Edit tour

Windows Analysis Report
https://email.cloud.secureclick.net/c/56657?id=9320.16.1.33e19ff7c4e153555ce8ae2ca531d282

Overview

General Information

Sample URL:	https://email.cloud.secureclick.net/c/56657?id=9320.16.1.33e19ff7c4e153555ce8ae2ca531d282
Analysis ID:	1561214
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected suspicious crossdomain redirect

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64native

chrome.exe (PID: 7808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 2132 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2196,i,16079074356059325000,1756189301792084668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2212 /prefetch:3 MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 7380 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.cloud.secureclick.net/c/56657?id=9320.16.1.33e19ff7c4e153555ce8ae2ca531d282" MD5: BB7C48CDDDE076E7EB44022520F40F77)

cleanup

HTTP traffic detected: POST /report/v4?s=vYeOswBuoP44ZAQOa4ANXv3Fd34GRE93K9d%2BLBX1o2CAEBJyCC%2BcxPB3ksIttXa1ZVIuuy70atJJJpX0GspUZalQC%2BWlNoHo7I4n6b%2BgaKQc145DiLVqYolvvw%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 433Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: https://hctit.io/explore	HTTP Parser: No favicon
Source: https://hctit.io/explore	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\scoped_dir7808_2017501319			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_7808_335096325			Jump to behavior

Source: unknown	HTTPS traffic detected: 23.199.50.2:443 -> 192.168.11.20:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.50.2:443 -> 192.168.11.20:49767 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.57.90.167
Source: unknown	TCP traffic detected without corresponding DNS query: 23.57.90.167
Source: unknown	TCP traffic detected without corresponding DNS query: 23.57.90.167
Source: unknown	TCP traffic detected without corresponding DNS query: 23.57.90.167
Source: unknown	TCP traffic detected without corresponding DNS query: 23.57.90.167
Source: unknown	TCP traffic detected without corresponding DNS query: 23.57.90.167
Source: unknown	TCP traffic detected without corresponding DNS query: 23.57.90.167
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 104.208.16.92
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 104.208.16.92
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.148
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.148
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.148
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.148
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.57.90.147
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.57.90.171
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /c/56657?id=9320.16.1.33e19ff7c4e153555ce8ae2ca531d282 HTTP/1.1Host: email.cloud.secureclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/website/9292f6b8-c30c-455a-b125-cc4b63423204/feed?categories=aa978083-0e0f-485d-9b4d-7422c0d0f308,90f1f722-c6dd-4a97-9d83-12b75da2c3f6,0cf9de48-14d9-45c2-8dd6-2baf1123ca7c,c29065e2-5985-4db3-bfd7-ffb539c53741,887039bd-46ff-43ad-8e50-9abc67da9c27,580198c2-0cff-4f45-a1b3-d3558597f95c,bbaecd39-7a26-4abd-ae3c-9560f6450e47,e55f215e-7ed9-47ca-9565-94f22078cc8a,7d4b2bcb-a88a-4ae6-a644-637d4061bbb0,936b7b82-68b8-4196-83ac-e0f30ef2d362&pageItems=10&pageSelected=1 HTTP/1.1Host: blog.apps.secureserver.netConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://hctit.ioSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/website/9292f6b8-c30c-455a-b125-cc4b63423204/categories HTTP/1.1Host: blog.apps.secureserver.netConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://hctit.ioSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/website/9292f6b8-c30c-455a-b125-cc4b63423204/categories HTTP/1.1Host: blog.apps.secureserver.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/website/9292f6b8-c30c-455a-b125-cc4b63423204/feed?categories=aa978083-0e0f-485d-9b4d-7422c0d0f308,90f1f722-c6dd-4a97-9d83-12b75da2c3f6,0cf9de48-14d9-45c2-8dd6-2baf1123ca7c,c29065e2-5985-4db3-bfd7-ffb539c53741,887039bd-46ff-43ad-8e50-9abc67da9c27,580198c2-0cff-4f45-a1b3-d3558597f95c,bbaecd39-7a26-4abd-ae3c-9560f6450e47,e55f215e-7ed9-47ca-9565-94f22078cc8a,7d4b2bcb-a88a-4ae6-a644-637d4061bbb0,936b7b82-68b8-4196-83ac-e0f30ef2d362&pageItems=10&pageSelected=1 HTTP/1.1Host: blog.apps.secureserver.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/pusher/7.0.1/pusher.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/pusher/7.0.1/pusher.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/default_avatars/missing-10-5ce634cdae779ed9e2b9e98703146e66f679c2551411727861775decd53396f3.png HTTP/1.1Host: reamaze.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/default_avatars/missing-10-5ce634cdae779ed9e2b9e98703146e66f679c2551411727861775decd53396f3.png HTTP/1.1Host: reamaze.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v4/videos/raw/video/uvb3OY5vvzF0ewv1Z HTTP/1.1Host: categories.api.godaddy.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoAccept-Language: en-US,en;q=0.9Range: bytes=0-
Source: global traffic	HTTP traffic detected: GET /v4/videos/raw/video/uvb3OY5vvzF0ewv1Z HTTP/1.1Host: categories.api.godaddy.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoAccept-Language: en-US,en;q=0.9Range: bytes=0-

Source: global traffic	DNS traffic detected: DNS query: email.cloud.secureclick.net
Source: global traffic	DNS traffic detected: DNS query: hctit.io
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: isteam.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.reamaze.com
Source: global traffic	DNS traffic detected: DNS query: blog.apps.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: events.api.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: csp.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: push.reamaze.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: reamaze.com
Source: global traffic	DNS traffic detected: DNS query: 9292f6b8-c30c-455a-b125-cc4b63423204.reamaze.io
Source: global traffic	DNS traffic detected: DNS query: categories.api.godaddy.com

Source: global traffic	TCP traffic: 192.168.11.20:61684 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:61684 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:61684 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:61684 -> 239.255.255.250:1900

Source: chromecache_198.1.dr, chromecache_181.1.dr	String found in binary or memory: http://ns.attribution.com/ads/1.0/
Source: chromecache_327.1.dr, chromecache_262.1.dr	String found in binary or memory: https://pusher.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2196,i,16079074356059325000,1756189301792084668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2212 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.cloud.secureclick.net/c/56657?id=9320.16.1.33e19ff7c4e153555ce8ae2ca531d282"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2196,i,16079074356059325000,1756189301792084668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2212 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Network Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	Malicious	Reputation
https://email.cloud.secureclick.net/c/56657?id=9320.16.1.33e19ff7c4e153555ce8ae2ca531d282	false	high
https://blog.apps.secureserver.net/v1/website/9292f6b8-c30c-455a-b125-cc4b63423204/feed?categories=aa978083-0e0f-485d-9b4d-7422c0d0f308,90f1f722-c6dd-4a97-9d83-12b75da2c3f6,0cf9de48-14d9-45c2-8dd6-2baf1123ca7c,c29065e2-5985-4db3-bfd7-ffb539c53741,887039bd-46ff-43ad-8e50-9abc67da9c27,580198c2-0cff-4f45-a1b3-d3558597f95c,bbaecd39-7a26-4abd-ae3c-9560f6450e47,e55f215e-7ed9-47ca-9565-94f22078cc8a,7d4b2bcb-a88a-4ae6-a644-637d4061bbb0,936b7b82-68b8-4196-83ac-e0f30ef2d362&pageItems=10&pageSelected=1	false	high
https://a.nel.cloudflare.com/report/v4?s=ShvDxioIH9Ge7%2FX6G36yETcM8ZBC7uMXhxlh66Ivrxo50tJB%2FF5u9JcmLKLf1TmRO4iJuwiC2t4v2MqpcDebqyZ0ZhsEgtqARtx71kqFzdNWo7S2TLIYAY1AFw%3D%3D	false	high
https://cdnjs.cloudflare.com/ajax/libs/pusher/7.0.1/pusher.min.js	false	high
https://blog.apps.secureserver.net/v1/website/9292f6b8-c30c-455a-b125-cc4b63423204/categories	false	high
https://reamaze.com/assets/default_avatars/missing-10-5ce634cdae779ed9e2b9e98703146e66f679c2551411727861775decd53396f3.png	false	high
https://categories.api.godaddy.com/v4/videos/raw/video/uvb3OY5vvzF0ewv1Z	false	high
https://hctit.io/blog/f/analyzing-the-attack-surface	false	unknown
https://hctit.io/	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.81.232	hctit.io	United States	13335	CLOUDFLARENETUS	false
104.22.9.8	cdn.reamaze.com	United States	13335	CLOUDFLARENETUS	false
52.2.232.243	isteam.wsimg.com	United States	14618	AMAZON-AESUS	false
45.40.130.49	proxy.k8s.pnc.phx.secureserver.net	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
198.71.248.123	proxy.pnc.geodns.secureserver.net	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
52.35.11.151	sable-apps-click-prod-a-256975612.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
172.67.28.250	push.reamaze.com	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
100.27.64.136	reamaze.us-east-1.fd.aws.gdcld.net	United States	14618	AMAZON-AESUS	false
35.71.189.132	unknown	United States	237	MERIT-AS-14US	false
142.250.81.228	www.google.com	United States	15169	GOOGLEUS	false
52.223.43.160	reamaze.com	United States	8987	AMAZONEXPANSIONGB	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561214
Start date and time:	2024-11-22 22:44:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://email.cloud.secureclick.net/c/56657?id=9320.16.1.33e19ff7c4e153555ce8ae2ca531d282
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/273@52/15

