21 09:34:28 UTC	56	IN	Data Raw: 2b 46 48 63 44 66 76 6e 33 44 33 46 6b 7a 38 50 48 6a 42 38 59 2b 6a 52 6f 33 77 56 4a 50 4c 34 58 6d 55 55 66 59 45 6d 58 59 73 76 43 46 35 46 5a 4d 44 48 5a 75 33 30 Data Ascii: +FHcDfvn3D3Fkz8PHjB8Y+jRo3wVJPL4XmUUfYEmXYsvCF5FZMDHZu30
2024-11-21 09:34:28 UTC	16384	IN	Data Raw: 72 73 73 33 4c 4e 4f 6c 68 62 31 78 54 49 49 67 71 46 6f 6b 35 51 42 7a 43 46 55 67 7a 34 6e 4a 70 4b 62 44 63 32 4e 75 5a 73 4c 72 61 48 62 61 61 4d 4c 55 56 4a 53 76 71 49 49 77 63 50 59 4f 2f 75 6e 63 53 49 55 42 30 64 45 53 64 52 6c 4c 2b 54 6b 35 4d 44 6e 34 73 58 73 47 48 74 61 75 4c 44 4e 56 42 59 6b 30 5a 56 2b 66 7a 35 4d 79 35 46 4d 6d 63 70 2f 43 35 4c 2b 68 30 33 39 7a 5a 59 37 53 58 5a 38 66 33 77 77 51 4d 38 65 2f 70 45 61 73 65 50 76 72 35 77 45 74 42 41 6f 62 54 71 6e 48 6b 4c 73 57 6a 2b 48 4b 6e 36 66 30 70 4f 78 6f 5a 31 61 33 44 34 30 41 47 4d 48 44 30 57 67 34 63 4f 56 31 6b 6e 45 30 55 32 53 4d 45 50 54 73 36 75 45 6d 76 50 4e 72 52 74 68 41 6f 56 4b 2b 4c 39 75 33 64 46 32 73 54 69 50 50 6a 37 2b 57 4c 77 30 47 47 63 32 69 6b 50 42 Data Ascii: rss3LNOlhb1xTIIgqFok5QBzCFUgz4nJpKbDc2NuZsLraHbaaMLUVJSvqIIwcPYO/uncSIUB0dESdRlL+Tk5MDn4sXsGHtauLDNVBYk0ZV+fz5My5FMmcp/C5L+h039zZY7SXZ8f3wwQM8e/pEasePvr5wEtBAobTqnHkLsWj+HKn6f0pOxoZ1a3D40AGMHD0Wg4cOV1knE0U2SMEPTs6uEmvPNrRthAoVK+L9u3dF2sTiPPj7+WLw0GGc2ikPB
2024-11-21 09:34:28 UTC	16384	IN	Data Raw: 54 5a 69 6d 56 67 61 47 79 49 7a 50 51 73 66 49 6a 36 69 4f 69 49 64 2b 44 78 43 6c 56 74 4c 67 44 36 7a 76 37 73 6c 46 54 39 33 63 7a 43 46 4d 61 6d 78 67 72 76 39 2f 33 62 39 78 4c 52 2f 75 4b 69 69 33 39 37 54 46 6b 36 44 6c 77 64 4c 6a 4c 53 4d 6a 47 36 79 32 52 45 68 55 63 58 64 37 4d 41 53 4c 59 4a 35 47 54 6e 49 43 30 6c 58 65 4d 32 67 65 49 63 4a 2f 2f 75 6c 46 51 35 6f 79 6c 30 64 48 58 67 56 71 73 4b 53 6a 6b 37 51 74 39 41 44 32 6e 4a 36 58 67 64 47 6f 55 76 48 37 38 57 64 39 4e 55 52 70 59 64 54 4e 58 33 54 4a 59 4d 6b 32 5a 4c 30 63 54 59 73 53 54 4c 31 46 2b 5a 6b 6d 4a 62 6f 56 42 2b 46 6d 54 4a 33 6c 2f 42 44 6b 33 35 4e 61 45 4f 34 46 2b 49 57 76 55 38 73 66 72 77 45 72 47 2f 38 58 69 46 53 45 74 4a 51 31 52 59 4e 4a 37 63 65 34 35 54 65 Data Ascii: TZimVgaGyIzPQsfIj6iOiId+DxClVtLgD6zv7slFT93czCFMamxgrv9/3b9xLR/uKii397TFk6DlwdLjLSMjG6y2REhUcXd7MASLYJ5GTnIC0lXeM2geIcJ//ulFQ5oyl0dHXgVqsKSjk7Qt9AD2nJ6XgdGoUvH78Wd9NURpYdTNX3TJYMk2ZL0cTYsSTL1F+ZkmJboVB+FmTJ3l/BDk35NaEO4F+IWvU8sfrwErG/8XiFSEtJQ1RYNJ7ce45Te
2024-11-21 09:34:29 UTC	16384	IN	Data Raw: 72 4d 72 4e 4f 57 66 4d 7a 50 7a 38 66 4c 6f 48 44 57 6e 79 52 44 71 4b 4c 45 76 48 37 50 52 4e 6a 72 36 65 6d 69 55 5a 76 36 38 50 42 32 59 77 49 74 50 6b 5a 2f 6c 71 73 4f 65 4f 4e 32 44 54 42 2f 38 77 7a 43 2b 5a 76 79 50 51 55 68 6a 30 4e 78 2b 31 4b 67 55 72 58 45 31 55 48 77 76 57 66 4d 2f 35 59 32 46 69 68 54 33 6f 6d 4a 39 4d 2f 4e 79 63 57 4c 52 36 48 34 39 43 36 57 4d 53 34 4b 42 6c 58 43 73 2f 35 6c 44 58 54 46 49 56 72 4c 55 52 