Edit tour

Windows Analysis Report
https://token.onelogin.com-token-auth.com/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K

Overview

General Information

Sample URL:	https://token.onelogin.com-token-auth.com/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRM
Analysis ID:	1573356
Infos:

Detection

KnowBe4

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected KnowBe4 simulated phishing

AI detected suspicious URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5820 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2020,i,17887203465776148993,7046714387287980499,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://token.onelogin.com-token-auth.com/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09?cid=2323041528" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.0.pages.csv	JoeSecurity_KnowBe4	Yara detected KnowBe4 simulated phishing	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected KnowBe4 simulated phishing

Source: Yara match

File source: 1.0.pages.csv, type: HTML

AI detected suspicious URL

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://token.onelogin.com-token-auth.com
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://token.onelogin.com-token-auth.com

Source: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09

HTTP Parser: No favicon

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09?cid=2323041528 HTTP/1.1Host: token.onelogin.com-token-auth.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09 HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://token.onelogin.com-token-auth.com/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09?cid=2323041528Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=wnNt_CG7ZLtq0e5HHJ7SjL_hW2E8Y_opWRhP4c76C2A-1733949212-1.0.1.1-OyygmnwvlEN11MMwQsK3LwSRphv5BXAWuKz5lFUKevDEXdLsQJehmFZ71fsadt4b0B_yaOgG3s64g__OVr_g3A
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=wnNt_CG7ZLtq0e5HHJ7SjL_hW2E8Y_opWRhP4c76C2A-1733949212-1.0.1.1-OyygmnwvlEN11MMwQsK3LwSRphv5BXAWuKz5lFUKevDEXdLsQJehmFZ71fsadt4b0B_yaOgG3s64g__OVr_g3AIf-None-Match: "ddf47be00ad3eebaabd63fec4c5733f2"If-Modified-Since: Fri, 29 Mar 2024 19:46:11 GMT
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=wnNt_CG7ZLtq0e5HHJ7SjL_hW2E8Y_opWRhP4c76C2A-1733949212-1.0.1.1-OyygmnwvlEN11MMwQsK3LwSRphv5BXAWuKz5lFUKevDEXdLsQJehmFZ71fsadt4b0B_yaOgG3s64g__OVr_g3AIf-None-Match: "ddf47be00ad3eebaabd63fec4c5733f2"If-Modified-Since: Fri, 29 Mar 2024 19:46:11 GMT
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: token.onelogin.com-token-auth.com
Source: global traffic	DNS traffic detected: DNS query: secured-login.net
Source: global traffic	DNS traffic detected: DNS query: cdn2.hubspot.net

Source: chromecache_66.2.dr	String found in binary or memory: https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
Source: chromecache_66.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Acme
Source: chromecache_72.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/acme/v25/RrQfboBx-C5_XxrBbg.woff2)
Source: chromecache_72.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/anton/v25/1Ptgg87LROyAm3K8-C8QSw.woff2)
Source: chromecache_72.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/anton/v25/1Ptgg87LROyAm3K9-C8QSw.woff2)
Source: chromecache_72.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/anton/v25/1Ptgg87LROyAm3Kz-C8.woff2)
Source: chromecache_67.2.dr	String found in binary or memory: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV
Source: chromecache_66.2.dr	String found in binary or memory: https://www.knowbe4.com

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: classification engine

Classification label: mal52.phis.win@17/22@12/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2020,i,17887203465776148993,7046714387287980499,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://token.onelogin.com-token-auth.com/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09?cid=2323041528"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2020,i,17887203465776148993,7046714387287980499,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://token.onelogin.com-token-auth.com/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09?cid=2323041528	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cdn2.hubspot.net	104.18.87.62	true	false	high
www.google.com	142.250.181.100	true	false	high
secured-login.net	34.235.63.222	true	false	high
landing.training.knowbe4.com	3.82.118.141	true	false	high
token.onelogin.com-token-auth.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://secured-login.net/favicon.ico	false	high
https://secured-login.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css	false	high
https://secured-login.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js	false	high
https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.knowbe4.com	chromecache_66.2.dr	false		high
https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV	chromecache_67.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.87.62	cdn2.hubspot.net	United States	13335	CLOUDFLARENETUS	false
34.235.63.222	secured-login.net	United States	14618	AMAZON-AESUS	false
3.82.118.141	landing.training.knowbe4.com	United States	14618	AMAZON-AESUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573356
Start date and time:	2024-12-11 21:32:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://token.onelogin.com-token-auth.com/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09?cid=2323041528
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@17/22@12/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.19.238, 173.194.222.84, 142.250.181.142, 172.217.19.170, 199.232.210.172, 216.58.208.227, 192.229.221.95, 172.217.17.35, 184.28.90.27, 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://token.onelogin.com-token-auth.com/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09?cid=2323041528

Simulations

Behavior and APIs

⊘No simulations

Input	Output
URL: https://token.onelogin.com-token-auth.com Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://token.onelogin.com-token-auth.com
URL: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJ Model: Joe Sandbox AI	{ "brands": [ "KnowBe4" ] }

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 19:33:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9863327406459206
Encrypted:	false
SSDEEP:	48:8HodDTrnKHfidAKZdA19ehwiZUklqehQy+3:8H83W/y
MD5:	D58E067A6766365167B79A8D0B056421
SHA1:	B680F82242F91E22E0AFAC951B005137D9DC24BE
SHA-256:	FA7A1EDAF1E55067BE4F250CFB8C52395D4E7A260FFE551799101549D8AFFF45
SHA-512:	DF590B46732E4AC7917F4317E11F6DD41BE666353D4DD215B2BF5760346E0B3D395B3EC70CD2690FF3E401B0213C965D332824F85FB5673757F8E30AF7903F33
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......]..L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y(.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y(.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y(.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y(............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y)............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E&......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 19:33:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000957179970375
Encrypted:	false
SSDEEP:	48:8ndDTrnKHfidAKZdA1weh/iZUkAQkqehvy+2:8x309QWy
MD5:	D02D482142E34D1A37B3445BACD68683
SHA1:	BDDCB46330F63F5ADDF89EE4B81C5D4FADC1B48B
SHA-256:	E1DFC5A9E294300EDBF8F494683D5E9BDD3C7131D739D91F0494012DC7012CAC
SHA-512:	478F4D83BAC2A79909A05180D7062A2900ED42B6FBBA1EB8259D02ECC8EE6907EABB88CF6D18D8524F624C828CED04380E837E36BF8AF57701A803DEBF3007F9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......Q..L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y(.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y(.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y(.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y(............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y)............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E&......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.011400946849614
Encrypted:	false
SSDEEP:	48:8xQdDTrnsHfidAKZdA14tseh7sFiZUkmgqeh7sdy+BX:8xk3inLy
MD5:	05D704497186F71F579D2EFC9AFCBB5E
SHA1:	54AF00E10DE17329BE70583B5686292B15DE85CE
SHA-256:	516C63E015405348B85A99A31DBACADC77D11346242AB9E29CA29F09590ED4CA
SHA-512:	CB4E774EA2D281E3D582B8C8A685A14B5D11371CBA0721DF25D7EA9F4A25F62147A9C748906AC0642BB5E971E7FDE405DB7AC4DFCBD37B49114A6135A1C6C960
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y(.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y(.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y(.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y(............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E&......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 19:33:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9979718877143
Encrypted:	false
SSDEEP:	48:8XIdDTrnKHfidAKZdA1vehDiZUkwqehjy+R:8M3fVy
MD5:	6419F3F4B043594FE54691F62F8F6A95
SHA1:	23601368448DA662F1B8CF73F286BAFF9E06D98C
SHA-256:	0456CA04122319DF3A68D4B18D4F63BEC62DDA05D3A12AD399D6303CF0478DFB
SHA-512:	7CD6139189CC4D9C614B4A1CFC460749D40F2FEE95F181A46F831DAAE708DD8366785DEF5D287B714D381BCF878CC04D2CFE11C3C1D4EDA6FE05E1EEA931E85C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....9M..L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y(.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y(.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y(.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y(............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y)............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E&......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 19:33:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.985703068800484
Encrypted:	false
SSDEEP:	48:86dDTrnKHfidAKZdA1hehBiZUk1W1qehJy+C:8C3f9py
MD5:	D859FC906D1D124E5C13FCB9628134BD
SHA1:	58D5A054029333469BFB45AB1127CFFE86207AD2
SHA-256:	8523111590F34A93ADA72B3B60D6D00DD9A988D0F623BE08E61B025F5AA4F0C3
SHA-512:	18097A091CC26D4E7762B9BC6BBD6149892D45B47A8BB370DE674D13A5F9C5E4D3E05107B4DA8E88F25DD76B31F3A2A6A29F3FA30390692C799C4897F5C7A08F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....%Y..L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y(.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y(.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y(.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y(............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y)............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E&......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 19:33:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.998934775940593
Encrypted:	false
SSDEEP:	48:8ndDTrnKHfidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8x3XT/TbxWOvTbLy7T
MD5:	932971B30AC9D3104C7D786A7560C1BC
SHA1:	42FFB2A86E9C8442D5428AAF90A03BD69ECF6A57
SHA-256:	7355A31249D728067437D0DA4F0F5A9929D8B13A27A17F8C53956F4F4E7AD6DB
SHA-512:	70356BD34969FD1A513E874D01FC102693635AED69D8E89A91384E58A6498C71834932E458C097F7FD49D5DA61C437E0C3DC3792637B6504B8D52F51CB92CE8F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......>..L..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y(.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y(.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y(.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y(............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y)............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E&......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2368
Entropy (8bit):	7.857782123483033
Encrypted:	false
SSDEEP:	48:eN+jd/MwX0F4lR7ZlqMmlNl08Q0+mNUjxulVE2Uh9wg0n:Njd/M62KJZVmlDJQ0+mGxykh9wg0
MD5:	402214A564EAB22101571DF8C6E30B79
SHA1:	D5E452981A5C325383F92BFB964BA28ECEA6FFA6
SHA-256:	8D63A7ED00572C8B418FF91F5B2E5CD667AA7226CE280E48FC8FE9D58A4D98AC
SHA-512:	D7FD2C24B182ACEA57713FB9EFD19371802B1AE748F7B01FA82D822A86F70267D94C5105FB6BD1967BCDBC1FC43DE484F2B647DFD1EC729531BD4E89814CA42C
Malicious:	false
Reputation:	low
URL:	https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
Preview:	RIFF8...WEBPVP8L,.../.@...0..M._.w..1..WVaU.W,K..m..}.J.]...=..:].Dz.=....~......M.O.PneX(.......3.4..........;.f;..I2..L.....$[J....wA.a....,....@.$.].m.m.m..l.N.mcO..l.-....[t...5....-.%.....A.f ..D.`._@+.q.?.....8...(..-.^.i.,...]f..a...i....Tw.p..B....."...J'......O..J9..L.%P...{..H..JP.jP-.Cu...P{jFU..%.P[.%B....3....X.'PO.Y.....bE....P........?J.U...P!......O5.M..rT./LQ"JI..uCR...BR...S...-U.].YR...(..R..t4.....J...c..J1)\|....) ^.C....=`.bR..~+.h.5.T......".....GS.u..\|.._Dj..".D....,.7....<1.PU.t...X}.[8H1;T!+....H...R..I.\..f..V..P.S..+...m..s.659FlS.I....Ph.).....GhV.v+...&......l...K.^Q.)...7....5.<....a..%.t....<.(.....;2.n....K...9.J.B....Lf...T..!a..(....0H....E1......Qn.+.j.....v.R6.1G..?B......~.....&R....F...2.....}.(m.....).....]..I.....~.e.Z.T..U..C.OE.[......Zq..F.hc.W..,E.\|.Bu..SQ;..`.a.......\|..?..}..COX4.....!{'P..J.8:..U...\..S.{8U1......J.P.N*._...9L......#<...v..n...M...8..##.r..]\..e\|.....D.t.@...