Name	IP	Active	Malicious	Reputation
reamaze.com	52.223.43.160	true	false	high
sable-apps-click-prod-a-256975612.us-west-2.elb.amazonaws.com	52.35.11.151	true	false	high
reamaze.us-east-1.fd.aws.gdcld.net	100.27.64.136	true	false	high
hctit.io	104.21.81.232	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
proxy.pnc.geodns.secureserver.net	198.71.248.123	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
proxy.k8s.pnc.phx.secureserver.net	45.40.130.49	true	false	high
www.google.com	142.250.81.228	true	false	high
cdn.reamaze.com	104.22.9.8	true	false	high
isteam.wsimg.com	52.2.232.243	true	false	high
push.reamaze.com	172.67.28.250	true	false	high
img1.wsimg.com	unknown	unknown	false	high
events.api.secureserver.net	unknown	unknown	false	high
csp.secureserver.net	unknown	unknown	false	high
email.cloud.secureclick.net	unknown	unknown	false	high
categories.api.godaddy.com	unknown	unknown	false	high
9292f6b8-c30c-455a-b125-cc4b63423204.reamaze.io	unknown	unknown	false	unknown
blog.apps.secureserver.net	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
http://ns.attribution.com/ads/1.0/	chromecache_198.1.dr, chromecache_181.1.dr	false	Avira URL Cloud: safe	unknown
https://pusher.com/	chromecache_327.1.dr, chromecache_262.1.dr	false		high

Input	Output
URL: https://email.cloud.secureclick.net Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://email.cloud.secureclick.net
URL: https://hctit.io/blog/f/analyzing-the-attack-surface Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Analyzing the Attack Surface", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://hctit.io/blog/f/analyzing-the-attack-surface Model: Joe Sandbox AI	{ "brands": [ "HCT" ] }
	{ "brands": [ "HCT" ] }
URL: https://hctit.io/blog/f/analyzing-the-attack-surface Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "VIEW SHARED FILE", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://hctit.io/blog/f/analyzing-the-attack-surface Model: Joe Sandbox AI	{ "brands": [ "HCT" ] }
	{ "brands": [ "HCT" ] }
URL: https://hctit.io/explore Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Discover HCT's Cybersecurity Services", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://hctit.io/explore Model: Joe Sandbox AI	{ "brands": [ "HCT" ] }
	{ "brands": [ "HCT" ] }
URL: https://hctit.io/explore Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Discover HCT's Cybersecurity Services", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://hctit.io/explore Model: Joe Sandbox AI	{ "brands": [ "HCT" ] }
	{ "brands": [ "HCT" ] }
URL: https://hctit.io/explore Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Discover HCT's Cybersecurity Services", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://hctit.io/explore Model: Joe Sandbox AI	{ "brands": [ "HCT" ] }
	{ "brands": [ "HCT" ] }
URL: https://hctit.io/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Protecting Critical Industries with Specialized Cybersecurity", "prominent_button_name": "EXPLORE OUR SERVICES", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://hctit.io/ Model: Joe Sandbox AI	{ "brands": [ "HCT" ] }
	{ "brands": [ "HCT" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 240 x 240, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1700
Entropy (8bit):	7.849138224811432
Encrypted:	false
SSDEEP:	24:TjXcrRUSDEPkclzF9WQCis+PY96wVlhNkXr8rHOqRZ/lQaUYHNMEr5KbdsULPt5z:T7cNU9PkYrnPY9VlhNCr4//+dEMNvz
MD5:	850C5AD6D367F3E2A61195A9A579D64B
SHA1:	7B717C60E7104ED000B96290FD9820273CB23D16
SHA-256:	5CE634CDAE779ED9E2B9E98703146E66F679C2551411727861775DECD53396F3
SHA-512:	554B8985D7DBFEDB34F65B2A9A51B36CDE898A68A3D3E41FEBF1687DB9DCA79054465A198C8AA817219FD08C077CC8EBDEAEACB7512798EC1D045242615DCE92
Malicious:	false
Reputation:	low
URL:	https://reamaze.com/assets/default_avatars/missing-10-5ce634cdae779ed9e2b9e98703146e66f679c2551411727861775decd53396f3.png
Preview:	.PNG........IHDR....................]PLTE...G......N.T.K.Y.b.....................{.f........j....w.H.r....].n.n.......IDATx.....0..`.F1....cf.d..f.5X..._.v>......8..8..8..8..8..8..8..8..8...O...."K.(..nx..U..);j..........k...fdu.k._.:..C.32....C..?L3..v..%.. %......g..K .i......Yt.,....L<..md......3..L..R)`!.0.x-..x..Jx.o.e~..y.8.."a..2..^.Bk..p.`@qa..:0"...J.F..N...C........}.q0.G..8m..+.y.....z......ob.$.9.(..0.c../.0.Snb....r.....L[.r0N....-..t.~..'../..@.....>. ..w.x......O...'...5..+#....4}Q..]3..x..E~...E.`<[..k...0.I.....o.i..g...]a...*.U.T_...U....y.......X...U.i......VPQ..A\|.!.fTps......F.O..G..Y......a.$Ki7..Fi.S.O....]u.c..._h...`..a?mz.c......?(.+.&O.<H[N.............P..&K...F.D.n2.b.._....~P..!.&XL..>.7.PCz..?.%.....=.J........Yx.3....=<M..gkw~.u..,..ej{.?.,8\|.7....g.F....R..!Z...1.ObZ........W...Z.U..G....z..%m....$./.aS.....Z:..8..l.<.Z..z..(.,.B.......^.......s..5o3.>.....'A.x._.\|..h.Q4.:....7..Z.....(.....

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 22:50:44.759196043 CET	137	137	192.168.11.20	192.168.11.255
Nov 22, 2024 22:50:45.522128105 CET	137	137	192.168.11.20	192.168.11.255
Nov 22, 2024 22:50:46.287619114 CET	137	137	192.168.11.20	192.168.11.255
Nov 22, 2024 22:50:52.652296066 CET	61684	1900	192.168.11.20	239.255.255.250
Nov 22, 2024 22:50:52.701786995 CET	53	59595	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:52.734494925 CET	53	61683	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:53.482089996 CET	53	57477	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:53.667407036 CET	61684	1900	192.168.11.20	239.255.255.250
Nov 22, 2024 22:50:54.240314007 CET	64909	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:54.240391016 CET	65483	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:54.336635113 CET	53	64909	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:54.337090015 CET	53	65483	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:54.667422056 CET	61684	1900	192.168.11.20	239.255.255.250
Nov 22, 2024 22:50:55.226283073 CET	64124	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:55.226358891 CET	58842	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:55.306664944 CET	53	59151	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:55.332114935 CET	53	58842	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:55.391242027 CET	53	64124	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:55.668040037 CET	61684	1900	192.168.11.20	239.255.255.250
Nov 22, 2024 22:50:56.221630096 CET	63531	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:56.221709013 CET	65160	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:56.221818924 CET	53055	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:56.221914053 CET	64533	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:56.316977024 CET	53	63076	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:56.317241907 CET	53	53055	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:56.320502996 CET	53	64533	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:56.483401060 CET	55024	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:56.483552933 CET	60110	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:56.645004034 CET	53	60110	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:56.666623116 CET	53	55024	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:57.253662109 CET	61241	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:57.253755093 CET	65247	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:57.255127907 CET	65404	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:57.255217075 CET	61935	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:57.348406076 CET	53	61241	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:57.349710941 CET	53	65247	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:57.728322983 CET	53	49613	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:57.772022009 CET	49832	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:57.772113085 CET	63069	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:57.843003035 CET	53593	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:57.843108892 CET	54611	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:57.859060049 CET	63304	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:57.859181881 CET	64396	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:57.866888046 CET	53	63069	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:57.867235899 CET	53	49832	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:57.938703060 CET	53	54611	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:57.939968109 CET	53	53593	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:57.956218958 CET	53	64396	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:57.961579084 CET	53	63304	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:58.595372915 CET	64877	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:58.595474958 CET	50795	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:58.692131042 CET	53	64877	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:58.694792032 CET	53	50795	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:58.780622959 CET	50363	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:58.780720949 CET	56152	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:58.875829935 CET	53	56152	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:58.876143932 CET	53	50363	1.1.1.1	192.168.11.20
Nov 22, 2024 22:50:59.338797092 CET	50263	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:59.338886976 CET	53909	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:59.588694096 CET	59701	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:50:59.588826895 CET	49789	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:00.374104023 CET	54030	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:00.374274015 CET	52664	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:15.328727961 CET	53	53918	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:21.400024891 CET	51419	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:21.400163889 CET	59675	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:21.405118942 CET	62074	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:21.405184984 CET	56116	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:21.495985985 CET	53	59675	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:21.500091076 CET	53	51419	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:21.500430107 CET	53	62074	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:21.501703978 CET	53	56116	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:22.321175098 CET	53	59590	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:22.393527985 CET	63958	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:22.393619061 CET	61594	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:22.489530087 CET	53	63958	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:22.489711046 CET	53	61594	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:33.094091892 CET	57257	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:33.094325066 CET	52369	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:33.190188885 CET	53	57257	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:33.191386938 CET	53	52369	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:33.965372086 CET	53651	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:33.965449095 CET	56377	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:34.061568975 CET	53	56377	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:34.061856031 CET	53	53651	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:37.118881941 CET	53	65427	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:42.991700888 CET	50167	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:42.991853952 CET	61050	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:52.721122026 CET	53	53730	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:57.780771971 CET	50621	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:57.780879974 CET	63097	53	192.168.11.20	1.1.1.1
Nov 22, 2024 22:51:57.876013994 CET	53	50621	1.1.1.1	192.168.11.20
Nov 22, 2024 22:51:57.877088070 CET	53	63097	1.1.1.1	192.168.11.20
Nov 22, 2024 22:52:03.147170067 CET	53	57026	1.1.1.1	192.168.11.20
Nov 22, 2024 22:52:06.949171066 CET	60978	53	192.168.11.20	9.9.9.9
Nov 22, 2024 22:52:06.949258089 CET	62030	53	192.168.11.20	9.9.9.9
Nov 22, 2024 22:52:07.091613054 CET	50988	53	192.168.11.20	9.9.9.9
Nov 22, 2024 22:52:07.091687918 CET	57595	53	192.168.11.20	9.9.9.9
Nov 22, 2024 22:52:07.092076063 CET	64727	53	192.168.11.20	9.9.9.9
Nov 22, 2024 22:52:07.092170000 CET	54018	53	192.168.11.20	9.9.9.9
Nov 22, 2024 22:52:07.160744905 CET	62029	53	192.168.11.20	9.9.9.9
Nov 22, 2024 22:52:07.160871983 CET	53043	53	192.168.11.20	9.9.9.9
Nov 22, 2024 22:52:07.190684080 CET	53	52959	9.9.9.9	192.168.11.20
Nov 22, 2024 22:52:07.190839052 CET	53	50988	9.9.9.9	192.168.11.20
Nov 22, 2024 22:52:07.191221952 CET	53	57595	9.9.9.9	192.168.11.20
Nov 22, 2024 22:52:07.262521982 CET	53	62029	9.9.9.9	192.168.11.20
Nov 22, 2024 22:52:07.328263998 CET	53	53043	9.9.9.9	192.168.11.20
Nov 22, 2024 22:52:07.821504116 CET	53	56324	9.9.9.9	192.168.11.20