61 70 4b 5a 49 44 48 55 52 6e 6b 47 61 6d 73 77 30 49 6b 72 4b 6a 41 4a 72 74 71 39 64 4f 33 32 4c 2b 4c 31 50 65 43 64 56 39 33 4e 43 77 6a 52 39 52 72 75 4f 71 55 4b 6f 71 63 65 69 49 69 62 49 58 2f 53 5a 49 69 38 54 50 7a 5a 61 74 50 30 69 37 50 34 72 77 34 65 31 48 77 67 68 63 79 74 6d 52 53 66 4d 6c 69 55 6f 2f 2b Data Ascii: rMrNOWfMzPz8fLoHDWnyRDqKLEvH7PRNjr6emiUZv68PB2YwItPkZ/lqsOeON2DTB/8wzC+ZvyPQUhj0Nx+1KgUrXE1UHwvWfM/5Y2FihT3omJ9M/NycWLR6H49C6WMS4KBlXCs/5lDXTFIVrLURapKZIDHURnkGamsw0IkrKjAJrtq9dO32L+L1PeCdV93NCwjR9RruOqUKoqceiIibIX/SZIi8TPzZatP0i7P4rw4e1HwghcytmRSfMliUo/+
2024-11-21 09:34:29 UTC	16384	IN	Data Raw: 6f 43 41 50 34 2b 63 68 46 48 66 7a 75 4a 62 38 66 32 51 65 39 68 33 65 46 64 76 51 70 76 50 43 37 6c 49 75 72 4a 43 2b 7a 62 63 41 68 50 37 6a 31 6a 6c 55 4e 5a 6d 52 52 6d 2f 37 58 66 59 47 70 6d 4b 76 58 37 48 39 68 38 46 4a 64 4f 58 41 4d 41 62 44 37 78 43 35 77 2f 74 34 2f 38 33 48 79 4d 2b 57 59 4b 4b 2f 2b 32 30 2b 73 5a 37 77 50 43 65 5a 54 56 59 79 53 52 6c 35 32 48 39 41 38 5a 55 76 4d 4a 79 75 62 69 69 53 73 52 47 78 47 48 7a 76 33 61 59 38 53 30 77 55 78 64 54 4f 6f 31 55 2b 59 59 71 64 39 4e 48 30 4b 34 32 33 38 5a 45 59 65 6c 55 39 59 51 43 78 79 4b 36 4a 48 4b 74 68 6c 56 39 44 4f 71 61 50 75 71 30 4d 46 55 32 66 59 46 32 7a 42 51 67 53 6e 39 66 30 42 61 61 6a 6f 72 33 37 77 4e 73 31 43 33 61 57 30 6d 76 58 37 75 46 73 4b 49 32 4c 68 4e 51 Data Ascii: oCAP4+chFHfzuJb8f2Qe9h3eFdvQpvPC7lIurJC+zbcAhP7j1jlUNZmRRm/7XfYGpmKvX7H9h8FJdOXAMAbD7xC5w/t4/83HyM+WYKK/+20+sZ7wPCeZTVYySRl52H9A8ZUvMJyubiiSsRGxGHzv3aY8S0wUxdTOo1U+YYqd9NH0K4238ZEYelU9YQCxyK6JHKthlV9DOqaPuq0MFU2fYF2zBQgSn9f0Baajor37wNs1C3aW0mvX7uFsKI2LhNQ
2024-11-21 09:34:29 UTC	16384	IN	Data Raw: 78 68 30 6e 4e 2b 6d 59 59 37 6c 78 2b 6f 37 50 6b 55 69 71 7a 51 45 38 41 55 6d 54 45 77 4e 47 41 74 56 4a 65 57 63 72 48 75 78 38 30 53 34 34 59 4b 45 33 4c 37 4b 63 73 76 76 36 65 50 4f 39 70 32 62 34 56 32 50 56 71 68 54 71 4e 41 32 43 73 51 56 33 44 70 35 44 57 45 47 77 77 6a 59 79 4d 30 61 46 45 58 6e 66 75 31 52 35 4f 32 51 66 41 4e 38 46 48 72 72 6c 74 5a 4f 58 2f 6b 45 72 47 6a 30 64 7a 53 44 46 33 36 64 30 44 6e 66 75 33 68 35 4f 71 41 6c 35 46 78 53 70 31 73 69 49 75 4f 52 2f 68 6a 63 69 65 71 6b 35 73 6a 76 4b 74 37 73 59 79 43 65 39 63 66 77 69 57 42 57 47 78 36 65 6e 71 6f 57 63 38 66 48 66 75 30 52 59 76 4f 54 56 47 7a 6e 6a 2b 7a 32 4b 42 4a 64 4c 56 63 41 4f 39 55 33 4d 49 4a 4b 34 6a 54 63 62 59 4f 4e 6d 6a 57 6f 54 45 36 39 57 32 48 42 Data Ascii: xh0nN+mYY7lx+o7PkUiqzQE8AUmTEwNGAtVJeWcrHux80S44YKE3L7Kcsvv6ePO9p2b4V2PVqhTqNA2CsQV3Dp5DWEGwwjYyM0aFEXnfu1R5O2QfAN8FHrrltZOX/kErGj0dzSDF36d0Dnfu3h5OqAl5FxSp1siIuOR/hjcieqk5sjvKt7sYyCe9cfwiWBWGx6enqoWc8fHfu0RYvOTVGznj+z2KBJdLVcAO9U3MIJK4jTcbYONmjWoTE69W2HB