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
Reputation:	low
URL:	https://secured-login.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (385)
Category:	downloaded
Size (bytes):	4658
Entropy (8bit):	5.306152515920272
Encrypted:	false
SSDEEP:	96:O4/OnyZWOwzcMRjdvtv0w7/Jo29Jq5EjJs+J4t9Mui2X5ovzCzwDl:ObyZWOwzcMJdGe/l5aeui2XW6wB
MD5:	C5AA485D724344B3560ABD7EEE0EC4CE
SHA1:	4017D9F4CA0B7B368466281F8A7939A62E59DD87
SHA-256:	746A1ED2056668383D8B65993BA1C8F926A38E16B2386C0C954E3AEE09459F79
SHA-512:	182515F650A3B66B7063FC21DEBF9F44A4BF7F9DA6D16B8768D1FB090286ABD3CB12D71D37C5B0861E9D2799D5F8645045295C04E254E6B575ABCFC90283F9B1
Malicious:	false
Reputation:	low
URL:	https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN". "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">. <meta name="IMPORTANT" content="This page is part of a simulated phishing attack initiated by KnowBe4 on behalf of its customers." />. <meta name="IMPORTANT" content="If you have any questions please contact support@knowbe4.com." />. <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible"/>. <meta name="robots" content="noindex, nofollow" />.. <head>. <script src="/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js"></script>.. <link rel="stylesheet" href="/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css" media="all" />.. </head>. .<link href="https://fonts.googleapis.com/css?family=Acme\|Anton" rel="stylesheet">.<style type="text/css">body {.background-color: #343637;.}...container {.position: relative;.margin: 5% au

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (416)
Category:	downloaded
Size (bytes):	470
Entropy (8bit):	5.85651513806979
Encrypted:	false
SSDEEP:	12:3R+xnrwYLYh/UyNoN1XpfMdfrTi9OA2bC4AEdeIQL:3ErwgYh/UyNu1XRMZfiHkCNEkj
MD5:	EF7AF54552F63D4073B50312478D2AB2
SHA1:	05FC2D9DE4DAFA968E50DF926569DE6C6F8DCAE4
SHA-256:	7A8C25B6C487DACDF0BB205FAEBD73C1B0D85B37E921D43C0FD26C1D04C7327A
SHA-512:	FE37B279F90A55B3DAADA5D71A479FD75F91227389692F2754F16D817D8E500CF39FA3ED84C582B559508466A5325D593BF9459834F159CA3F299A2A6C39C4E8
Malicious:	false
Reputation:	low
URL:	https://token.onelogin.com-token-auth.com/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09?cid=2323041528
Preview:	<html>. <head>. <script>window.location.href = 'https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09';</script>. </head>. <body>. </body>.</html>.

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 8236, version 1.0
Category:	downloaded
Size (bytes):	8236
Entropy (8bit):	7.969325649130019
Encrypted:	false
SSDEEP:	192:GUpWXNPlpLRKLo/ymzypjE0rI0eq/KOvSxLnoc4l1A7DmDdRHp1Y4N2:GU8XN9px/y1WQI0t/KB8N/A7DmDTHA4U
MD5:	06EFD00B7F74385C105F230DFFA6CCA0
SHA1:	1DDD4E5F12E2EFB9DC91FD179C39809E1567CA9B
SHA-256:	BB814AC86E7F409154CED702B9F3543761D09410E837EC728242E6B980A26AA0
SHA-512:	DCB5C904AEB206F592E488B1E09E0C8D8709DE614F6BF407E1A19C49FE8FB93938E139A9E998A1647A845EE712387396CEFE6AEBF1A7888EC7D8D2CDC11FB07C
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/acme/v25/RrQfboBx-C5_XxrBbg.woff2
Preview:	wOF2...... ,......LX...............................`........(.P..&..6.$..H. ..v..S...s:3.V.=......-.L".^f..E......Nk...T./?....`.L\........FH2;<...Q.6...!Fb...b.%"F...p..+.Wk].+...&..].:....:..m...u......7...{...$.7......].. ..\|8..\|...]..`[4......?b..~.. ..X.H..T..&.e....t~...7.M.w.@.Za{..+......,`..O...9..mf'}...."Ib.G....X.n.@.(....i.........c...o.V&u.....8... .`I.H.../.......uG.......:g..`~...n.eO......?N....B..ma........`A.=.)......l.+~....F..-v..a......k....b...Vm...=}........=.]..m]Rw.._..F......g..e...+7.~.emHG....C>.uC......@.;.....XA@..d...N.F..y...T ...Z..%a8....\|....r....+9V...._..u...9;{..]...j...f&.q.^b. g.r..)....Y.PQ.IKku9.9.g....q....x}.Oc.9.......7".B%'s.@.J....k.....3...&....F.i..\K@)T$.s\H....-.dG.....U.Z.m..Y..h..c.._...].s ..n.6m...].......4M.&...j/S1..>...)..(.4[=}...F].F.tJ..x....'..~....\|.o.Dy.i(..._v..=+.2....{UUt OY....<.6.....Rj\.>7:S..S...(..k....c..7...I....%..u...3}>.......j.......E\V.......m.....L.O....p..9...

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
Reputation:	low
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1471
Entropy (8bit):	4.754611179426391
Encrypted:	false
SSDEEP:	24:y40r8CQo40agx40mC400XLaR404hZYmx40vGk40vG/I40vGhH40VhZ40UrCmn:xdDgCFEiBZgnTOHTn
MD5:	15E89F9684B18EC43EE51F8D62A787C3
SHA1:	9CBAAACEAE96845ECD3497F41EE3B02588ABEC11
SHA-256:	16F13E16A7EF02FB6F94250AA1931DED83DBEE5D9FAD278E33DD5792D085194F
SHA-512:	79E0110A045F28437D192290AC9789270CB0D4E676A985564746DB439992D867BA89639D7738E2A7F7D83BBF37D9A02CAA2AE1DC4E0EE2519797E5840A47FABE
Malicious:	false
Reputation:	low
URL:	https://secured-login.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css
Preview:	/* line 1, app/assets/stylesheets/landing-watermark.scss /..watermark {. -webkit-writing-mode: vertical-rl;. -ms-writing-mode: tb-rl;. writing-mode: vertical-rl;. text-orientation: sideways;.}../ line 4, app/assets/stylesheets/landing-watermark.scss /..watermark.left {. left: 0;.}../ line 7, app/assets/stylesheets/landing-watermark.scss /..watermark.right {. right: 0;.}../ line 10, app/assets/stylesheets/landing-watermark.scss /..watermark.top {. text-align: center;. -webkit-writing-mode: horizontal-tb;. -ms-writing-mode: lr-tb;. writing-mode: horizontal-tb;. top: -38px;.}../ line 15, app/assets/stylesheets/landing-watermark.scss /..watermark h1 {. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. user-select: none;. font-size: 15px;. color: #fdfdfa;. font-weight: bold;.}../ line 24, app/assets/stylesheets/landing-watermark.scss /.#template_sei .watermark.left {. margin-left: -10px;.}../ li