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:50:54 UTC	730	OUT	GET /c/56657?id=9320.16.1.33e19ff7c4e153555ce8ae2ca531d282 HTTP/1.1 Host: email.cloud.secureclick.net Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-11-22 21:50:55 UTC	161	IN	HTTP/1.1 302 Found Date: Fri, 22 Nov 2024 21:50:55 GMT Content-Length: 0 Connection: close Location: https://hctit.io/blog/f/analyzing-the-attack-surface

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:50:58 UTC	531	OUT	OPTIONS /report/v4?s=vYeOswBuoP44ZAQOa4ANXv3Fd34GRE93K9d%2BLBX1o2CAEBJyCC%2BcxPB3ksIttXa1ZVIuuy70atJJJpX0GspUZalQC%2BWlNoHo7I4n6b%2BgaKQc145DiLVqYolvvw%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://hctit.io Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-11-22 21:50:58 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Fri, 22 Nov 2024 21:50:58 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:50:58 UTC	980	OUT	GET /v1/website/9292f6b8-c30c-455a-b125-cc4b63423204/feed?categories=aa978083-0e0f-485d-9b4d-7422c0d0f308,90f1f722-c6dd-4a97-9d83-12b75da2c3f6,0cf9de48-14d9-45c2-8dd6-2baf1123ca7c,c29065e2-5985-4db3-bfd7-ffb539c53741,887039bd-46ff-43ad-8e50-9abc67da9c27,580198c2-0cff-4f45-a1b3-d3558597f95c,bbaecd39-7a26-4abd-ae3c-9560f6450e47,e55f215e-7ed9-47ca-9565-94f22078cc8a,7d4b2bcb-a88a-4ae6-a644-637d4061bbb0,936b7b82-68b8-4196-83ac-e0f30ef2d362&pageItems=10&pageSelected=1 HTTP/1.1 Host: blog.apps.secureserver.net Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://hctit.io Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-11-22 21:50:58 UTC	656	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:50:58 GMT Content-Type: application/json; charset=utf-8 Content-Length: 2244 Connection: close Vary: Accept-Encoding Vary: Origin Access-Control-Allow-Credentials: true X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15724800; includeSubDomains X-Download-Options: noopen Surrogate-Control: no-store Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate Pragma: no-cache Expires: 0 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: https://hctit.io ETag: W/"8c4-pItrq7fwnSnrTkXgEDm18UBxxIA"
2024-11-22 21:50:58 UTC	729	IN	Data Raw: 7b 22 70 61 67 65 53 65 6c 65 63 74 65 64 22 3a 31 2c 22 70 61 67 65 49 74 65 6d 73 22 3a 31 30 2c 22 66 65 65 64 22 3a 5b 7b 22 70 6f 73 74 49 64 22 3a 22 64 32 65 61 61 33 30 62 2d 37 34 37 34 2d 34 64 36 61 2d 39 66 34 36 2d 36 33 38 63 65 36 34 63 35 30 61 33 22 2c 22 68 69 64 65 43 6f 6d 6d 65 6e 74 69 6e 67 22 3a 74 72 75 65 2c 22 74 69 74 6c 65 22 3a 22 41 6e 61 6c 79 7a 69 6e 67 20 74 68 65 20 41 74 74 61 63 6b 20 53 75 72 66 61 63 65 22 2c 22 64 61 74 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 31 33 3a 30 30 3a 30 30 2e 30 30 30 5a 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 49 6e 73 69 67 68 74 73 20 66 72 6f 6d 20 61 6e 20 41 74 74 61 63 6b 65 72 e2 80 99 73 20 50 65 72 73 70 65 63 74 69 76 65 20 22 2c 22 73 6c 75 67 22 3a 22 61 6e 61 6c 79 7a 69 Data Ascii: {"pageSelected":1,"pageItems":10,"feed":[{"postId":"d2eaa30b-7474-4d6a-9f46-638ce64c50a3","hideCommenting":true,"title":"Analyzing the Attack Surface","date":"2024-11-22T13:00:00.000Z","content":"Insights from an Attackers Perspective ","slug":"analyzi
2024-11-22 21:50:58 UTC	1515	IN	Data Raw: 6c 2d 70 72 6f 70 65 72 74 79 22 2c 22 66 65 61 74 75 72 65 64 49 6d 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 39 32 39 32 66 36 62 38 2d 63 33 30 63 2d 34 35 35 61 2d 62 31 32 35 2d 63 63 34 62 36 33 34 32 33 32 30 34 2f 50 69 63 74 75 72 65 34 2e 31 2e 70 6e 67 22 2c 22 63 61 74 65 67 6f 72 69 65 73 22 3a 5b 22 4d 61 6e 61 67 65 64 20 44 65 74 65 63 74 69 6f 6e 20 61 6e 64 20 52 65 73 70 6f 6e 73 65 22 5d 2c 22 66 65 61 74 75 72 65 46 6c 61 67 73 22 3a 7b 7d 2c 22 70 75 62 6c 69 73 68 65 64 44 61 74 65 22 3a 22 32 30 32 34 2d 31 31 2d 30 38 54 30 30 3a 34 37 3a 35 34 2e 33 35 33 5a 22 7d 2c 7b 22 70 6f 73 74 49 64 22 3a 22 64 34 63 63 66 65 30 35 2d 39 39 63 36 2d 34 64 39 65 2d Data Ascii: l-property","featuredImage":"https://img1.wsimg.com/isteam/ip/9292f6b8-c30c-455a-b125-cc4b63423204/Picture4.1.png","categories":["Managed Detection and Response"],"featureFlags":{},"publishedDate":"2024-11-08T00:47:54.353Z"},{"postId":"d4ccfe05-99c6-4d9e-