2024-11-21 09:34:29 UTC	16384	IN	Data Raw: 51 51 51 67 67 68 68 48 78 71 56 41 4b 61 45 45 49 49 49 59 53 6f 31 4c 48 64 70 78 42 38 34 67 71 53 50 36 62 49 6e 42 38 64 46 59 50 74 4b 2f 5a 67 53 74 2f 5a 72 4a 4b 64 41 4a 44 77 2f 67 4d 6d 39 4a 71 4a 4d 77 66 50 49 7a 4d 39 55 32 72 64 39 4e 51 4d 48 4e 74 31 45 70 6b 5a 57 56 4c 7a 50 71 58 6a 65 30 35 6a 61 74 2f 76 63 65 76 76 4f 38 6a 4c 7a 5a 4f 61 6e 35 2b 58 6a 35 76 42 64 33 44 68 36 4e 38 79 31 70 5a 32 35 30 71 49 7a 4c 45 62 4d 39 4d 7a 63 65 62 67 65 55 77 62 38 41 4e 72 50 45 6c 56 39 4b 47 71 2f 72 31 30 46 30 64 32 6e 6d 41 46 41 73 57 6c 4a 4b 62 69 35 4a 39 6e 4d 63 4a 2f 49 6c 34 2b 65 61 58 77 39 70 64 4d 57 34 56 46 6b 31 66 69 57 65 67 4c 71 52 4b 6a 41 4a 43 57 6e 49 61 67 77 78 66 78 38 4a 5a 38 6d 61 30 41 73 47 4c 32 57 Data Ascii: QQQgghhHxqVAKaEEIIIYSo1LHdpxB84gqSP6bInB8dFYPtK/ZgSt/ZrJKdAJDw/gMm9JqJMwfPIzM9U2rd9NQMHNt1EpkZWVLzPqXje05jat/vcevvO8jLzZOan5+Xj5vBd3Dh6N8y1pZ250qIzLEbM9MzcebgeUwb8ANrPElV9KGq/r10F0d2nmAFAsWlJKbi5J9nMcJ/Il4+eaXw9pdMW4VFk1fiWegLqRKjAJCWnIagwxfx8JZ8ma0AsGL2W
2024-11-21 09:34:29 UTC	16384	IN	Data Raw: 31 51 62 4e 71 38 74 66 67 31 4d 62 65 77 77 4f 4b 6c 79 35 47 54 6e 59 32 44 42 2f 37 6b 33 65 65 52 6c 2f 42 33 76 66 4b 75 67 77 76 49 65 75 38 49 72 50 38 72 6f 78 52 6c 6b 5a 36 39 2b 75 44 62 45 53 50 68 31 4d 6f 5a 65 6e 70 36 45 43 63 6d 49 70 70 52 6c 72 57 73 2f 50 7a 4b 6c 76 6d 63 6c 5a 57 46 7a 52 76 58 34 38 2b 39 75 35 6e 37 47 52 6b 62 6f 35 31 72 42 30 37 37 46 6f 2b 4e 67 67 2f 32 4e 33 68 73 78 5a 42 76 68 78 58 2f 33 4c 74 50 50 39 51 78 71 59 4d 68 67 37 39 69 37 71 4f 75 72 73 34 62 33 43 6b 69 56 48 71 34 4a 44 74 37 65 34 7a 39 59 54 78 63 76 33 52 44 6e 54 71 6d 79 4d 7a 49 51 48 42 51 45 4f 6f 33 4b 4d 78 6b 62 76 70 66 77 43 45 72 4b 77 76 68 6a 50 65 6d 53 4b 53 4f 48 6a 31 37 51 30 74 4c 75 66 36 39 38 50 75 75 50 5a 7a 72 48 Data Ascii: 1QbNq8tfg1MbewwOKly5GTnY2DB/7k3eeRl/B3vfKugwvIeu8IrP8roxRlkZ69+uDbESPh1MoZenp6ECcmIppRlrWs/PzKlvmclZWFzRvX48+9u5n7GRkbo51rB077Fo+Ngg/2N3hsxZBvhxX/3LtPP9QxqYMhg79i7qOurs4b3CkiVHq4JDt7e4z9YTxcv3RDnTqmyMzIQHBQEOo3KMxkbvpfwCErKwvhjPemSKSOHj17Q0tLuf698PuuPZzrH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49711	52.214.139.140	443	2456	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 09:34:28 UTC	1060	OUT	GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1 Host: secure.encryptedconnection.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 09:34:29 UTC	263	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 09:34:28 GMT Content-Type: text/css Content-Length: 1471 Connection: close Last-Modified: Wed, 20 Nov 2024 19:37:36 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-21 09:34:29 UTC	1471	IN	Data Raw: 2f 2a 20 6c 69 6e 65 20 31 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 74 65 72 6d 61 72 6b 2e 73 63 73 73 20 2a 2f 0a 2e 77 61 74 65 72 6d 61 72 6b 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 20 20 20 20 2d 6d 73 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 74 62 2d 72 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 