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 38, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3014
Entropy (8bit):	7.902919939139106
Encrypted:	false
SSDEEP:	48:vnJJCJaqcfDoxU8qAg6opvwr+FYc1lWO1pPGDfMexqwFYRFlIe9BhGtAHIWVRs:vnJJ8CESXp66vwPuGDfMexqwALvhTFTs
MD5:	E154B58FD2CD3F1F2E2C6C810BB1E65B
SHA1:	CAEF301E8550A910909ECE9471669DA0C32EA6F0
SHA-256:	E8C5A2C9860C1A6CC7C949B9D7C793E5E435D75996DEBEB295A959F3D09831C0
SHA-512:	464EC940E824EAB8B7F83EB40852DD3019E84BE7B1A0F75AF288656605426B2EE386FA7FF102E0144AA065F053E88E8356E7C185B4DC393CC4D8EB0ADC877312
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......&........l....IDATx...{h.U..q...Ms"e.ej,..M.,](&..B...)G.F...2.22oY......L.%...iF......L.e.dsn.Oo.@..?...........y...s...=...D-jQ.D..&C1..Mr_9.n...p.8.W...x....8d..Nl.b..=h...b<.`...W .GI...S.Q....l..b ....G.F2.+ ...C..u...2j.?Z.).....!-...d)2]..d.;p.,.t@>F>.3}9....... ......v@.>4.= ..B.5H..e.....5i.?NP....<.Y.LWx.a.>8..?.M.$S> .C...r...:.,...OLWx.a.v8.....c.....Z../...M........m.,..Rl..1.X.Y........j@.@.%.2l....YJR..?.....5 ..G.d.BF./.L\........,J..~...0]...,...q.7x....h}.m..#...."<...0q....8.9.`...e...EV...m..p.M}H.y...H..l.~...x..0...<.....d..Xh.1.~.Y.M`.].Q....:...8.....M1.'..~.h...g{..OD..f.Hc.g.(..)....,.y.w.\.....HO" /A.\..Z@...$...].,.<.G..WavB...q....\...H..<.t=d...-VWTC.I........jv...!....N@..0..M...."._B....%X.R.q.....W.'WAL..'m].+.j.pF.8,...V.Jc..@....E...\|L...=.[..2&^......y....X..1..(.F..,..f.5..dT...b>..q>.;..d....:.O..)N. ..\.......s..R...UcD..d;ct.,+<.c;.W...!K.$..... .g.../.,5.T..g7l.,...p. .8.]...C_4...?

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1518
Entropy (8bit):	5.269828755683586
Encrypted:	false
SSDEEP:	24:R7OYsVwy96cGSSfI1/EMOYssedkL/AZzhEMOYssedXftJc+u/rEMOYssedx8wy9+:tOLVN0xAVOLrQevOLr9FJc+uxOLr0N0V
MD5:	B9171ECB226196CFFBD4A35606BE3D02
SHA1:	9F1CA9E6B30FD4B8D26E51C0AC981995AB7EBE70
SHA-256:	55B61805517582BA67D47A0110594C6938888438944F4E975D86E26DE9BB753D
SHA-512:	DE4DFD9881BFE9FD613CA63BDAE01D7E1994D1AF3F4511F8A4611F7035B0765325D78583F42A4C19352D6165AAAA8E4F21DFC916682AA354686EDFF8F5EBCF7F
Malicious:	false
Reputation:	low
URL:	https://fonts.googleapis.com/css?family=Acme\|Anton
Preview:	/* latin /.@font-face {. font-family: 'Acme';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/acme/v25/RrQfboBx-C5_XxrBbg.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;.}./ vietnamese /.@font-face {. font-family: 'Anton';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/anton/v25/1Ptgg87LROyAm3K8-C8QSw.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./ latin-ext */.@font-face {. font-family: 'Anton';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/anton/v25/1Ptgg87LROyAm3K9-C8QSw.woff2) format('woff2');. unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+0