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:50:58 UTC	480	OUT	POST /report/v4?s=vYeOswBuoP44ZAQOa4ANXv3Fd34GRE93K9d%2BLBX1o2CAEBJyCC%2BcxPB3ksIttXa1ZVIuuy70atJJJpX0GspUZalQC%2BWlNoHo7I4n6b%2BgaKQc145DiLVqYolvvw%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 433 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-11-22 21:50:58 UTC	433	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 36 34 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 68 63 74 69 74 2e 69 6f 2f 62 6c 6f 67 2f 66 2f 61 6e 61 6c 79 7a 69 6e 67 2d 74 68 65 2d 61 74 74 61 63 6b 2d 73 75 72 66 61 63 65 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 38 31 2e 32 33 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 Data Ascii: [{"age":0,"body":{"elapsed_time":164,"method":"GET","phase":"application","protocol":"h2","referrer":"https://hctit.io/blog/f/analyzing-the-attack-surface","sampling_fraction":1.0,"server_ip":"104.21.81.232","status_code":404,"type":"http.error"},"type":"
2024-11-22 21:50:59 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Fri, 22 Nov 2024 21:50:58 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:51:21 UTC	527	OUT	GET /ajax/libs/pusher/7.0.1/pusher.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-11-22 21:51:22 UTC	947	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:51:22 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5fa0e6b5-10195" Last-Modified: Tue, 03 Nov 2020 05:12:21 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: MISS Expires: Wed, 12 Nov 2025 21:51:22 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=utJYjeUkF8g6EP5jYvIFVl5M1FU7WxkvrUOSyi4hVmhy4fLG8RZ%2Fpr8pBnx9cA0tIL5qY%2F65Qhh85gcESgEmFZbaHmYBIJ2ewApVqPmq9%2B9cNnbbYcj0mw5SF2QhAyKUqTxhoWKv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8e6c23f30fdd41b5-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:51:22 UTC	422	IN	Data Raw: 37 62 66 65 0d 0a 2f 2a 21 0a 20 2a 20 50 75 73 68 65 72 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 37 2e 30 2e 31 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 70 75 73 68 65 72 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 30 2c 20 50 75 73 68 65 72 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 63 65 2e 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e Data Ascii: 7bfe/! Pusher JavaScript Library v7.0.1 * https://pusher.com/ * * Copyright 2020, Pusher * Released under the MIT licence. */!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.
2024-11-22 21:51:22 UTC	1369	IN	Data Raw: 20 72 3d 65 5b 6f 5d 3d 7b 69 3a 6f 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 74 5b 6f 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6e 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6e 2e 6d 3d 74 2c 6e 2e 63 3d 65 2c 6e 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6f 29 7b 6e 2e 6f 28 74 2c 65 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 65 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 6f 7d 29 7d 2c 6e 2e 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f 6c 2e 74 6f 53 74 72 69 6e 67 54 61 67 26 26 4f 62 6a Data Ascii: r=e[o]={i:o,l:!1,exports:{}};return t[o].call(r.exports,r,r.exports,n),r.l=!0,r.exports}return n.m=t,n.c=e,n.d=function(t,e,o){n.o(t,e)\|\|Object.defineProperty(t,e,{enumerable:!0,get:o})},n.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Obj
2024-11-22 21:51:22 UTC	1369	IN	Data Raw: 65 6e 67 74 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 70 61 64 64 69 6e 67 43 68 61 72 61 63 74 65 72 3f 28 74 2b 32 29 2f 33 2a 34 7c 30 3a 28 38 2a 74 2b 35 29 2f 36 7c 30 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 63 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 22 22 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 2d 32 3b 6e 2b 3d 33 29 7b 76 61 72 20 6f 3d 74 5b 6e 5d 3c 3c 31 36 7c 74 5b 6e 2b 31 5d 3c 3c 38 7c 74 5b 6e 2b 32 5d 3b 65 2b 3d 74 68 69 73 2e 5f 65 6e 63 6f 64 65 42 79 74 65 28 6f 3e 3e 3e 31 38 26 36 33 29 2c 65 2b 3d 74 68 69 73 2e 5f 65 6e 63 6f 64 65 42 79 74 65 28 6f 3e 3e 3e 31 32 26 36 33 29 2c 65 2b 3d 74 68 69 73 2e 5f 65 6e 63 6f 64 65 42 79 74 65 28 6f Data Ascii: ength=function(t){return this._paddingCharacter?(t+2)/34\|0:(8t+5)/6\|0},t.prototype.encode=function(t){for(var e="",n=0;n<t.length-2;n+=3){var o=t[n]<<16\|t[n+1]<<8\|t[n+2];e+=this._encodeByte(o>>>18&63),e+=this._encodeByte(o>>>12&63),e+=this._encodeByte(o
2024-11-22 21:51:22 UTC	1369	IN	Data Raw: 65 43 68 61 72 28 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 33 29 29 2c 6f 5b 72 2b 2b 5d 3d 75 3c 3c 36 7c 68 2c 73 7c 3d 32 35 36 26 68 29 2c 30 21 3d 3d 73 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 42 61 73 65 36 34 43 6f 64 65 72 3a 20 69 6e 63 6f 72 72 65 63 74 20 63 68 61 72 61 63 74 65 72 73 20 66 6f 72 20 64 65 63 6f 64 69 6e 67 22 29 3b 72 65 74 75 72 6e 20 6f 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 65 6e 63 6f 64 65 42 79 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 3b 72 65 74 75 72 6e 20 65 2b 3d 36 35 2c 65 2b 3d 32 35 2d 74 3e 3e 3e 38 26 36 2c 65 2b 3d 35 31 2d 74 3e 3e 3e 38 26 2d 37 35 2c 65 2b 3d 36 31 2d 74 3e 3e 3e 38 26 2d 31 35 2c 65 2b 3d 36 32 2d 74 3e 3e 3e 38 26 33 2c 53 74 72 69 6e 67 2e Data Ascii: eChar(t.charCodeAt(i+3)),o[r++]=u<<6\|h,s\|=256&h),0!==s)throw new Error("Base64Coder: incorrect characters for decoding");return o},t.prototype._encodeByte=function(t){var e=t;return e+=65,e+=25-t>>>8&6,e+=51-t>>>8&-75,e+=61-t>>>8&-15,e+=62-t>>>8&3,String.
2024-11-22 21:51:22 UTC	1369	IN	Data Raw: 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 61 2e 64 65 63 6f 64 65 28 74 29 7d 2c 65 2e 65 6e 63 6f 64 65 64 4c 65 6e 67 74 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 73 2e 65 6e 63 6f 64 65 64 4c 65 6e 67 74 68 28 74 29 7d 2c 65 2e 6d 61 78 44 65 63 6f 64 65 64 4c 65 6e 67 74 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 73 2e 6d 61 78 44 65 63 6f 64 65 64 4c 65 6e 67 74 68 28 74 29 7d 2c 65 2e 64 65 63 6f 64 65 64 4c 65 6e 67 74 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 73 2e 64 65 63 6f 64 65 64 4c 65 6e 67 74 68 28 74 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 22 5f 5f 65 Data Ascii: on(t){return a.decode(t)},e.encodedLength=function(t){return s.encodedLength(t)},e.maxDecodedLength=function(t){return s.maxDecodedLength(t)},e.decodedLength=function(t){return s.decodedLength(t)}},function(t,e,n){"use strict";Object.defineProperty(e,"__e
2024-11-22 21:51:22 UTC	1369	IN	Data Raw: 29 3b 73 3d 74 5b 2b 2b 6e 5d 2c 63 3d 74 5b 2b 2b 6e 5d 3b 76 61 72 20 61 3d 74 5b 2b 2b 6e 5d 3b 69 66 28 31 32 38 21 3d 28 31 39 32 26 73 29 7c 7c 31 32 38 21 3d 28 31 39 32 26 63 29 7c 7c 31 32 38 21 3d 28 31 39 32 26 61 29 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 6f 29 3b 72 3d 28 31 35 26 72 29 3c 3c 31 38 7c 28 36 33 26 73 29 3c 3c 31 32 7c 28 36 33 26 63 29 3c 3c 36 7c 36 33 26 61 2c 69 3d 36 35 35 33 36 7d 69 66 28 72 3c 69 7c 7c 72 3e 3d 35 35 32 39 36 26 26 72 3c 3d 35 37 33 34 33 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 6f 29 3b 69 66 28 72 3e 3d 36 35 35 33 36 29 7b 69 66 28 72 3e 31 31 31 34 31 31 31 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 6f 29 3b 72 2d 3d 36 35 35 33 36 2c 65 2e 70 75 73 68 28 53 74 72 69 6e Data Ascii: );s=t[++n],c=t[++n];var a=t[++n];if(128!=(192&s)\|\|128!=(192&c)\|\|128!=(192&a))throw new Error(o);r=(15&r)<<18\|(63&s)<<12\|(63&c)<<6\|63&a,i=65536}if(r<i\|\|r>=55296&&r<=57343)throw new Error(o);if(r>=65536){if(r>1114111)throw new Error(o);r-=65536,e.push(Strin
2024-11-22 21:51:22 UTC	1369	IN	Data Raw: 74 5d 2e 6c 65 6e 67 74 68 3e 30 29 6f 2e 6c 6f 61 64 69 6e 67 5b 74 5d 2e 70 75 73 68 28 6e 29 3b 65 6c 73 65 7b 6f 2e 6c 6f 61 64 69 6e 67 5b 74 5d 3d 5b 6e 5d 3b 76 61 72 20 72 3d 5f 65 2e 63 72 65 61 74 65 53 63 72 69 70 74 52 65 71 75 65 73 74 28 6f 2e 67 65 74 50 61 74 68 28 74 2c 65 29 29 2c 69 3d 6f 2e 72 65 63 65 69 76 65 72 73 2e 63 72 65 61 74 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6f 2e 72 65 63 65 69 76 65 72 73 2e 72 65 6d 6f 76 65 28 69 29 2c 6f 2e 6c 6f 61 64 69 6e 67 5b 74 5d 29 7b 76 61 72 20 6e 3d 6f 2e 6c 6f 61 64 69 6e 67 5b 74 5d 3b 64 65 6c 65 74 65 20 6f 2e 6c 6f 61 64 69 6e 67 5b 74 5d 3b 66 6f 72 28 76 61 72 20 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 7c 7c 72 2e 63 6c 65 61 6e 75 70 28 29 7d 2c 63 3d 30 3b 63 Data Ascii: t].length>0)o.loading[t].push(n);else{o.loading[t]=[n];var r=_e.createScriptRequest(o.getPath(t,e)),i=o.receivers.create((function(e){if(o.receivers.remove(i),o.loading[t]){var n=o.loading[t];delete o.loading[t];for(var s=function(t){t\|\|r.cleanup()},c=0;c
2024-11-22 21:51:22 UTC	1369	IN	Data Raw: 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 65 29 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6e 29 26 26 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 7d 29 28 74 2c 65 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 74 7d 6f 28 74 2c 65 29 2c 74 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 75 6c 6c 3d 3d 3d 65 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 65 29 3a 28 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 65 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 65 77 20 6e 29 7d 29 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 76 61 72 20 6e 3d 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2c 6f 3d 74 2e 63 61 Data Ascii: }\|\|function(t,e){for(var n in e)e.hasOwnProperty(n)&&(t[n]=e[n])})(t,e)},function(t,e){function n(){this.constructor=t}o(t,e),t.prototype=null===e?Object.create(e):(n.prototype=e.prototype,new n)}),f=function(t){function e(e){var n=this.constructor,o=t.ca
2024-11-22 21:51:22 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 6f 2c 72 3d 74 68 69 73 3b 66 6f 72 28 76 61 72 20 69 20 69 6e 28 6f 3d 5f 65 2e 63 72 65 61 74 65 58 48 52 28 29 29 2e 6f 70 65 6e 28 22 50 4f 53 54 22 2c 72 2e 6f 70 74 69 6f 6e 73 2e 61 75 74 68 45 6e 64 70 6f 69 6e 74 2c 21 30 29 2c 6f 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 2c 74 68 69 73 2e 61 75 74 68 4f 70 74 69 6f 6e 73 2e 68 65 61 64 65 72 73 29 6f 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 69 2c 74 68 69 73 2e 61 75 74 68 4f 70 74 69 6f 6e 73 2e 68 65 61 64 65 72 73 5b 69 5d 29 3b 72 65 74 75 72 6e 20 6f 2e 6f 6e 72 65 61 Data Ascii: tion(t,e,n){var o,r=this;for(var i in(o=_e.createXHR()).open("POST",r.options.authEndpoint,!0),o.setRequestHeader("Content-Type","application/x-www-form-urlencoded"),this.authOptions.headers)o.setRequestHeader(i,this.authOptions.headers[i]);return o.onrea
2024-11-22 21:51:22 UTC	1369	IN	Data Raw: 29 7d 2c 78 3d 77 69 6e 64 6f 77 2e 62 74 6f 61 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 73 5c 53 5d 7b 31 2c 33 7d 2f 67 2c 4c 29 7d 2c 41 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 2c 6e 2c 6f 29 7b 76 61 72 20 72 3d 74 68 69 73 3b 74 68 69 73 2e 63 6c 65 61 72 3d 65 2c 74 68 69 73 2e 74 69 6d 65 72 3d 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 74 69 6d 65 72 26 26 28 72 2e 74 69 6d 65 72 3d 6f 28 72 2e 74 69 6d 65 72 29 29 7d 29 2c 6e 29 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 52 75 6e 6e 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 74 68 69 73 2e 74 69 6d 65 72 7d 2c 74 2e 70 72 6f 74 Data Ascii: )},x=window.btoa\|\|function(t){return t.replace(/[\s\S]{1,3}/g,L)},A=function(){function t(t,e,n,o){var r=this;this.clear=e,this.timer=t((function(){r.timer&&(r.timer=o(r.timer))}),n)}return t.prototype.isRunning=function(){return null!==this.timer},t.prot