74 65 78 74 2d 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 73 69 64 65 77 61 79 73 3b 0a 7d 0a 0a 2f 2a 20 6c 69 6e 65 20 34 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 Data Ascii: /* line 1, app/assets/stylesheets/landing-watermark.scss /.watermark { -webkit-writing-mode: vertical-rl; -ms-writing-mode: tb-rl; writing-mode: vertical-rl; text-orientation: sideways;}/ line 4, app/assets/stylesheets/landing-wa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49713	52.214.139.140	443	2456	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 09:34:30 UTC	1039	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: secure.encryptedconnection.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 09:34:30 UTC	279	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 09:34:30 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Wed, 20 Nov 2024 19:37:36 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-21 09:34:30 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-11-21 09:34:30 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-11-21 09:34:30 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-11-21 09:34:31 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-11-21 09:34:31 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-11-21 09:34:31 UTC	16384	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-11-21 09:34:31 UTC	16384	IN	Data Raw: 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 3d 21 31 21 3d 3d 65 2e 6a 73 6f 6e 70 26 26 28 5a 74 2e 74 65 73 74 28 65 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 61 74 61 26 26 30 3d 3d 3d 28 65 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 5a 74 2e 74 65 73 74 28 65 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 61 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 65 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 72 3d 65 2e 6a 73 6f 6e 70 43 61 6c Data Ascii: efilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Zt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Zt.test(e.data)&&"data");if(a\|\|"jsonp"===e.dataTypes[0])return r=e.jsonpCal
2024-11-21 09:34:31 UTC	16384	IN	Data Raw: 74 65 72 22 2c 69 5b 31 5d 3d 6c 2e 74 65 73 74 28 69 5b 31 5d 29 3f 69 5b 31 5d 3a 22 63 65 6e 74 65 72 22 2c 74 3d 68 2e 65 78 65 63 28 69 5b 30 5d 29 2c 65 3d 68 2e 65 78 65 63 28 69 5b 31 5d 29 2c 77 5b 74 68 69 73 5d 3d 5b 74 3f 74 5b 30 5d 3a 30 2c 65 3f 65 5b 30 5d 3a 30 5d 2c 75 5b 74 68 69 73 5d 3d 5b 63 2e 65 78 65 63 28 69 5b 30 5d 29 5b 30 5d 2c 63 2e 65 78 65 63 28 69 5b 31 5d 29 5b 30 5d 5d 7d 29 2c 31 3d 3d 3d 79 2e 6c 65 6e 67 74 68 26 26 28 79 5b 31 5d 3d 79 5b 30 5d 29 2c 22 72 69 67 68 74 22 3d 3d 3d 75 2e 61 74 5b 30 5d 3f 6d 2e 6c 65 66 74 2b 3d 70 3a 22 63 65 6e 74 65 72 22 3d 3d 3d 75 2e 61 74 5b 30 5d 26 26 28 6d 2e 6c 65 66 74 2b 3d 70 2f 32 29 2c 22 62 6f 74 74 6f 6d 22 3d 3d 3d 75 2e 61 74 5b 31 5d 3f 6d 2e 74 6f 70 2b 3d 66 3a Data Ascii: ter",i[1]=l.test(i[1])?i[1]:"center",t=h.exec(i[0]),e=h.exec(i[1]),w[this]=[t?t[0]:0,e?e[0]:0],u[this]=[c.exec(i[0])[0],c.exec(i[1])[0]]}),1===y.length&&(y[1]=y[0]),"right"===u.at[0]?m.left+=p:"center"===u.at[0]&&(m.left+=p/2),"bottom"===u.at[1]?m.top+=f:
2024-11-21 09:34:31 UTC	16384	IN	Data Raw: 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 2e 6f 66 66 73 65 74 28 29 2c 65 3d 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 3b 72 65 74 75 72 6e 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 21 3d 3d 65 26 26 56 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 2c 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 5b 30 5d 29 26 26 28 74 2e 6c 65 66 74 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 2c 74 2e 74 6f 70 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 Data Ascii: ffset:function(){var t=this.offsetParent.offset(),e=this.document[0];return"absolute"===this.cssPosition&&this.scrollParent[0]!==e&&V.contains(this.scrollParent[0],this.offsetParent[0])&&(t.left+=this.scrollParent.scrollLeft(),t.top+=this.scrollParent.scr
2024-11-21 09:34:31 UTC	16384	IN	Data Raw: 74 2e 6f 66 66 73 65 74 28 29 2c 6e 5b 69 5d 2e 70 72 6f 70 6f 72 74 69 6f 6e 73 28 7b 77 69 64 74 68 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 68 65 69 67 68 74 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7d 29 29 7d 7d 2c 64 72 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 56 2e 65 61 63 68 28 28 56 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 6f 70 70 61 62 6c 65 73 5b 74 2e 6f 70 74 69 6f 6e 73 2e 73 63 6f 70 65 5d 7c 7c 5b 5d 29 2e 73 6c 69 63 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 26 26 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 Data Ascii: t.offset(),n[i].proportions({width:n[i].element[0].offsetWidth,height:n[i].element[0].offsetHeight}))}},drop:function(t,e){var i=!1;return V.each((V.ui.ddmanager.droppables[t.options.scope]\|\|[]).slice(),function(){this.options&&(!this.options.disabled&&th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49714	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 09:34:32 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=rmUon3rGCBFCvfr&MD=Dlls5Rg3 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 09:34:32 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d8d1c1ef-8ddb-47b3-818d-f0235179d127 MS-RequestId: a0450c0a-d6d2-4cb9-a922-8e30da5962bc MS-CV: Cvvbr343BEGMkH0i.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 09:34:31 GMT Connection: close Content-Length: 24490