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 21:33:10.352222919 CET	49675	443	192.168.2.5	23.1.237.91
Dec 11, 2024 21:33:10.363914967 CET	49674	443	192.168.2.5	23.1.237.91
Dec 11, 2024 21:33:10.473609924 CET	49673	443	192.168.2.5	23.1.237.91
Dec 11, 2024 21:33:19.955913067 CET	49675	443	192.168.2.5	23.1.237.91
Dec 11, 2024 21:33:19.971538067 CET	49674	443	192.168.2.5	23.1.237.91
Dec 11, 2024 21:33:20.081022024 CET	49673	443	192.168.2.5	23.1.237.91
Dec 11, 2024 21:33:21.659069061 CET	49712	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:33:21.659162045 CET	443	49712	142.250.181.100	192.168.2.5
Dec 11, 2024 21:33:21.659265995 CET	49712	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:33:21.659549952 CET	49712	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:33:21.659573078 CET	443	49712	142.250.181.100	192.168.2.5
Dec 11, 2024 21:33:22.601227999 CET	443	49703	23.1.237.91	192.168.2.5
Dec 11, 2024 21:33:22.601356030 CET	49703	443	192.168.2.5	23.1.237.91
Dec 11, 2024 21:33:23.356069088 CET	443	49712	142.250.181.100	192.168.2.5
Dec 11, 2024 21:33:23.356420994 CET	49712	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:33:23.356452942 CET	443	49712	142.250.181.100	192.168.2.5
Dec 11, 2024 21:33:23.358072996 CET	443	49712	142.250.181.100	192.168.2.5
Dec 11, 2024 21:33:23.358196020 CET	49712	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:33:23.361844063 CET	49712	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:33:23.361929893 CET	443	49712	142.250.181.100	192.168.2.5
Dec 11, 2024 21:33:23.411290884 CET	49712	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:33:23.411324978 CET	443	49712	142.250.181.100	192.168.2.5
Dec 11, 2024 21:33:23.458873034 CET	49712	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:33:23.872165918 CET	49714	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:23.872172117 CET	49715	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:23.872221947 CET	443	49714	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:23.872261047 CET	443	49715	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:23.872373104 CET	49715	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:23.872462034 CET	49714	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:23.872625113 CET	49715	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:23.872649908 CET	443	49715	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:23.872767925 CET	49714	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:23.872822046 CET	443	49714	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:25.541495085 CET	443	49715	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:25.541848898 CET	49715	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:25.541882992 CET	443	49715	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:25.543348074 CET	443	49715	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:25.543432951 CET	49715	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:25.544558048 CET	49715	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:25.544636965 CET	443	49715	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:25.544945955 CET	49715	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:25.544954062 CET	443	49715	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:25.599195004 CET	49715	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:25.608582973 CET	443	49714	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:25.608814955 CET	49714	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:25.608848095 CET	443	49714	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:25.612428904 CET	443	49714	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:25.612509012 CET	49714	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:25.613027096 CET	49714	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:25.613192081 CET	443	49714	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:25.661393881 CET	49714	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:25.661423922 CET	443	49714	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:25.707626104 CET	49714	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:26.051960945 CET	443	49715	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:26.052067041 CET	443	49715	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:26.052279949 CET	49715	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:26.053316116 CET	49715	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:26.053339958 CET	443	49715	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:26.472493887 CET	49716	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:26.472589970 CET	443	49716	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:26.472639084 CET	49717	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:26.472739935 CET	443	49717	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:26.472814083 CET	49716	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:26.472851038 CET	49717	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:26.473054886 CET	49716	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:26.473092079 CET	443	49716	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:26.473170042 CET	49717	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:26.473217010 CET	443	49717	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:28.389473915 CET	443	49716	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:28.389475107 CET	443	49717	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:28.389864922 CET	49717	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:28.389933109 CET	443	49717	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:28.389964104 CET	49716	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:28.390032053 CET	443	49716	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:28.391472101 CET	443	49717	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:28.391549110 CET	443	49716	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:28.391591072 CET	49717	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:28.391655922 CET	49716	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:28.392899036 CET	49716	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:28.392999887 CET	443	49716	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:28.393114090 CET	49717	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:28.393219948 CET	49716	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:28.393235922 CET	443	49717	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:28.393239975 CET	443	49716	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:28.442431927 CET	49716	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:28.442558050 CET	49717	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:28.442625999 CET	443	49717	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:28.489691019 CET	49717	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:30.363862991 CET	443	49716	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:30.363919973 CET	443	49716	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:30.364098072 CET	443	49716	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:30.364149094 CET	49716	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:30.364217043 CET	49716	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:30.365046024 CET	49716	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:30.365070105 CET	443	49716	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:30.381654024 CET	49717	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:30.382199049 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:30.382251978 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:30.382342100 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:30.382932901 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:30.382968903 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:30.427336931 CET	443	49717	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:30.829425097 CET	443	49717	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:30.829462051 CET	443	49717	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:30.829538107 CET	443	49717	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:30.829679012 CET	49717	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:30.829679966 CET	49717	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:30.835074902 CET	49717	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:30.835128069 CET	443	49717	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:30.978064060 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:30.978142977 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:30.978238106 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:30.978441000 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:30.978467941 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:31.668303967 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:31.668602943 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:31.668637037 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:31.669748068 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:31.670156002 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:31.670326948 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:31.670402050 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:31.711337090 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:32.201522112 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.201880932 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.201900005 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.203542948 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.203617096 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.203623056 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.203672886 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.207731009 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.207827091 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.207969904 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.207976103 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.254872084 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.694297075 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.694510937 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.694592953 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.694595098 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.694624901 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.694816113 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.694829941 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.694849014 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.695486069 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.696965933 CET	49721	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.696985006 CET	443	49721	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.843514919 CET	49724	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.843571901 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.843710899 CET	49724	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.844067097 CET	49724	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:32.844079018 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:32.937881947 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:32.937946081 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:32.937989950 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:32.938148022 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:32.938148022 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:32.938209057 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:32.938448906 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:32.986896038 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:32.986947060 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:32.987077951 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:32.987077951 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:32.987097979 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.036396027 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.047038078 CET	443	49712	142.250.181.100	192.168.2.5
Dec 11, 2024 21:33:33.047111988 CET	443	49712	142.250.181.100	192.168.2.5
Dec 11, 2024 21:33:33.048229933 CET	49712	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:33:33.144675970 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.144740105 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.144781113 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.144804955 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.144824028 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.145001888 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.173352957 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.173403025 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.173470020 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.173537016 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.173573017 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.174159050 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.206278086 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.206329107 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.206562042 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.206562996 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.206626892 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.206829071 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.241554022 CET	49712	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:33:33.241580963 CET	443	49712	142.250.181.100	192.168.2.5
Dec 11, 2024 21:33:33.261562109 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.261629105 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.261655092 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.261676073 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.261708975 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.261730909 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.348083019 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.348121881 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.348227978 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.348228931 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.348278999 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.348480940 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.369309902 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.369378090 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.369425058 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.369446039 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.369469881 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.369496107 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.388639927 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.388688087 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.388834000 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.388834000 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.388900042 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.388955116 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.402331114 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.402375937 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.402532101 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.402532101 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.402595043 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.402661085 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.415704012 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.415736914 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.415785074 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.415800095 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.415831089 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.415849924 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.523977041 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.524029016 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.524090052 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.524159908 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.524199009 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.524224043 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.536434889 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.536473989 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.536516905 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.536531925 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.536562920 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.536746025 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.546793938 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.546828032 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.546878099 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.546890974 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.546921015 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.546964884 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.558760881 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.558794022 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.558849096 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.558861971 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.558887959 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.560739040 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.570847988 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.570903063 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.570946932 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.570957899 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.570986032 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.571006060 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.581948042 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.581995010 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.582025051 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.582036972 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.582067966 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.582087040 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.593811989 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.593862057 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.593894005 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.593908072 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.593934059 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.593954086 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.605799913 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.605853081 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.605891943 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.605906010 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.605937004 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.605957031 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.717504025 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.717572927 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.717713118 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.717714071 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.717782021 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.717993021 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.725656986 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.725701094 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.726016998 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.726032972 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.726090908 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.735275030 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.735354900 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.735363007 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.735388041 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.735424042 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.735447884 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.744386911 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.744445086 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.744474888 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.744488001 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.744515896 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.744535923 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.746929884 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.747013092 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.747025013 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.747112036 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.747157097 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.747180939 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.747329950 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.747329950 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.747363091 CET	443	49718	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:33.747548103 CET	49718	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:33.811780930 CET	49726	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:33.811836004 CET	443	49726	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:33.811955929 CET	49726	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:33.812191010 CET	49726	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:33.812211037 CET	443	49726	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:33.919375896 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:33.919419050 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:33.919497013 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:33.919747114 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:33.919759035 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:34.057861090 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:34.058180094 CET	49724	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:34.058197975 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:34.059642076 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:34.059792042 CET	49724	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:34.059799910 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:34.059895039 CET	49724	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:34.060132980 CET	49724	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:34.060213089 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:34.060311079 CET	49724	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:34.060317993 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:34.101869106 CET	49724	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:34.559539080 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:34.559658051 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:34.559703112 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:34.559748888 CET	49724	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:34.559768915 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:34.559834957 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:34.559951067 CET	49724	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:34.671791077 CET	49724	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:34.671822071 CET	443	49724	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:35.027370930 CET	443	49726	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:35.027645111 CET	49726	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:35.027659893 CET	443	49726	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:35.028126955 CET	443	49726	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:35.028525114 CET	49726	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:35.028604984 CET	443	49726	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:35.028669119 CET	49726	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:35.071341038 CET	443	49726	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:35.554621935 CET	443	49726	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:35.554779053 CET	443	49726	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:35.554852962 CET	49726	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:35.555335045 CET	49726	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:35.555351019 CET	443	49726	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:35.559187889 CET	49729	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:35.559211969 CET	443	49729	