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://email.cloud.secureclick.net/c/56657?id=9320.16.1.33e19ff7c4e153555ce8ae2ca531d282

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Windows Analysis Report
https://email.cloud.secureclick.net/c/56657?id=9320.16.1.33e19ff7c4e153555ce8ae2ca531d282

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:51:22 UTC	386	OUT	GET /ajax/libs/pusher/7.0.1/pusher.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-11-22 21:51:23 UTC	954	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:51:23 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5fa0e6b5-10195" Last-Modified: Tue, 03 Nov 2020 05:12:21 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1 Expires: Wed, 12 Nov 2025 21:51:23 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=41Qa2%2BopKMLM6ClSF5zpnnZoeMCBoMUDFJtHnugRAtrifE%2BXyiD95z%2FalEj6C6XkAhTaYR98g7m4cyrDtT1EiSPYa2zGfuzGwpEjBd6YuhaqIeOIfgPirkz92wuiMxOIJ9JShibU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8e6c23f92f4332ee-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 21:51:23 UTC	415	IN	Data Raw: 37 62 66 37 0d 0a 2f 2a 21 0a 20 2a 20 50 75 73 68 65 72 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 37 2e 30 2e 31 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 70 75 73 68 65 72 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 30 2c 20 50 75 73 68 65 72 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 63 65 2e 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e Data Ascii: 7bf7/! Pusher JavaScript Library v7.0.1 * https://pusher.com/ * * Copyright 2020, Pusher * Released under the MIT licence. */!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.
2024-11-22 21:51:23 UTC	1369	IN	Data Raw: 72 74 73 3b 76 61 72 20 72 3d 65 5b 6f 5d 3d 7b 69 3a 6f 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 74 5b 6f 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6e 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6e 2e 6d 3d 74 2c 6e 2e 63 3d 65 2c 6e 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6f 29 7b 6e 2e 6f 28 74 2c 65 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 65 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 6f 7d 29 7d 2c 6e 2e 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f 6c 2e 74 6f 53 74 72 69 6e 67 54 Data Ascii: rts;var r=e[o]={i:o,l:!1,exports:{}};return t[o].call(r.exports,r,r.exports,n),r.l=!0,r.exports}return n.m=t,n.c=e,n.d=function(t,e,o){n.o(t,e)\|\|Object.defineProperty(t,e,{enumerable:!0,get:o})},n.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringT
2024-11-22 21:51:23 UTC	1369	IN	Data Raw: 6e 63 6f 64 65 64 4c 65 6e 67 74 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 70 61 64 64 69 6e 67 43 68 61 72 61 63 74 65 72 3f 28 74 2b 32 29 2f 33 2a 34 7c 30 3a 28 38 2a 74 2b 35 29 2f 36 7c 30 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 63 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 22 22 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 2d 32 3b 6e 2b 3d 33 29 7b 76 61 72 20 6f 3d 74 5b 6e 5d 3c 3c 31 36 7c 74 5b 6e 2b 31 5d 3c 3c 38 7c 74 5b 6e 2b 32 5d 3b 65 2b 3d 74 68 69 73 2e 5f 65 6e 63 6f 64 65 42 79 74 65 28 6f 3e 3e 3e 31 38 26 36 33 29 2c 65 2b 3d 74 68 69 73 2e 5f 65 6e 63 6f 64 65 42 79 74 65 28 6f 3e 3e 3e 31 32 26 36 33 29 2c 65 2b 3d 74 68 69 73 2e 5f 65 6e 63 6f 64 Data Ascii: ncodedLength=function(t){return this._paddingCharacter?(t+2)/34\|0:(8t+5)/6\|0},t.prototype.encode=function(t){for(var e="",n=0;n<t.length-2;n+=3){var o=t[n]<<16\|t[n+1]<<8\|t[n+2];e+=this._encodeByte(o>>>18&63),e+=this._encodeByte(o>>>12&63),e+=this._encod
2024-11-22 21:51:23 UTC	1369	IN	Data Raw: 2e 5f 64 65 63 6f 64 65 43 68 61 72 28 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 33 29 29 2c 6f 5b 72 2b 2b 5d 3d 75 3c 3c 36 7c 68 2c 73 7c 3d 32 35 36 26 68 29 2c 30 21 3d 3d 73 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 42 61 73 65 36 34 43 6f 64 65 72 3a 20 69 6e 63 6f 72 72 65 63 74 20 63 68 61 72 61 63 74 65 72 73 20 66 6f 72 20 64 65 63 6f 64 69 6e 67 22 29 3b 72 65 74 75 72 6e 20 6f 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 65 6e 63 6f 64 65 42 79 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 3b 72 65 74 75 72 6e 20 65 2b 3d 36 35 2c 65 2b 3d 32 35 2d 74 3e 3e 3e 38 26 36 2c 65 2b 3d 35 31 2d 74 3e 3e 3e 38 26 2d 37 35 2c 65 2b 3d 36 31 2d 74 3e 3e 3e 38 26 2d 31 35 2c 65 2b 3d 36 32 2d 74 3e 3e 3e 38 26 33 2c Data Ascii: ._decodeChar(t.charCodeAt(i+3)),o[r++]=u<<6\|h,s\|=256&h),0!==s)throw new Error("Base64Coder: incorrect characters for decoding");return o},t.prototype._encodeByte=function(t){var e=t;return e+=65,e+=25-t>>>8&6,e+=51-t>>>8&-75,e+=61-t>>>8&-15,e+=62-t>>>8&3,
2024-11-22 21:51:23 UTC	1369	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 61 2e 64 65 63 6f 64 65 28 74 29 7d 2c 65 2e 65 6e 63 6f 64 65 64 4c 65 6e 67 74 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 73 2e 65 6e 63 6f 64 65 64 4c 65 6e 67 74 68 28 74 29 7d 2c 65 2e 6d 61 78 44 65 63 6f 64 65 64 4c 65 6e 67 74 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 73 2e 6d 61 78 44 65 63 6f 64 65 64 4c 65 6e 67 74 68 28 74 29 7d 2c 65 2e 64 65 63 6f 64 65 64 4c 65 6e 67 74 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 73 2e 64 65 63 6f 64 65 64 4c 65 6e 67 74 68 28 74 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 Data Ascii: =function(t){return a.decode(t)},e.encodedLength=function(t){return s.encodedLength(t)},e.maxDecodedLength=function(t){return s.maxDecodedLength(t)},e.decodedLength=function(t){return s.decodedLength(t)}},function(t,e,n){"use strict";Object.defineProperty
2024-11-22 21:51:23 UTC	1369	IN	Data Raw: 45 72 72 6f 72 28 6f 29 3b 73 3d 74 5b 2b 2b 6e 5d 2c 63 3d 74 5b 2b 2b 6e 5d 3b 76 61 72 20 61 3d 74 5b 2b 2b 6e 5d 3b 69 66 28 31 32 38 21 3d 28 31 39 32 26 73 29 7c 7c 31 32 38 21 3d 28 31 39 32 26 63 29 7c 7c 31 32 38 21 3d 28 31 39 32 26 61 29 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 6f 29 3b 72 3d 28 31 35 26 72 29 3c 3c 31 38 7c 28 36 33 26 73 29 3c 3c 31 32 7c 28 36 33 26 63 29 3c 3c 36 7c 36 33 26 61 2c 69 3d 36 35 35 33 36 7d 69 66 28 72 3c 69 7c 7c 72 3e 3d 35 35 32 39 36 26 26 72 3c 3d 35 37 33 34 33 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 6f 29 3b 69 66 28 72 3e 3d 36 35 35 33 36 29 7b 69 66 28 72 3e 31 31 31 34 31 31 31 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 6f 29 3b 72 2d 3d 36 35 35 33 36 2c 65 2e 70 75 73 Data Ascii: Error(o);s=t[++n],c=t[++n];var a=t[++n];if(128!=(192&s)\|\|128!=(192&c)\|\|128!=(192&a))throw new Error(o);r=(15&r)<<18\|(63&s)<<12\|(63&c)<<6\|63&a,i=65536}if(r<i\|\|r>=55296&&r<=57343)throw new Error(o);if(r>=65536){if(r>1114111)throw new Error(o);r-=65536,e.pus