2024-11-21 09:34:32 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-21 09:34:32 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49715	52.214.139.140	443	2456	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 09:34:33 UTC	1024	OUT	GET /favicon.ico HTTP/1.1 Host: secure.encryptedconnection.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secure.encryptedconnection.net/pages/306a43f4e4941e58b785527267e07a0d/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 09:34:33 UTC	253	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 09:34:33 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Wed, 20 Nov 2024 19:38:18 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49716	52.214.139.140	443	2456	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 09:34:33 UTC	440	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: secure.encryptedconnection.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 09:34:34 UTC	279	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 09:34:33 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Wed, 20 Nov 2024 19:37:36 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-11-21 09:34:34 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-11-21 09:34:34 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-11-21 09:34:34 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-11-21 09:34:34 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-11-21 09:34:34 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-11-21 09:34:34 UTC	16384	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-11-21 09:34:34 UTC	16384	IN	Data Raw: 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 3d 21 31 21 3d 3d 65 2e 6a 73 6f 6e 70 26 26 28 5a 74 2e 74 65 73 74 28 65 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 61 74 61 26 26 30 3d 3d 3d 28 65 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 5a 74 2e 74 65 73 74 28 65 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 61 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 65 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 72 3d 65 2e 6a 73 6f 6e 70 43 61 6c Data Ascii: efilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Zt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Zt.test(e.data)&&"data");if(a\|\|"jsonp"===e.dataTypes[0])return r=e.jsonpCal
2024-11-21 09:34:34 UTC	16384	IN	Data Raw: 74 65 72 22 2c 69 5b 31 5d 3d 6c 2e 74 65 73 74 28 69 5b 31 5d 29 3f 69 5b 31 5d 3a 22 63 65 6e 74 65 72 22 2c 74 3d 68 2e 65 78 65 63 28 69 5b 30 5d 29 2c 65 3d 68 2e 65 78 65 63 28 69 5b 31 5d 29 2c 77 5b 74 68 69 73 5d 3d 5b 74 3f 74 5b 30 5d 3a 30 2c 65 3f 65 5b 30 5d 3a 30 5d 2c 75 5b 74 68 69 73 5d 3d 5b 63 2e 65 78 65 63 28 69 5b 30 5d 29 5b 30 5d 2c 63 2e 65 78 65 63 28 69 5b 31 5d 29 5b 30 5d 5d 7d 29 2c 31 3d 3d 3d 79 2e 6c 65 6e 67 74 68 26 26 28 79 5b 31 5d 3d 79 5b 30 5d 29 2c 22 72 69 67 68 74 22 3d 3d 3d 75 2e 61 74 5b 30 5d 3f 6d 2e 6c 65 66 74 2b 3d 70 3a 22 63 65 6e 74 65 72 22 3d 3d 3d 75 2e 61 74 5b 30 5d 26 26 28 6d 2e 6c 65 66 74 2b 3d 70 2f 32 29 2c 22 62 6f 74 74 6f 6d 22 3d 3d 3d 75 2e 61 74 5b 31 5d 3f 6d 2e 74 6f 70 2b 3d 66 3a Data Ascii: ter",i[1]=l.test(i[1])?i[1]:"center",t=h.exec(i[0]),e=h.exec(i[1]),w[this]=[t?t[0]:0,e?e[0]:0],u[this]=[c.exec(i[0])[0],c.exec(i[1])[0]]}),1===y.length&&(y[1]=y[0]),"right"===u.at[0]?m.left+=p:"center"===u.at[0]&&(m.left+=p/2),"bottom"===u.at[1]?m.top+=f:
2024-11-21 09:34:34 UTC	16384	IN	Data Raw: 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 2e 6f 66 66 73 65 74 28 29 2c 65 3d 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 3b 72 65 74 75 72 6e 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 21 3d 3d 65 26 26 56 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 2c 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 5b 30 5d 29 26 26 28 74 2e 6c 65 66 74 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 2c 74 2e 74 6f 70 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 Data Ascii: ffset:function(){var t=this.offsetParent.offset(),e=this.document[0];return"absolute"===this.cssPosition&&this.scrollParent[0]!==e&&V.contains(this.scrollParent[0],this.offsetParent[0])&&(t.left+=this.scrollParent.scrollLeft(),t.top+=this.scrollParent.scr
2024-11-21 09:34:34 UTC	16384	IN	Data Raw: 74 2e 6f 66 66 73 65 74 28 29 2c 6e 5b 69 5d 2e 70 72 6f 70 6f 72 74 69 6f 6e 73 28 7b 77 69 64 74 68 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 68 65 69 67 68 74 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7d 29 29 7d 7d 2c 64 72 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 56 2e 65 61 63 68 28 28 56 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 6f 70 70 61 62 6c 65 73 5b 74 2e 6f 70 74 69 6f 6e 73 2e 73 63 6f 70 65 5d 7c 7c 5b 5d 29 2e 73 6c 69 63 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 26 26 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 Data Ascii: t.offset(),n[i].proportions({width:n[i].element[0].offsetWidth,height:n[i].element[0].offsetHeight}))}},drop:function(t,e){var i=!1;return V.each((V.ui.ddmanager.droppables[t.options.scope]\|\|[]).slice(),function(){this.options&&(!this.options.disabled&&th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49717	52.214.139.140	443	2456	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 09:34:35 UTC	365	OUT	GET /favicon.ico HTTP/1.1 Host: secure.encryptedconnection.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 09:34:35 UTC	253	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 09:34:35 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Wed, 20 Nov 2024 19:38:18 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49718	2.23.209.189	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 09:34:49 UTC	2703	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: -300 X-DeviceID: 01000A4109009A83 X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75 X-Search-TimeZone: Bias=300; StandardBias=0; TimeZoneKeyName=Eastern Standard Time X-BM-Theme: 000000;0078d7 X-Agent-DeviceId: 01000A4109009A83 