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:35.559278965 CET	49729	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:35.559468985 CET	49729	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:35.559483051 CET	443	49729	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:35.680100918 CET	49730	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:35.680160046 CET	443	49730	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:35.680265903 CET	49730	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:35.680483103 CET	49730	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:35.680501938 CET	443	49730	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:35.681278944 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:35.681477070 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:35.681493044 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:35.684914112 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:35.685034990 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:35.685712099 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:35.685787916 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:35.686331034 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:35.686336040 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:35.728965044 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.197639942 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.197698116 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.197720051 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.197760105 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.197766066 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.197793961 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.197805882 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.197813034 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.197839022 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.197839022 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.197870016 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.415117979 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.415153980 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.415258884 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.415379047 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.415379047 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.415379047 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.415406942 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.415420055 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.415469885 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.465152025 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.465217113 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.465322018 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.465322018 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.465337038 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.467333078 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.629982948 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.630050898 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.630083084 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.630096912 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.630167961 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.630167961 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.663665056 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.663721085 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.663780928 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.663786888 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.663845062 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.663845062 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.698028088 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.698077917 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.698148012 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.698152065 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.698339939 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.727545977 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.727592945 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.727644920 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.727648973 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.727706909 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.727854967 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.827385902 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.827404022 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.827565908 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.827574968 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.827733040 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.850156069 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.850173950 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.850274086 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.850281000 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.850333929 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.872997999 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.873012066 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.873090029 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.873095036 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.873169899 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.895715952 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.895730019 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.895803928 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.895809889 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.895852089 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.916152000 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.916166067 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.916522980 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.916544914 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.916605949 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.939543009 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.939577103 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.939635992 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.939640045 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.939701080 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.954973936 CET	443	49729	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:36.958228111 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.958252907 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.958323956 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.958344936 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:36.958375931 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.958400011 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:36.967828035 CET	49729	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:36.967850924 CET	443	49729	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:36.968985081 CET	443	49729	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:37.008209944 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.008230925 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.008291006 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.008313894 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.008359909 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.008378029 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.009223938 CET	49729	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:37.009578943 CET	443	49729	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:37.010363102 CET	49729	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:37.024111986 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.024133921 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.024285078 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.024291039 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.024365902 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.036765099 CET	443	49730	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:37.038582087 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.038604021 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.038697958 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.038703918 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.038748980 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.050005913 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.050003052 CET	49730	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:37.050025940 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.050075054 CET	443	49730	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:37.050101042 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.050107002 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.050165892 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.051229954 CET	443	49730	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:37.055350065 CET	443	49729	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:37.063438892 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.063465118 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.063548088 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.063553095 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.063599110 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.070369959 CET	49730	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:37.070523977 CET	49730	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:37.070538998 CET	443	49730	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:37.070574999 CET	443	49730	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:37.070913076 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.070934057 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.070977926 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.070982933 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.071038008 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.079446077 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.079468966 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.079541922 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.079546928 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.079586029 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.087706089 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.087727070 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.087798119 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.087804079 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.087846994 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.113149881 CET	49730	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:37.199343920 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.199367046 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.199440002 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.199464083 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.199490070 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.199512005 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.202280045 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.202351093 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.202357054 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.202389002 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.202404976 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.202441931 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.202694893 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.202708960 CET	443	49728	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.202718019 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.202759027 CET	49728	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.494362116 CET	443	49729	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:37.494512081 CET	443	49729	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:37.494581938 CET	49729	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:37.495083094 CET	49729	443	192.168.2.5	104.18.87.62
Dec 11, 2024 21:33:37.495105982 CET	443	49729	104.18.87.62	192.168.2.5
Dec 11, 2024 21:33:37.506525993 CET	443	49730	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:37.506673098 CET	443	49730	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:37.506747961 CET	49730	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:37.506997108 CET	49730	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:37.507026911 CET	443	49730	34.235.63.222	192.168.2.5
Dec 11, 2024 21:33:37.507041931 CET	49730	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:37.507083893 CET	49730	443	192.168.2.5	34.235.63.222
Dec 11, 2024 21:33:37.510596991 CET	49734	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.510667086 CET	443	49734	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:37.510762930 CET	49734	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.510941982 CET	49734	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:37.510974884 CET	443	49734	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:38.924530983 CET	443	49734	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:38.925014973 CET	49734	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:38.925074100 CET	443	49734	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:38.925362110 CET	443	49734	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:38.926001072 CET	49734	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:38.926001072 CET	49734	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:38.926063061 CET	443	49734	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:38.972126961 CET	49734	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:39.381678104 CET	443	49734	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:39.381762028 CET	443	49734	3.82.118.141	192.168.2.5
Dec 11, 2024 21:33:39.381932974 CET	49734	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:39.382586956 CET	49734	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:33:39.382605076 CET	443	49734	3.82.118.141	192.168.2.5
Dec 11, 2024 21:34:10.675261974 CET	49714	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:34:10.675319910 CET	443	49714	3.82.118.141	192.168.2.5
Dec 11, 2024 21:34:19.897444010 CET	443	49714	3.82.118.141	192.168.2.5
Dec 11, 2024 21:34:19.897538900 CET	443	49714	3.82.118.141	192.168.2.5
Dec 11, 2024 21:34:19.897598982 CET	49714	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:34:21.238857985 CET	49714	443	192.168.2.5	3.82.118.141
Dec 11, 2024 21:34:21.238892078 CET	443	49714	3.82.118.141	192.168.2.5
Dec 11, 2024 21:34:21.582199097 CET	49827	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:34:21.582252979 CET	443	49827	142.250.181.100	192.168.2.5
Dec 11, 2024 21:34:21.582376957 CET	49827	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:34:21.582602978 CET	49827	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:34:21.582613945 CET	443	49827	142.250.181.100	192.168.2.5
Dec 11, 2024 21:34:23.275957108 CET	443	49827	142.250.181.100	192.168.2.5
Dec 11, 2024 21:34:23.276205063 CET	49827	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:34:23.276227951 CET	443	49827	142.250.181.100	192.168.2.5
Dec 11, 2024 21:34:23.276889086 CET	443	49827	142.250.181.100	192.168.2.5
Dec 11, 2024 21:34:23.277168989 CET	49827	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:34:23.277257919 CET	443	49827	142.250.181.100	192.168.2.5
Dec 11, 2024 21:34:23.331336021 CET	49827	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:34:33.001113892 CET	443	49827	142.250.181.100	192.168.2.5
Dec 11, 2024 21:34:33.001240969 CET	443	49827	142.250.181.100	192.168.2.5
Dec 11, 2024 21:34:33.001451969 CET	49827	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:34:33.239546061 CET	49827	443	192.168.2.5	142.250.181.100
Dec 11, 2024 21:34:33.239610910 CET	443	49827	142.250.181.100	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 21:33:17.002403975 CET	53	52227	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:19.803273916 CET	53	60234	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:21.519927025 CET	64411	53	192.168.2.5	1.1.1.1
Dec 11, 2024 21:33:21.520055056 CET	49423	53	192.168.2.5	1.1.1.1
Dec 11, 2024 21:33:21.657306910 CET	53	64411	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:21.657402992 CET	53	49423	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:23.070033073 CET	50794	53	192.168.2.5	1.1.1.1
Dec 11, 2024 21:33:23.073613882 CET	50466	53	192.168.2.5	1.1.1.1
Dec 11, 2024 21:33:23.869468927 CET	53	50794	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:23.870881081 CET	53	50466	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:26.102905989 CET	58289	53	192.168.2.5	1.1.1.1
Dec 11, 2024 21:33:26.103079081 CET	59505	53	192.168.2.5	1.1.1.1
Dec 11, 2024 21:33:26.470619917 CET	53	59505	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:26.471504927 CET	53	58289	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:30.519704103 CET	53	60889	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:30.836831093 CET	61165	53	192.168.2.5	1.1.1.1
Dec 11, 2024 21:33:30.836950064 CET	55549	53	192.168.2.5	1.1.1.1
Dec 11, 2024 21:33:30.976563931 CET	53	55549	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:30.977350950 CET	53	61165	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:32.702162027 CET	56306	53	192.168.2.5	1.1.1.1
Dec 11, 2024 21:33:32.702162027 CET	51433	53	192.168.2.5	1.1.1.1
Dec 11, 2024 21:33:32.839436054 CET	53	51433	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:32.839860916 CET	53	56306	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:33.752084970 CET	52982	53	192.168.2.5	1.1.1.1
Dec 11, 2024 21:33:33.752366066 CET	55194	53	192.168.2.5	1.1.1.1
Dec 11, 2024 21:33:33.894210100 CET	53	55194	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:33.896684885 CET	53	52982	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:36.691369057 CET	53	63090	1.1.1.1	192.168.2.5
Dec 11, 2024 21:33:55.643501997 CET	53	54555	1.1.1.1	192.168.2.5
Dec 11, 2024 21:34:16.846605062 CET	53	51519	1.1.1.1	192.168.2.5
Dec 11, 2024 21:34:18.082703114 CET	53	61563	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 21:33:21.519927025 CET	192.168.2.5	1.1.1.1	0x86ca	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:21.520055056 CET	192.168.2.5	1.1.1.1	0xa1d2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 11, 2024 21:33:23.070033073 CET	192.168.2.5	1.1.1.1	0xbfa6	Standard query (0)	token.onelogin.com-token-auth.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:23.073613882 CET	192.168.2.5	1.1.1.1	0x6b4b	Standard query (0)	token.onelogin.com-token-auth.com	65	IN (0x0001)	false
Dec 11, 2024 21:33:26.102905989 CET	192.168.2.5	1.1.1.1	0xf44f	Standard query (0)	secured-login.net	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:26.103079081 CET	192.168.2.5	1.1.1.1	0x3abc	Standard query (0)	secured-login.net	65	IN (0x0001)	false
Dec 11, 2024 21:33:30.836831093 CET	192.168.2.5	1.1.1.1	0xdf00	Standard query (0)	cdn2.hubspot.net	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:30.836950064 CET	192.168.2.5	1.1.1.1	0x620c	Standard query (0)	cdn2.hubspot.net	65	IN (0x0001)	false
Dec 11, 2024 21:33:32.702162027 CET	192.168.2.5	1.1.1.1	0x4399	Standard query (0)	cdn2.hubspot.net	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:32.702162027 CET	192.168.2.5	1.1.1.1	0x417a	Standard query (0)	cdn2.hubspot.net	65	IN (0x0001)	false
Dec 11, 2024 21:33:33.752084970 CET	192.168.2.5	1.1.1.1	0xe077	Standard query (0)	secured-login.net	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:33.752366066 CET	192.168.2.5	1.1.1.1	0xa592	Standard query (0)	secured-login.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 21:33:21.657306910 CET	1.1.1.1	192.168.2.5	0x86ca	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:21.657402992 CET	1.1.1.1	192.168.2.5	0xa1d2	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 11, 2024 21:33:23.869468927 CET	1.1.1.1	192.168.2.5	0xbfa6	No error (0)	token.onelogin.com-token-auth.com	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 21:33:23.869468927 CET	1.1.1.1	192.168.2.5	0xbfa6	No error (0)	landing.training.knowbe4.com		3.82.118.141	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:23.869468927 CET	1.1.1.1	192.168.2.5	0xbfa6	No error (0)	landing.training.knowbe4.com		3.92.248.204	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:23.869468927 CET	1.1.1.1	192.168.2.5	0xbfa6	No error (0)	landing.training.knowbe4.com		34.196.207.207	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:23.869468927 CET	1.1.1.1	192.168.2.5	0xbfa6	No error (0)	landing.training.knowbe4.com		34.230.105.133	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:23.869468927 CET	1.1.1.1	192.168.2.5	0xbfa6	No error (0)	landing.training.knowbe4.com		34.235.63.222	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:23.869468927 CET	1.1.1.1	192.168.2.5	0xbfa6	No error (0)	landing.training.knowbe4.com		54.210.185.151	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:23.870881081 CET	1.1.1.1	192.168.2.5	0x6b4b	No error (0)	token.onelogin.com-token-auth.com	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 21:33:26.471504927 CET	1.1.1.1	192.168.2.5	0xf44f	No error (0)	secured-login.net		34.235.63.222	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:26.471504927 CET	1.1.1.1	192.168.2.5	0xf44f	No error (0)	secured-login.net		34.230.105.133	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:26.471504927 CET	1.1.1.1	192.168.2.5	0xf44f	No error (0)	secured-login.net		34.196.207.207	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:26.471504927 CET	1.1.1.1	192.168.2.5	0xf44f	No error (0)	secured-login.net		54.210.185.151	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:26.471504927 CET	1.1.1.1	192.168.2.5	0xf44f	No error (0)	secured-login.net		3.82.118.141	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:26.471504927 CET	1.1.1.1	192.168.2.5	0xf44f	No error (0)	secured-login.net		3.92.248.204	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:30.976563931 CET	1.1.1.1	192.168.2.5	0x620c	No error (0)	cdn2.hubspot.net			65	IN (0x0001)	false
Dec 11, 2024 21:33:30.977350950 CET	1.1.1.1	192.168.2.5	0xdf00	No error (0)	cdn2.hubspot.net		104.18.87.62	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:30.977350950 CET	1.1.1.1	192.168.2.5	0xdf00	No error (0)	cdn2.hubspot.net		104.18.88.62	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:30.977350950 CET	1.1.1.1	192.168.2.5	0xdf00	No error (0)	cdn2.hubspot.net		104.18.89.62	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:30.977350950 CET	1.1.1.1	192.168.2.5	0xdf00	No error (0)	cdn2.hubspot.net		104.18.90.62	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:30.977350950 CET	1.1.1.1	192.168.2.5	0xdf00	No error (0)	cdn2.hubspot.net		104.18.91.62	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:32.839436054 CET	1.1.1.1	192.168.2.5	0x417a	No error (0)	cdn2.hubspot.net			65	IN (0x0001)	false
Dec 11, 2024 21:33:32.839860916 CET	1.1.1.1	192.168.2.5	0x4399	No error (0)	cdn2.hubspot.net		104.18.87.62	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:32.839860916 CET	1.1.1.1	192.168.2.5	0x4399	No error (0)	cdn2.hubspot.net		104.18.88.62	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:32.839860916 CET	1.1.1.1	192.168.2.5	0x4399	No error (0)	cdn2.hubspot.net		104.18.89.62	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:32.839860916 CET	1.1.1.1	192.168.2.5	0x4399	No error (0)	cdn2.hubspot.net		104.18.90.62	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:32.839860916 CET	1.1.1.1	192.168.2.5	0x4399	No error (0)	cdn2.hubspot.net		104.18.91.62	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:33.896684885 CET	1.1.1.1	192.168.2.5	0xe077	No error (0)	secured-login.net		3.82.118.141	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:33.896684885 CET	1.1.1.1	192.168.2.5	0xe077	No error (0)	secured-login.net		34.230.105.133	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:33.896684885 CET	1.1.1.1	192.168.2.5	0xe077	No error (0)	secured-login.net		34.196.207.207	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:33.896684885 CET	1.1.1.1	192.168.2.5	0xe077	No error (0)	secured-login.net		54.210.185.151	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:33.896684885 CET	1.1.1.1	192.168.2.5	0xe077	No error (0)	secured-login.net		34.235.63.222	A (IP address)	IN (0x0001)	false
Dec 11, 2024 21:33:33.896684885 CET	1.1.1.1	192.168.2.5	0xe077	No error (0)	secured-login.net		3.92.248.204	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