2024-11-22 21:51:23 UTC	1369	IN	Data Raw: 6f 61 64 69 6e 67 5b 74 5d 2e 6c 65 6e 67 74 68 3e 30 29 6f 2e 6c 6f 61 64 69 6e 67 5b 74 5d 2e 70 75 73 68 28 6e 29 3b 65 6c 73 65 7b 6f 2e 6c 6f 61 64 69 6e 67 5b 74 5d 3d 5b 6e 5d 3b 76 61 72 20 72 3d 5f 65 2e 63 72 65 61 74 65 53 63 72 69 70 74 52 65 71 75 65 73 74 28 6f 2e 67 65 74 50 61 74 68 28 74 2c 65 29 29 2c 69 3d 6f 2e 72 65 63 65 69 76 65 72 73 2e 63 72 65 61 74 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6f 2e 72 65 63 65 69 76 65 72 73 2e 72 65 6d 6f 76 65 28 69 29 2c 6f 2e 6c 6f 61 64 69 6e 67 5b 74 5d 29 7b 76 61 72 20 6e 3d 6f 2e 6c 6f 61 64 69 6e 67 5b 74 5d 3b 64 65 6c 65 74 65 20 6f 2e 6c 6f 61 64 69 6e 67 5b 74 5d 3b 66 6f 72 28 76 61 72 20 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 7c 7c 72 2e 63 6c 65 61 6e 75 70 28 29 Data Ascii: oading[t].length>0)o.loading[t].push(n);else{o.loading[t]=[n];var r=_e.createScriptRequest(o.getPath(t,e)),i=o.receivers.create((function(e){if(o.receivers.remove(i),o.loading[t]){var n=o.loading[t];delete o.loading[t];for(var s=function(t){t\|\|r.cleanup()
2024-11-22 21:51:23 UTC	1369	IN	Data Raw: 6f 74 6f 5f 5f 3d 65 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 65 29 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6e 29 26 26 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 7d 29 28 74 2c 65 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 74 7d 6f 28 74 2c 65 29 2c 74 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 75 6c 6c 3d 3d 3d 65 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 65 29 3a 28 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 65 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 65 77 20 6e 29 7d 29 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 76 61 72 20 6e 3d 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 Data Ascii: oto__=e}\|\|function(t,e){for(var n in e)e.hasOwnProperty(n)&&(t[n]=e[n])})(t,e)},function(t,e){function n(){this.constructor=t}o(t,e),t.prototype=null===e?Object.create(e):(n.prototype=e.prototype,new n)}),f=function(t){function e(e){var n=this.constructor
2024-11-22 21:51:23 UTC	1369	IN	Data Raw: 2c 5f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 6f 2c 72 3d 74 68 69 73 3b 66 6f 72 28 76 61 72 20 69 20 69 6e 28 6f 3d 5f 65 2e 63 72 65 61 74 65 58 48 52 28 29 29 2e 6f 70 65 6e 28 22 50 4f 53 54 22 2c 72 2e 6f 70 74 69 6f 6e 73 2e 61 75 74 68 45 6e 64 70 6f 69 6e 74 2c 21 30 29 2c 6f 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 2c 74 68 69 73 2e 61 75 74 68 4f 70 74 69 6f 6e 73 2e 68 65 61 64 65 72 73 29 6f 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 69 2c 74 68 69 73 2e 61 75 74 68 4f 70 74 69 6f 6e 73 2e 68 65 61 64 65 72 73 5b 69 5d 29 3b 72 65 74 75 72 6e 20 Data Ascii: ,_=function(t,e,n){var o,r=this;for(var i in(o=_e.createXHR()).open("POST",r.options.authEndpoint,!0),o.setRequestHeader("Content-Type","application/x-www-form-urlencoded"),this.authOptions.headers)o.setRequestHeader(i,this.authOptions.headers[i]);return
2024-11-22 21:51:23 UTC	1369	IN	Data Raw: 6a 6f 69 6e 28 22 22 29 7d 2c 78 3d 77 69 6e 64 6f 77 2e 62 74 6f 61 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 73 5c 53 5d 7b 31 2c 33 7d 2f 67 2c 4c 29 7d 2c 41 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 2c 6e 2c 6f 29 7b 76 61 72 20 72 3d 74 68 69 73 3b 74 68 69 73 2e 63 6c 65 61 72 3d 65 2c 74 68 69 73 2e 74 69 6d 65 72 3d 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 74 69 6d 65 72 26 26 28 72 2e 74 69 6d 65 72 3d 6f 28 72 2e 74 69 6d 65 72 29 29 7d 29 2c 6e 29 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 52 75 6e 6e 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 74 68 69 73 2e 74 69 6d 65 72 7d Data Ascii: join("")},x=window.btoa\|\|function(t){return t.replace(/[\s\S]{1,3}/g,L)},A=function(){function t(t,e,n,o){var r=this;this.clear=e,this.timer=t((function(){r.timer&&(r.timer=o(r.timer))}),n)}return t.prototype.isRunning=function(){return null!==this.timer}

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:51:33 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-22 21:51:33 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=33076 Date: Fri, 22 Nov 2024 21:51:33 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:51:33 UTC	644	OUT	GET /assets/default_avatars/missing-10-5ce634cdae779ed9e2b9e98703146e66f679c2551411727861775decd53396f3.png HTTP/1.1 Host: reamaze.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-11-22 21:51:33 UTC	272	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 21:51:33 GMT Content-Type: image/png Content-Length: 1700 Connection: close Server: Apache Last-Modified: Fri, 22 Nov 2024 18:21:31 GMT ETag: "6a4-6278473ba00c0" Accept-Ranges: bytes Cache-Control: max-age=604800, public
2024-11-22 21:51:33 UTC	1700	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f0 00 00 00 f0 08 03 00 00 00 09 8b 19 a0 00 00 00 5d 50 4c 54 45 c2 f0 e0 47 d1 a3 c4 f0 e1 be ef de 4e d3 a7 54 d5 aa 4b d2 a5 59 d6 ac 62 d8 b0 ab eb d5 81 e0 c0 a7 ea d3 a2 e8 d0 b6 ed da af eb d7 97 e6 cb bb ee dd 9c e7 ce 7b de bd 66 d9 b2 92 e4 c8 88 e2 c3 b8 ee db 6a da b5 8d e3 c6 77 dd bb 48 d1 a4 72 dc b9 b3 ec d9 5d d7 ae 6e db b7 6e 11 b4 e1 00 00 06 02 49 44 41 54 78 da ed dd d7 9a 9b 30 10 05 60 cd a0 46 31 bd 17 bf ff 63 66 e3 64 ed cd 66 93 35 58 c0 08 f4 5f f9 76 3e 15 03 92 8e 98 e3 38 8e e3 38 8e e3 38 8e e3 38 8e e3 38 8e e3 38 8e e3 38 8e e3 38 8e e3 38 ce c1 e1 4f 1f 7f 1e 19 22 4b e3 28 a9 82 6e 78 d3 05 55 12 c5 29 3b 6a d1 c8 ea b0 1d b4 90 f0 81 14 ba 6b c3 9a 1d ae 66 64 Data Ascii: PNGIHDR]PLTEGNTKYb{fjwHr]nnIDATx0`F1cfdf5X_v>888888888O"K(nxU);jkfd