X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAeMRzuQup/5WvEKbE7YAq6XDFQ1piK9sGWgkVKizglM7gPg0iR4RjoLtM7JWgMyV%2B0aoZdOMoDhDl0VxGUveqRgpIYl6isqYhDNHvHjMBjPIgOXSrXWkNzslt3r6VkyLElBbNwIZ6LNN99r/0vJMKjZnFJCJR/aH7AwFP989ttuigT5Pody3rQmia5aKW2OAzpIuk4Xe/YJ6qyDX/amVjm8TdrrNMBSQEoIjtFSZ1G0ODI6ZAWgV6X4EYneHb0qFtSDE2yqZqGuOs3M%2B3q7RuKn/mlF7emx1hmpTlFzBiKZ4q%2Bq4Sqmu1SuTojyX%2BUmScVKp2XyMisdKCHYRAb%2BFhaAQZgAAEG2j3qNlyPkSvjJq9EYWUFCwAXqT%2BeUoLxdhRArJxjeD2BehJYEXiL44xuEZZ70rC5fWh4Fvw0RLqWlXcj6Sw6jttk3veicVusveq%2BW7Fz%2BVUm6IIxxO0FTUDWFx1%2BlD/EvrKqhb66hj46BsCDDVPStD09jK9WMw2b1NCjT1SvpSn0uW/ROTX7xZB8zaTJ7bBOq9PH5sA/A1aZc9y%2B5/FvcvlxVRS2B8ABWFx5bIfGB4q5iwROe/bZ/zSrx6OcfnlCs%2BAWvbXIaJyjMLpGs6zX6iB3KtQIGSuEEm8s/LZWzF14oo3v/geBHCIJ14IqvaCDWDvK7w2QIcsnNeSfCoC7IN33Obd%2Bw%2B2n8bkKPQe7S5VfMACFaoO5PeflxcUaw4JOBMgJ%2BIWrfPfVfd7J/09mDLF6Yac1ts3AY2X0xl/UAwJzztIjhO9/z%2BKeiy/Jtq%2BkN4QIZfeDMcDlLUa6jt/ayZElbcXeSEwIX/4HOduTg3v2MisiJ6XXeMPRe2OwESie4niCZcSq3pAS%2Bz2j58p6/z6YiP6anK1R0z%2BPT4VJRlZxCkbeS%2BLk/T1at34TF [TRUNCATED] X-BM-CBT: 1732181686 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: 1F65C95488C14F3C98AF2CCFA1A0A48F X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=3a628620&IPMID=1707317755885; MUID=5047E5942BB2460EA35B53CCF78DDB3D; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-11-21 09:34:49 UTC	1319	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 673efeb9d9ef4718820319ed7cb2382a X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Thu, 21 Nov 2024 09:34:49 GMT Connection: close Set-Cookie: _EDGE_S=SID=0C7A0F4038EB6F6D012A1A7E39BC6EB0&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=en&HV=1707317784&IPMH=3a628620&IPMID=1707317755885; domain=.bing.com; expires=Tue, 16-Dec-2025 09:34:49 GMT; path=/; secure; SameSite=None Set-Cookie: ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; domain=.bing.com; expires=Tue, 16-Dec-2025 09:34:49 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=0C7A0F4038EB6F6D012A1A7E39BC6EB0; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15d01702.1732181689.ab3d88b
2024-11-21 09:34:49 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49719	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 09:35:11 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=rmUon3rGCBFCvfr&MD=Dlls5Rg3 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 09:35:12 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 16f776dd-6560-4a6c-86c6-8343cc34bc43 MS-RequestId: 0dfb4e12-44e9-47f6-815a-55fdba49f29a MS-CV: KR3PMPgWYkaiB2vj.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 09:35:11 GMT Connection: close Content-Length: 30005
2024-11-21 09:35:12 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-21 09:35:12 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	04:34:19
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	04:34:19
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1876,i,16783391306513579524,5699982791856897382,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	04:34:21
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6916, Parent PID: 3972