token.onelogin.com-token-auth.com

https:

secured-login.net

cdn2.hubspot.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49715	3.82.118.141	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 20:33:25 UTC	1012	OUT	GET /XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09?cid=2323041528 HTTP/1.1 Host: token.onelogin.com-token-auth.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-11 20:33:26 UTC	574	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 20:33:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 470 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade ETag: W/"7a8c25b6c487dacdf0bb205faebd73c1" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: 422ef1b6-ce82-4abd-b060-11db3231b215 X-Runtime: 0.050419 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-11 20:33:26 UTC	470	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 64 2d 6c 6f 67 69 6e 2e 6e 65 74 2f 70 61 67 65 73 2f 64 38 65 34 31 36 31 38 33 30 63 36 62 2f 58 61 47 38 35 65 69 73 76 4e 32 4a 36 65 57 64 4e 59 58 4a 33 4f 48 68 6f 62 32 77 77 5a 46 52 51 55 30 74 34 55 55 4d 35 57 48 52 55 55 30 64 4e 5a 31 64 71 56 32 63 72 5a 31 64 68 56 30 38 78 51 54 64 55 4d 57 31 68 56 6d 4a 61 5a 55 52 6e 63 6c 64 43 52 6b 52 4d 5a 6e 4a 70 4d 45 70 4f 57 44 52 30 64 6a 5a 69 4e 58 4e 4c 54 47 68 54 54 55 5a 42 4d 57 56 46 56 44 5a 49 4d 46 46 58 65 55 35 71 52 45 4a 31 54 55 55 32 5a 47 51 72 56 46 68 4b 51 6d 38 76 59 56 Data Ascii: <html> <head> <script>window.location.href = 'https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49716	34.235.63.222	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 20:33:28 UTC	1376	OUT	GET /pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09 HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://token.onelogin.com-token-auth.com/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09?cid=2323041528 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-11 20:33:30 UTC	832	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 20:33:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 4658 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Link: </assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css>; rel=preload; as=style; nopush,</assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js>; rel=preload; as=script; nopush ETag: W/"746a1ed2056668383d8b65993ba1c8f9" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: 4f6ad254-0a71-42ac-acb8-98d862afa17e X-Runtime: 1.494423 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-11 20:33:30 UTC	4658	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 49 4d 50 4f 52 54 41 4e 54 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 70 61 67 65 20 69 73 20 70 61 72 74 20 6f 66 20 61 20 73 69 6d 75 6c 61 74 65 64 20 70 68 69 73 68 69 6e 67 20 61 74 74 61 63 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"> <meta name="IMPORTANT" content="This page is part of a simulated phishing attac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49717	34.235.63.222	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 20:33:30 UTC	967	OUT	GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-11 20:33:30 UTC	263	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 20:33:30 GMT Content-Type: text/css Content-Length: 1471 Connection: close Last-Modified: Wed, 11 Dec 2024 19:08:46 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-11 20:33:30 UTC	1471	IN	Data Raw: 2f 2a 20 6c 69 6e 65 20 31 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 74 65 72 6d 61 72 6b 2e 73 63 73 73 20 2a 2f 0a 2e 77 61 74 65 72 6d 61 72 6b 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 20 20 20 20 2d 6d 73 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 74 62 2d 72 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 74 65 78 74 2d 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 73 69 64 65 77 61 79 73 3b 0a 7d 0a 0a 2f 2a 20 6c 69 6e 65 20 34 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 Data Ascii: /* line 1, app/assets/stylesheets/landing-watermark.scss /.watermark { -webkit-writing-mode: vertical-rl; -ms-writing-mode: tb-rl; writing-mode: vertical-rl; text-orientation: sideways;}/ line 4, app/assets/stylesheets/landing-wa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49718	34.235.63.222	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 20:33:31 UTC	946	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-11 20:33:32 UTC	279	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 20:33:32 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Wed, 11 Dec 2024 19:08:46 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-11 20:33:32 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-11 20:33:32 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-12-11 20:33:32 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-12-11 20:33:33 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-12-11 20:33:33 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-12-11 20:33:33 UTC	16384	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-12-11 20:33:33 UTC	16384	IN	Data Raw: 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 3d 21 31 21 3d 3d 65 2e 6a 73 6f 6e 70 26 26 28 5a 74 2e 74 65 73 74 28 65 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 61 74 61 26 26 30 3d 3d 3d 28 65 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 5a 74 2e 74 65 73 74 28 65 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 61 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 65 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 72 3d 65 2e 6a 73 6f 6e 70 43 61 6c Data Ascii: efilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Zt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Zt.test(e.data)&&"data");if(a\|\|"jsonp"===e.dataTypes[0])return r=e.jsonpCal
2024-12-11 20:33:33 UTC	16384	IN	Data Raw: 74 65 72 22 2c 69 5b 31 5d 3d 6c 2e 74 65 73 74 28 69 5b 31 5d 29 3f 69 5b 31 5d 3a 22 63 65 6e 74 65 72 22 2c 74 3d 68 2e 65 78 65 63 28 69 5b 30 5d 29 2c 65 3d 68 2e 65 78 65 63 28 69 5b 31 5d 29 2c 77 5b 74 68 69 73 5d 3d 5b 74 3f 74 5b 30 5d 3a 30 2c 65 3f 65 5b 30 5d 3a 30 5d 2c 75 5b 74 68 69 73 5d 3d 5b 63 2e 65 78 65 63 28 69 5b 30 5d 29 5b 30 5d 2c 63 2e 65 78 65 63 28 69 5b 31 5d 29 5b 30 5d 5d 7d 29 2c 31 3d 3d 3d 79 2e 6c 65 6e 67 74 68 26 26 28 79 5b 31 5d 3d 79 5b 30 5d 29 2c 22 72 69 67 68 74 22 3d 3d 3d 75 2e 61 74 5b 30 5d 3f 6d 2e 6c 65 66 74 2b 3d 70 3a 22 63 65 6e 74 65 72 22 3d 3d 3d 75 2e 61 74 5b 30 5d 26 26 28 6d 2e 6c 65 66 74 2b 3d 70 2f 32 29 2c 22 62 6f 74 74 6f 6d 22 3d 3d 3d 75 2e 61 74 5b 31 5d 3f 6d 2e 74 6f 70 2b 3d 66 3a Data Ascii: ter",i[1]=l.test(i[1])?i[1]:"center",t=h.exec(i[0]),e=h.exec(i[1]),w[this]=[t?t[0]:0,e?e[0]:0],u[this]=[c.exec(i[0])[0],c.exec(i[1])[0]]}),1===y.length&&(y[1]=y[0]),"right"===u.at[0]?m.left+=p:"center"===u.at[0]&&(m.left+=p/2),"bottom"===u.at[1]?m.top+=f:
2024-12-11 20:33:33 UTC	16384	IN	Data Raw: 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 2e 6f 66 66 73 65 74 28 29 2c 65 3d 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 3b 72 65 74 75 72 6e 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 21 3d 3d 65 26 26 56 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 2c 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 5b 30 5d 29 26 26 28 74 2e 6c 65 66 74 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 2c 74 2e 74 6f 70 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 Data Ascii: ffset:function(){var t=this.offsetParent.offset(),e=this.document[0];return"absolute"===this.cssPosition&&this.scrollParent[0]!==e&&V.contains(this.scrollParent[0],this.offsetParent[0])&&(t.left+=this.scrollParent.scrollLeft(),t.top+=this.scrollParent.scr