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:51:33 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-22 21:51:34 UTC	659	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-CID: 7 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 974286BFDC254CDCB50C2B73CC4B4276 Ref B: MNZ221060605025 Ref C: 2023-03-13T15:26:50Z X-MSEdge-Ref: Ref A: 87B54C6474A14C81B6E546C3B6B2F842 Ref B: BLUEDGE1720 Ref C: 2023-03-13T15:26:50Z Cache-Control: public, max-age=33104 Date: Fri, 22 Nov 2024 21:51:34 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-22 21:51:34 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:51:58 UTC	527	OUT	OPTIONS /report/v4?s=ShvDxioIH9Ge7%2FX6G36yETcM8ZBC7uMXhxlh66Ivrxo50tJB%2FF5u9JcmLKLf1TmRO4iJuwiC2t4v2MqpcDebqyZ0ZhsEgtqARtx71kqFzdNWo7S2TLIYAY1AFw%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://hctit.io Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-11-22 21:51:58 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Fri, 22 Nov 2024 21:51:57 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:51:58 UTC	476	OUT	POST /report/v4?s=ShvDxioIH9Ge7%2FX6G36yETcM8ZBC7uMXhxlh66Ivrxo50tJB%2FF5u9JcmLKLf1TmRO4iJuwiC2t4v2MqpcDebqyZ0ZhsEgtqARtx71kqFzdNWo7S2TLIYAY1AFw%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 429 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-11-22 21:51:58 UTC	429	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 39 33 32 31 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 31 38 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 38 31 2e 32 33 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 35 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 68 63 74 69 74 2e 69 6f 2f 63 64 6e 2d 63 67 69 2f 63 Data Ascii: [{"age":59321,"body":{"elapsed_time":118,"method":"GET","phase":"application","protocol":"h2","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.81.232","status_code":405,"type":"http.error"},"type":"network-error","url":"https://hctit.io/cdn-cgi/c
2024-11-22 21:51:59 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Fri, 22 Nov 2024 21:51:58 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:52:07 UTC	546	OUT	GET /v4/videos/raw/video/uvb3OY5vvzF0ewv1Z HTTP/1.1 Host: categories.api.godaddy.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" Accept-Encoding: identity;q=1, ;q=0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: /* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Accept-Language: en-US,en;q=0.9 Range: bytes=0-
2024-11-22 21:52:08 UTC	497	IN	HTTP/1.1 206 Partial Content Date: Fri, 22 Nov 2024 21:52:08 GMT Content-Type: video/mp4 Content-Length: 3456229 Connection: close x-powered-by: Slay x-request-id: 31052891-e793-478a-9435-5fb50d7efded Vary: Referer, Accept-Encoding Access-Control-Allow-Credentials: true Cache-Control: max-age=86400, must-revalidate Accept-Ranges: bytes Content-Range: bytes 0-3456228/3456229 ETag: "1d1608c9dbd5117770d2ab4d28141f30" Strict-Transport-Security: max-age=15724800; includeSubDomains
2024-11-22 21:52:08 UTC	929	IN	Data Raw: 00 00 00 20 66 74 79 70 6d 70 34 32 00 00 02 00 69 73 6f 6d 69 73 6f 32 61 76 63 31 6d 70 34 31 00 00 2a 5a 6d 6f 6f 76 00 00 00 6c 6d 76 68 64 00 00 00 00 d6 21 31 ae d6 21 31 ae 00 00 03 e8 00 00 51 83 00 01 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 18 69 6f 64 73 00 00 00 00 10 80 80 80 07 00 4f ff ff ff fe ff 00 00 29 5f 74 72 61 6b 00 00 00 5c 74 6b 68 64 00 00 00 03 d6 21 31 ae d6 21 31 ae 00 00 00 01 00 00 00 00 00 00 51 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 Data Ascii: ftypmp42isomiso2avc1mp41*Zmoovlmvhd!1!1Q@iodsO)_trak\tkhd!1!1Q
2024-11-22 21:52:08 UTC	2780	IN	Data Raw: 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 23 28 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 Data Ascii: :p:p:p:p:p#(:p:p
2024-11-22 21:52:08 UTC	4096	IN	Data Raw: 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 Data Ascii: :p:p:p:p:p:p:p:p
2024-11-22 21:52:08 UTC	1464	IN	Data Raw: 33 d6 00 00 1c 98 00 00 12 79 00 00 12 c2 00 00 34 5b 00 00 1c 09 00 00 12 87 00 00 12 1f 00 00 33 2d 00 00 1b f8 00 00 11 d4 00 00 11 1e 00 00 31 a8 00 00 1c 25 00 00 12 0c 00 00 11 66 00 00 2f d8 00 00 1b 56 00 00 11 a1 00 00 10 9b 00 00 31 05 00 00 1b 78 00 00 10 73 00 00 10 74 00 00 2f 35 00 00 1a 8c 00 00 10 e8 00 00 0f 6f 00 00 2d e6 00 00 18 cd 00 00 0f eb 00 00 0e 26 00 00 2a f9 00 00 19 4e 00 00 0f 71 00 00 0e 50 00 00 28 05 00 00 18 c7 00 00 10 9a 00 00 0e 28 00 00 20 fe 00 00 16 49 00 00 0e 65 00 00 0c 4c 00 00 1b b8 00 00 11 ec 00 00 0c 18 00 00 0a 76 00 00 17 71 00 00 0d c5 00 00 09 3e 00 00 08 6d 00 00 14 62 00 00 0c 57 00 00 08 74 00 00 07 35 00 00 11 8e 00 00 09 df 00 00 06 d1 00 00 05 c0 00 00 0f f7 00 00 08 24 00 00 05 82 00 00 04 35 00 Data Ascii: 3y4[3-1%f/V1xst/5o-&*NqP(( IeLvq>mbWt5$5
2024-11-22 21:52:08 UTC	4096	IN	Data Raw: 4b 2b 00 08 52 37 00 08 7c 61 00 08 94 af 00 08 9d ed 00 08 a6 39 00 08 d0 86 00 08 e9 9b 00 08 f2 f6 00 08 fc 33 00 09 28 42 00 09 42 0d 00 09 4a 9f 00 09 56 1e 00 09 84 ad 00 09 a1 24 00 09 ab c4 00 09 b6 b7 00 09 e6 1b 00 0a 05 7f 00 0a 12 49 00 0a 1d eb 00 0a 53 3c 00 0a 77 51 00 0a 86 69 00 0a 94 87 00 0a cf cd 00 0a f7 de 00 0b 07 9f 00 0b 18 d0 00 0b 4d f8 00 0b 5e 11 00 0b c3 0f 00 0c 05 34 00 0c 2b 00 00 0c 3f 3f 00 0c 58 b3 00 0c a2 66 00 0c cc 78 00 0c e5 37 00 0d 00 09 00 0d 4c 4a 00 0d 79 33 00 0d 94 6a 00 0d b0 e2 00 0d fd 14 00 0e 2a a4 00 0e 45 21 00 0e 63 97 00 0e b0 51 00 0e dd 11 00 0e f6 f9 00 0f 16 36 00 0f 60 da 00 0f 8c aa 00 0f a7 0e 00 0f c3 f8 00 10 0c 3b 00 10 37 f6 00 10 54 07 00 10 70 cc 00 10 b6 d6 00 10 e1 b1 00 10 fc 31 00 Data Ascii: K+R7\|a93(BBJV$IS<wQiM^4+??Xfx7LJy3j*E!cQ6`;7Tp1
2024-11-22 21:52:08 UTC	74	IN	Data Raw: 0f 8e 8f 7f be 73 84 9e a5 64 3b 29 0d 0b 9a 8e 80 71 7c 27 2c b1 b9 2f f8 b5 52 ee 60 66 77 e5 23 ad c0 2d 3b 9f 2c 10 32 fa fc 7e 1c b1 b7 9b 49 a2 e4 40 68 a7 0d 15 f5 ae 36 78 da 64 50 62 b8 8b ea 73 b9 ba f0 52 27 04 Data Ascii: sd;)q\|',/R`fw#-;,2~I@h6xdPbsR'
2024-11-22 21:52:08 UTC	1390	IN	Data Raw: e2 80 f3 2e 54 b6 b3 f5 3c 55 d9 1b 74 57 ba 22 45 81 df 6c e8 d5 94 ac cd 52 00 00 00 93 41 9f da 45 15 2c 2b ff 00 00 03 00 00 03 00 00 03 00 00 03 00 00 03 00 15 57 99 78 eb d2 dc 9f 56 23 40 14 9b c1 e8 98 8f d7 01 60 32 d3 58 d7 91 c0 6e d1 a1 33 fc 57 15 ae b1 cb bc a5 79 8f 91 76 7f 20 db a2 7d b5 e5 04 1b 4d 31 dc f0 4f ef 17 7f 46 04 ca ad f9 71 f1 54 c4 23 a5 c2 83 bc 77 9f 42 8b e5 6e b7 20 82 89 b2 ea 67 55 7e 01 bc 02 a6 ca 77 36 ba 15 00 cf 87 cf a7 70 a0 64 8b 54 cc a9 c3 cd 16 13 ad 00 40 0c a1 43 75 e9 6f 39 00 00 00 74 01 9f f9 44 27 ff 00 00 03 00 00 03 00 00 03 00 00 03 00 00 03 00 21 df 25 40 0d d6 21 3a cf 7f a4 a2 1b 4d 01 62 ae 5a ec 6d e5 f1 96 80 0d ea 29 a5 42 0c 65 d8 ea 0b 9a 0a 4c de d8 2c 36 76 e9 2e ec 80 35 76 d5 47 56 f0 Data Ascii: .T<UtW"ElRAE,+WxV#@`2Xn3Wyv }M1OFqT#wBn gU~w6pdT@Cuo9tD'!%@!:MbZm)BeL,6v.5vGV
2024-11-22 21:52:08 UTC	1390	IN	Data Raw: c0 f3 33 73 12 0f b5 eb ed 8c 2c db 74 89 05 28 ad b6 3c a0 e3 e5 d5 9e 82 b5 cf a3 c7 65 be 6e 87 57 28 95 55 9b a6 18 9d 00 00 00 99 01 9e 61 44 27 ff 00 00 03 00 00 03 00 00 03 00 00 03 00 00 03 00 21 bf ab 02 01 80 06 c5 85 48 66 f3 60 56 66 09 af b1 e7 00 ed f6 67 14 76 92 41 7b 8e 5b 84 13 aa 56 60 de bf 58 82 7c 28 cb 46 5f 19 6a c9 db 14 08 43 e6 97 13 82 ec 5a 47 a0 0f 7d 10 c3 8a 39 b3 62 40 a7 5d 93 e3 ac 34 88 8a b9 e8 36 98 e6 c7 34 64 31 f1 c7 0f 96 2f 81 4e bc ea 15 ae 67 91 cb 0a b0 60 4c f2 49 b3 2a 8f cf 94 f5 37 f3 d2 5a 3a b3 f1 a5 a6 54 0d 5d ad 33 44 ed 4d 14 40 68 00 00 00 85 01 9e 63 44 27 ff 00 00 03 00 00 03 00 00 03 00 00 03 00 00 03 00 21 b1 a6 17 96 7f bf a8 00 ee 06 1a 89 c5 e9 6c 14 cc 75 de 0f ef b2 f0 f5 d1 c0 50 92 7c 80 Data Ascii: 3s,t(<enW(UaD'!Hf`VfgvA{[V`X\|(F_jCZG}9b@]464d1/Ng`LI*7Z:T]3DM@hcD'!luP\|
2024-11-22 21:52:08 UTC	2780	IN	Data Raw: 71 05 30 82 3c 03 c7 53 27 66 2f fa 3b df 91 8b 70 09 6e 06 83 ab eb 63 36 86 04 48 dd 22 39 a0 22 88 56 0a 63 cf cc 05 25 8c 5c 42 2b 1e 26 12 89 42 a9 d5 2e f4 b8 b8 63 f3 3a 7a ec db b1 a1 cf fc 7a 67 95 a1 f3 97 94 b4 6e 3d 34 6e ca 50 62 6c 30 d4 cf 9b a4 40 30 d6 47 80 70 25 7b f3 df e9 3c de 4c 39 99 5b 54 a5 7d 47 6d 21 8c b7 81 27 e4 71 a1 c3 19 46 9a 6a 56 d3 50 c5 04 27 ca 68 9a 5e 91 f7 2d ee b4 fa 34 0e ae 64 70 6c 10 ef c6 7f d5 64 72 a6 5d 80 80 a3 f8 b6 99 5c cf 74 23 7e 67 16 0c 1b bb 03 2f cc 3a cb 9c 94 fa 18 5c 63 f5 00 3a 7a e2 39 0f 8b f8 63 90 43 41 19 d7 6c fc a0 e8 6e 29 a2 88 97 82 40 43 81 d4 fd 6d 2d 6d db 0c 68 dc 03 8f 23 8a 8e d2 5b 46 d9 46 79 56 60 b2 ea d2 5d b1 06 4b bc 14 39 59 df 9a bc 7a 06 e8 f4 0c 4c e0 c2 f9 35 57 Data Ascii: q0<S'f/;pnc6H"9"Vc%\B+&B.c:zzgn=4nPbl0@0Gp%{<L9[T}Gm!'qFjVP'h^-4dpldr]\t#~g/:\c:z9cCAln)@Cm-mh#[FFyV`]K9YzL5W
2024-11-22 21:52:08 UTC	2780	IN	Data Raw: 32 cb 71 1a 11 c1 d5 49 6b 68 c1 6c 73 0f e9 18 1b 47 af 1f c7 fd c6 ea b6 f2 ec 94 d7 fb bb e2 e9 01 bf f7 fc 07 79 8e e5 0b fd ff c8 77 5d 01 6c ba 72 87 32 58 ed 2a 48 1f 3b 74 16 4d 26 d7 d7 dd 25 6c 4e 76 07 e0 08 be 9a 6a 7d 80 8c 62 dd 7d 23 89 72 ea 95 1a d9 06 5b 2b d4 13 98 3e df 37 84 4e 3d 99 d1 cb d1 3b 3f f7 7b 18 e2 00 ee 64 14 ad e0 6d 06 3e 30 f4 03 f2 93 ab 54 8a da ae ba 4f b0 d5 5b 18 a5 69 7d 3b fe 44 6c 5b 8b 12 22 93 9a cf f9 df 5e 29 47 9a 8c 23 64 39 fd d7 38 a5 ac aa 5c 41 b7 d0 b2 f3 16 8f 2f 6c 08 a6 d7 e9 20 4d d6 d9 4a fe d6 e2 14 6a 92 4c 3a 79 a2 90 8c 25 85 14 6b 8a 2a 8c b8 76 66 0f 4b fc 01 2b fb c7 4f fd 9f fe 4e f6 2b b2 8d a2 02 32 91 b9 19 21 38 b5 e3 89 e1 9e 21 f2 83 d5 01 ef f6 bb 49 42 a7 66 7d 20 fb 72 52 7a 2f Data Ascii: 2qIkhlsGyw]lr2XH;tM&%lNvj}b}#r[+>7N=;?{dm>0TO[i};Dl["^)G#d98\A/l MJjL:y%kvfK+ON+2!8!IBf} rRz/