2024-12-11 20:33:33 UTC	16384	IN	Data Raw: 74 2e 6f 66 66 73 65 74 28 29 2c 6e 5b 69 5d 2e 70 72 6f 70 6f 72 74 69 6f 6e 73 28 7b 77 69 64 74 68 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 68 65 69 67 68 74 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7d 29 29 7d 7d 2c 64 72 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 56 2e 65 61 63 68 28 28 56 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 6f 70 70 61 62 6c 65 73 5b 74 2e 6f 70 74 69 6f 6e 73 2e 73 63 6f 70 65 5d 7c 7c 5b 5d 29 2e 73 6c 69 63 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 26 26 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 Data Ascii: t.offset(),n[i].proportions({width:n[i].element[0].offsetWidth,height:n[i].element[0].offsetHeight}))}},drop:function(t,e){var i=!1;return V.each((V.ui.ddmanager.droppables[t.options.scope]\|\|[]).slice(),function(){this.options&&(!this.options.disabled&&th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49721	104.18.87.62	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 20:33:32 UTC	963	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-11 20:33:32 UTC	1332	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 20:33:32 GMT Content-Type: image/webp Content-Length: 2368 Connection: close CF-Ray: 8f084011fb354283-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 2365913 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="KB4-logo.webp" ETag: "ddf47be00ad3eebaabd63fec4c5733f2" Last-Modified: Fri, 29 Mar 2024 19:46:11 GMT Vary: Accept Via: 1.1 dd462bc6996e0000e9b2cde9e1f25e20.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=3873 Edge-Cache-Tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Timing-Allow-Origin: cdn2.hubspot.net X-Amz-Cf-Id: QKqrrk-o8hm4YOAc5hd22S53yFm2LEefdoJC-8A90IP2gpZ2suQ3fg== X-Amz-Cf-Pop: BOS50-P1 x-amz-id-2: jJtNu4bygFgZzqCYwDHQJVMDWNLrbBdcG7C+9mPmBg6z1SbJnfrVy8hgqaOpvZ3rFjX7G28zb3o= x-amz-meta-access-tag: public-not-indexable x-amz-meta-cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL x-amz-meta-created-unix-time-millis: 1447343595191 x-amz-meta-index-tag: none x-amz-replication-status: COMPLETED x-amz-request-id: 5T65YXZ9JEV92BRD x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING
2024-12-11 20:33:32 UTC	863	IN	Data Raw: 78 2d 61 6d 7a 2d 76 65 72 73 69 6f 6e 2d 69 64 3a 20 47 4f 75 41 4a 7a 41 31 2e 62 6f 31 76 6a 6f 74 5f 48 73 71 30 6f 77 45 59 39 38 58 6a 59 48 39 0d 0a 58 2d 43 61 63 68 65 3a 20 52 65 66 72 65 73 68 48 69 74 20 66 72 6f 6d 20 63 6c 6f 75 64 66 72 6f 6e 74 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 77 6e 4e 74 5f 43 47 37 5a 4c 74 71 30 65 35 48 48 4a 37 53 6a 4c Data Ascii: x-amz-version-id: GOuAJzA1.bo1vjot_Hsq0owEY98XjYH9X-Cache: RefreshHit from cloudfrontX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: noneSet-Cookie: __cf_bm=wnNt_CG7ZLtq0e5HHJ7SjL
2024-12-11 20:33:32 UTC	543	IN	Data Raw: 52 49 46 46 38 09 00 00 57 45 42 50 56 50 38 4c 2c 09 00 00 2f c7 40 09 10 e2 30 90 b6 4d e3 5f f8 77 07 11 31 01 e9 57 56 61 55 0f 57 2c 4b db b6 fe 6d 93 a3 7d bc 4a da 5d 8f 80 97 3d 83 ee 3a 5d f7 44 7a 0e 3d 80 9e 01 fd 7e bf ef f7 fd ff 1e 4d b7 4f c9 50 6e 65 58 28 0c e6 e0 bf 0c f2 84 99 93 7f 33 d6 34 cc cc cc cc 8c 8a 03 0a 93 1c 86 3b 8c 66 3b 9c 98 49 32 d3 df 4c 1a cf fc b3 89 24 5b 4a ff 1f df f9 77 41 91 61 00 1d e4 97 05 2c e1 04 11 d8 40 02 24 db a6 5d d9 b6 6d db b6 6d db b6 6d db b6 ed a4 6c db 4e be 6d 63 4f 00 d4 6c db 96 2d db fe b8 bb 5b 74 a9 ae dd 35 b9 bb d3 dc 2d b9 25 97 01 fe 01 d8 82 41 1c 66 20 f9 0a 44 16 60 02 5f 40 2b c7 71 b5 3f fd 03 e0 f5 e9 38 0c d0 7f 28 b6 b5 2d ab 5e dc 69 96 2c b9 0e c0 5d 66 a0 c9 61 0c d0 a0 d1 Data Ascii: RIFF8WEBPVP8L,/@0M_w1WVaUW,Km}J]=:]Dz=~MOPneX(34;f;I2L$[JwAa,@$]mmmlNmcOl-[t5-%Af D`_@+q?8(-^i,]fa
2024-12-11 20:33:32 UTC	1369	IN	Data Raw: 55 c5 a3 74 01 e5 e2 58 7d d5 5b 38 48 31 3b 54 21 2b 02 85 93 a6 48 94 81 8a 52 d9 2a b5 49 e9 5c 91 af 66 9a ea 56 c0 07 50 c0 53 c0 fe 2b 8c ac 9a 6d ae c8 73 c5 36 35 39 46 6c 53 13 49 f9 02 eb e4 50 68 db 29 ef 8e aa f4 e5 87 cb 17 47 68 56 d7 a0 76 2b b1 9a d5 26 a0 0c 1d dc 06 9a 6c df b6 9e fa 4b ea 8e aa 5e 51 86 29 94 ff ab 37 04 aa 17 9b 35 a6 3c a7 fe c3 d5 61 93 00 25 1f 74 0a a0 a8 e3 3c 0f 28 a3 a0 99 fd d5 3b 32 cf af 6e cc a3 c2 81 b7 1d 4b 95 01 1f 39 97 4a b1 42 7f 99 d0 b3 a6 4c 66 c0 f6 e4 54 1b 8a 21 61 b5 02 28 f2 90 f9 00 aa 30 48 8d c0 9f 1d 45 31 aa 9f f0 8c c2 0e 51 6e ea 2b c1 6a eb e3 b0 99 ea 0b a8 76 c7 52 36 c0 31 47 e6 eb 3f 42 cd 02 a8 1d d5 dc 7e f2 f9 00 97 a9 26 52 e2 c7 01 ad 46 f8 e6 15 32 d2 9a 17 86 de 0d 7d e8 be Data Ascii: UtX}[8H1;T!+HR*I\fVPS+ms659FlSIPh)GhVv+&lK^Q)75<a%t<(;2nK9JBLfT!a(0HE1Qn+jvR61G?B~&RF2}
2024-12-11 20:33:32 UTC	456	IN	Data Raw: 54 a2 3f 70 52 8c 8a 4a ec 9f 7b 4d 40 d5 f5 ef df bf bf 8a ce 63 15 0c ac 7d 7a 11 1c a9 6e f3 79 e8 8c 7c eb b9 31 65 82 c3 ef b4 e3 e1 7c df 0c fd 9c 39 04 16 35 1e 0f fb 14 66 02 30 23 b1 0c f8 77 8c 98 8b 81 4e 4e e6 b2 6a 00 36 50 84 85 f3 96 f9 f0 73 70 92 00 14 d0 ca f4 35 80 43 1e 80 89 59 af 00 cb fe 0c db 15 64 1a 70 a1 62 49 94 4e 86 96 65 ad 59 f3 54 60 97 c6 c2 f9 d6 7c 49 55 ee cc 92 7a 02 97 b7 d0 ab 6b 96 1f 07 d5 da c2 59 95 02 94 6a db 01 2f 3b 75 57 60 91 e2 6f bd 7c c2 4d 40 c7 22 d8 77 41 8c 81 cd 59 56 a5 50 0f fb 39 50 65 92 54 35 8e d6 f5 b5 a9 00 0f d4 a4 b9 1b 50 df a5 26 e4 c8 95 45 e7 ee f5 80 b2 2e 9c 47 7c 92 6f e3 1a 07 2a 55 92 75 21 4a 32 e5 c6 3c 9d 57 28 d3 4b eb 6e 54 26 2f ed b3 4b 3d c9 81 57 38 b3 f9 50 80 67 46 be Data Ascii: T?pRJ{M@c}zny\|1e\|95f0#wNNj6Psp5CYdpbINeYT`\|IUzkYj/;uW`o\|M@"wAYVP9PeT5P&E.G\|o*Uu!J2<W(KnT&/K=W8PgF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49724	104.18.87.62	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 20:33:34 UTC	552	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=wnNt_CG7ZLtq0e5HHJ7SjL_hW2E8Y_opWRhP4c76C2A-1733949212-1.0.1.1-OyygmnwvlEN11MMwQsK3LwSRphv5BXAWuKz5lFUKevDEXdLsQJehmFZ71fsadt4b0B_yaOgG3s64g__OVr_g3A
2024-12-11 20:33:34 UTC	1352	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 20:33:34 GMT Content-Type: image/png Content-Length: 3014 Connection: close CF-Ray: 8f08401d99500f87-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 2360079 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "ddf47be00ad3eebaabd63fec4c5733f2" Last-Modified: Fri, 29 Mar 2024 19:46:11 GMT Vary: Accept Via: 1.1 dd462bc6996e0000e9b2cde9e1f25e20.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origSize=3873 Edge-Cache-Tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Timing-Allow-Origin: cdn2.hubspot.net X-Amz-Cf-Id: QKqrrk-o8hm4YOAc5hd22S53yFm2LEefdoJC-8A90IP2gpZ2suQ3fg== X-Amz-Cf-Pop: BOS50-P1 x-amz-id-2: jJtNu4bygFgZzqCYwDHQJVMDWNLrbBdcG7C+9mPmBg6z1SbJnfrVy8hgqaOpvZ3rFjX7G28zb3o= x-amz-meta-access-tag: public-not-indexable x-amz-meta-cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL x-amz-meta-created-unix-time-millis: 1447343595191 x-amz-meta-index-tag: none x-amz-replication-status: COMPLETED x-amz-request-id: 5T65YXZ9JEV92BRD x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: GOuAJzA1.bo1vjot_Hsq0owEY98XjYH9 X-Cache: RefreshHit from cloudfront
2024-12-11 20:33:34 UTC	510	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 51 42 4f 64 6f 6a 63 6a 63 7a 6e 34 6f 61 37 36 79 31 69 65 4f 41 76 53 38 54 46 42 39 32 44 7a 78 6b 50 44 37 36 41 6e 67 65 25 32 42 38 39 25 32 42 4e 4f 42 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: noneReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QBOdojcjczn4oa76y1ieOAvS8TFB92DzxkPD76Ange%2B89%2BNOB