Timestamp	Bytes transferred	Direction	Data
2024-11-22 21:52:08 UTC	546	OUT	GET /v4/videos/raw/video/uvb3OY5vvzF0ewv1Z HTTP/1.1 Host: categories.api.godaddy.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" Accept-Encoding: identity;q=1, ;q=0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: /* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Accept-Language: en-US,en;q=0.9 Range: bytes=0-
2024-11-22 21:52:09 UTC	497	IN	HTTP/1.1 206 Partial Content Date: Fri, 22 Nov 2024 21:52:09 GMT Content-Type: video/mp4 Content-Length: 3456229 Connection: close x-powered-by: Slay x-request-id: e25e62c2-657c-47ea-8d65-594e27709ebb Vary: Referer, Accept-Encoding Access-Control-Allow-Credentials: true Cache-Control: max-age=86400, must-revalidate Accept-Ranges: bytes Content-Range: bytes 0-3456228/3456229 ETag: "1d1608c9dbd5117770d2ab4d28141f30" Strict-Transport-Security: max-age=15724800; includeSubDomains
2024-11-22 21:52:09 UTC	3599	IN	Data Raw: 00 00 00 20 66 74 79 70 6d 70 34 32 00 00 02 00 69 73 6f 6d 69 73 6f 32 61 76 63 31 6d 70 34 31 00 00 2a 5a 6d 6f 6f 76 00 00 00 6c 6d 76 68 64 00 00 00 00 d6 21 31 ae d6 21 31 ae 00 00 03 e8 00 00 51 83 00 01 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 18 69 6f 64 73 00 00 00 00 10 80 80 80 07 00 4f ff ff ff fe ff 00 00 29 5f 74 72 61 6b 00 00 00 5c 74 6b 68 64 00 00 00 03 d6 21 31 ae d6 21 31 ae 00 00 00 01 00 00 00 00 00 00 51 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 Data Ascii: ftypmp42isomiso2avc1mp41*Zmoovlmvhd!1!1Q@iodsO)_trak\tkhd!1!1Q
2024-11-22 21:52:09 UTC	4096	IN	Data Raw: 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 01 00 00 17 70 00 00 00 01 00 00 00 00 00 00 00 01 00 00 0b b8 00 00 00 01 00 00 3a 98 00 00 00 Data Ascii: p:p:p:p:p:p:p:p:
2024-11-22 21:52:09 UTC	4096	IN	Data Raw: 00 00 1c d3 00 00 12 f1 00 00 14 fa 00 00 34 a7 00 00 1d 18 00 00 13 10 00 00 14 8f 00 00 35 6d 00 00 1c e2 00 00 12 5e 00 00 13 fa 00 00 36 38 00 00 1e 98 00 00 15 01 00 00 13 52 00 00 33 be 00 00 1c aa 00 00 13 51 00 00 13 22 00 00 34 43 00 00 1d 05 00 00 13 54 00 00 12 63 00 00 33 fb 00 00 1d 14 00 00 13 4d 00 00 11 56 00 00 33 d6 00 00 1c 98 00 00 12 79 00 00 12 c2 00 00 34 5b 00 00 1c 09 00 00 12 87 00 00 12 1f 00 00 33 2d 00 00 1b f8 00 00 11 d4 00 00 11 1e 00 00 31 a8 00 00 1c 25 00 00 12 0c 00 00 11 66 00 00 2f d8 00 00 1b 56 00 00 11 a1 00 00 10 9b 00 00 31 05 00 00 1b 78 00 00 10 73 00 00 10 74 00 00 2f 35 00 00 1a 8c 00 00 10 e8 00 00 0f 6f 00 00 2d e6 00 00 18 cd 00 00 0f eb 00 00 0e 26 00 00 2a f9 00 00 19 4e 00 00 0f 71 00 00 0e 50 00 00 28 Data Ascii: 45m^68R3Q"4CTc3MV3y4[3-1%f/V1xst/5o-&*NqP(

Target ID:	0
Start time:	16:50:49
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7da580000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	16:50:50
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2196,i,16079074356059325000,1756189301792084668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2212 /prefetch:3
Imagebase:	0x7ff7da580000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false