2024-12-11 20:33:34 UTC	1369	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 26 08 06 00 00 00 81 16 d4 6c 00 00 0b 8d 49 44 41 54 78 da ec da 7b 68 97 55 1c c7 71 f7 9b b7 4d 73 22 65 a9 65 6a 2c bb 98 4d cc 2c 5d 28 26 d4 e8 42 17 b0 12 29 47 e2 46 9a b8 84 32 f3 32 32 6f 59 ce d4 c2 14 91 d4 4c 12 25 c3 b4 0b 16 69 46 a6 a5 2e 99 97 92 4c a7 65 da 98 64 73 6e ce 4f 6f f0 40 a7 83 3f f7 9c df cf 07 f6 1b cf 81 d7 1f db 79 be cf d9 73 9e f3 f9 3d 97 fd 9a 44 2d 6a 51 bb 44 d3 c8 26 43 31 dc c8 4d 72 5f 39 18 6e e9 1e cd 70 83 38 c7 57 a1 00 c5 78 17 eb b0 05 a5 38 64 ec c7 4e 6c c2 62 8c c5 3d 68 d6 08 e7 62 3c 16 60 06 ba d7 57 20 cb 47 49 0c 9c 8d 53 90 51 8e f6 d1 f2 6c 10 8b 62 20 94 a0 0a cc 47 e7 46 32 17 2b 20 a3 12 ed 43 0f 08 75 99 f8 09 32 6a d1 3f 5a Data Ascii: PNGIHDR&lIDATx{hUqMs"eej,M,](&B)GF222oYL%iF.LedsnOo@?ys=D-jQD&C1Mr_9np8Wx8dNlb=hb<`W GISQlb GF2+ Cu2j?Z
2024-12-11 20:33:34 UTC	1369	IN	Data Raw: 64 9b 49 10 80 bd 9b 24 d1 f6 7f 25 15 a6 fb 2d 92 65 23 fe bb 25 9b d0 d5 ee 1b 67 5f de 3d 4f 50 16 6a 21 a3 37 62 38 f6 6f 79 e7 1a 1b 55 11 c5 71 db 6d 61 89 b4 94 a8 e9 36 4a 24 8d 91 5a d3 50 04 8d 31 69 10 d1 40 95 47 41 8c 02 09 36 1a 10 35 60 91 6a 41 c4 00 3e 3e 14 31 4d 7c 00 4a 10 c4 17 28 a1 96 d2 a0 7c b0 35 a6 08 91 46 30 90 40 13 69 d5 a0 55 da da 0a a9 1f 4a 8f 27 b7 27 9b c9 3f 73 bb 77 76 ee dd dd 86 49 7e 01 7a 66 e6 de bb dc ff ec cc 39 67 a6 0c 09 2f 1a cc f1 bb 98 90 cf 02 41 2e 89 90 b3 0d a3 ee cb 2d 62 19 bd 5e bc 51 6c ab 56 ea 0d 30 c5 41 0b 24 24 8b 25 f4 1a e5 d9 0b c4 fe c3 83 17 a9 0e ed ca 06 2e 67 6d e1 94 81 01 a2 f5 13 a4 8d 21 6d 3f 92 53 8e 6c 51 7f 7e 5c bd 26 cc 9b fb 99 6c 8f 91 e9 5f 99 34 cd f4 b1 39 c6 67 70 40 Data Ascii: dI$%-e#%g_=OPj!7b8oyUqma6J$ZP1i@GA65`jA>>1M\|J(\|5F0@iUJ''?swvI~zf9g/A.-b^QlV0A$$%.gm!m?SlQ~\&l_49gp@
2024-12-11 20:33:34 UTC	276	IN	Data Raw: 23 6d bb 65 6d 9b 31 7c 05 e2 3e e7 ef 63 a6 24 51 20 e8 fd 58 23 f7 44 86 5c c6 df 8d 61 30 02 f7 30 18 3b 19 69 e8 b5 f9 43 73 3f a3 8c 05 62 4f 37 f3 1c 93 6e 78 0e da 06 98 9e c5 43 d1 70 15 08 f6 b7 4e 73 08 5b 24 59 02 c1 22 a3 d4 56 8f c7 d0 f4 ca 34 69 9c c5 7d 7e 86 9b bb 6c 52 be 85 03 09 fe 05 3a 27 98 55 36 27 f7 8b 8b 7b 17 04 11 bd d2 c2 dc 9e 2c 81 2c 66 9e 95 af bb 12 9f 02 39 73 99 72 49 89 78 5c 9d 43 8a ad 42 98 61 71 9d 52 59 38 3e 05 01 37 93 5d 89 65 cc 66 71 5d 36 09 b5 32 ef 9f 6d 71 0c 29 6e 17 58 ca 3c 2f 7f c6 73 ce 53 be 3c 67 95 3c 73 a1 61 fb eb 99 27 c4 45 fc 81 4c 37 bf 97 41 e6 3c d3 c6 9c 93 7f 37 32 1f 33 eb 99 f9 4c c4 e7 17 33 9b 59 20 9f fb 41 f1 ca 9d 61 5a e5 fa 3f 30 fb c4 be d0 e8 f3 32 1f 34 6a 84 6a 26 47 57 ef Data Ascii: #mem1\|>c$Q X#D\a00;iCs?bO7nxCpNs[$Y"V4i}~lR:'U6'{,,f9srIx\CBaqRY8>7]efq]62mq)nX</sS<g<sa'EL7A<723L3Y AaZ?024jj&GW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49726	104.18.87.62	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 20:33:35 UTC	1231	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=wnNt_CG7ZLtq0e5HHJ7SjL_hW2E8Y_opWRhP4c76C2A-1733949212-1.0.1.1-OyygmnwvlEN11MMwQsK3LwSRphv5BXAWuKz5lFUKevDEXdLsQJehmFZ71fsadt4b0B_yaOgG3s64g__OVr_g3A If-None-Match: "ddf47be00ad3eebaabd63fec4c5733f2" If-Modified-Since: Fri, 29 Mar 2024 19:46:11 GMT
2024-12-11 20:33:35 UTC	1322	IN	HTTP/1.1 304 Not Modified Date: Wed, 11 Dec 2024 20:33:35 GMT Connection: close CF-Ray: 8f084023089cc413-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 2365916 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="KB4-logo.webp" ETag: "ddf47be00ad3eebaabd63fec4c5733f2" Last-Modified: Fri, 29 Mar 2024 19:46:11 GMT Vary: Accept Via: 1.1 dd462bc6996e0000e9b2cde9e1f25e20.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=3873 Edge-Cache-Tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL X-Amz-Cf-Id: QKqrrk-o8hm4YOAc5hd22S53yFm2LEefdoJC-8A90IP2gpZ2suQ3fg== X-Amz-Cf-Pop: BOS50-P1 x-amz-id-2: jJtNu4bygFgZzqCYwDHQJVMDWNLrbBdcG7C+9mPmBg6z1SbJnfrVy8hgqaOpvZ3rFjX7G28zb3o= x-amz-meta-access-tag: public-not-indexable x-amz-meta-cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL x-amz-meta-created-unix-time-millis: 1447343595191 x-amz-meta-index-tag: none x-amz-replication-status: COMPLETED x-amz-request-id: 5T65YXZ9JEV92BRD x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: GOuAJzA1.bo1vjot_Hsq0owEY98XjYH9 X-Cache: RefreshHit from cloudfront
2024-12-11 20:33:35 UTC	510	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 42 4a 42 61 41 39 43 53 77 53 62 31 55 72 41 55 38 56 6b 4b 4b 39 25 32 46 57 37 6d 4e 31 62 39 67 64 55 45 25 32 46 58 58 49 77 34 52 4d 55 5a 4f 43 6c 49 75 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: noneReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BJBaA9CSwSb1UrAU8VkKK9%2FW7mN1b9gdUE%2FXXIw4RMUZOClIu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49728	3.82.118.141	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 20:33:35 UTC	427	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: secured-login.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-11 20:33:36 UTC	279	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 20:33:35 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Wed, 11 Dec 2024 19:08:46 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-11 20:33:36 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-11 20:33:36 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-12-11 20:33:36 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-12-11 20:33:36 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-12-11 20:33:36 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-12-11 20:33:36 UTC	16384	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-12-11 20:33:36 UTC	16384	IN	Data Raw: 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 3d 21 31 21 3d 3d 65 2e 6a 73 6f 6e 70 26 26 28 5a 74 2e 74 65 73 74 28 65 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 61 74 61 26 26 30 3d 3d 3d 28 65 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 5a 74 2e 74 65 73 74 28 65 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 61 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 65 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 72 3d 65 2e 6a 73 6f 6e 70 43 61 6c Data Ascii: efilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Zt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Zt.test(e.data)&&"data");if(a\|\|"jsonp"===e.dataTypes[0])return r=e.jsonpCal
2024-12-11 20:33:36 UTC	16384	IN	Data Raw: 74 65 72 22 2c 69 5b 31 5d 3d 6c 2e 74 65 73 74 28 69 5b 31 5d 29 3f 69 5b 31 5d 3a 22 63 65 6e 74 65 72 22 2c 74 3d 68 2e 65 78 65 63 28 69 5b 30 5d 29 2c 65 3d 68 2e 65 78 65 63 28 69 5b 31 5d 29 2c 77 5b 74 68 69 73 5d 3d 5b 74 3f 74 5b 30 5d 3a 30 2c 65 3f 65 5b 30 5d 3a 30 5d 2c 75 5b 74 68 69 73 5d 3d 5b 63 2e 65 78 65 63 28 69 5b 30 5d 29 5b 30 5d 2c 63 2e 65 78 65 63 28 69 5b 31 5d 29 5b 30 5d 5d 7d 29 2c 31 3d 3d 3d 79 2e 6c 65 6e 67 74 68 26 26 28 79 5b 31 5d 3d 79 5b 30 5d 29 2c 22 72 69 67 68 74 22 3d 3d 3d 75 2e 61 74 5b 30 5d 3f 6d 2e 6c 65 66 74 2b 3d 70 3a 22 63 65 6e 74 65 72 22 3d 3d 3d 75 2e 61 74 5b 30 5d 26 26 28 6d 2e 6c 65 66 74 2b 3d 70 2f 32 29 2c 22 62 6f 74 74 6f 6d 22 3d 3d 3d 75 2e 61 74 5b 31 5d 3f 6d 2e 74 6f 70 2b 3d 66 3a Data Ascii: ter",i[1]=l.test(i[1])?i[1]:"center",t=h.exec(i[0]),e=h.exec(i[1]),w[this]=[t?t[0]:0,e?e[0]:0],u[this]=[c.exec(i[0])[0],c.exec(i[1])[0]]}),1===y.length&&(y[1]=y[0]),"right"===u.at[0]?m.left+=p:"center"===u.at[0]&&(m.left+=p/2),"bottom"===u.at[1]?m.top+=f:
2024-12-11 20:33:36 UTC	16384	IN	Data Raw: 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 2e 6f 66 66 73 65 74 28 29 2c 65 3d 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 3b 72 65 74 75 72 6e 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 21 3d 3d 65 26 26 56 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 2c 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 5b 30 5d 29 26 26 28 74 2e 6c 65 66 74 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 2c 74 2e 74 6f 70 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 Data Ascii: ffset:function(){var t=this.offsetParent.offset(),e=this.document[0];return"absolute"===this.cssPosition&&this.scrollParent[0]!==e&&V.contains(this.scrollParent[0],this.offsetParent[0])&&(t.left+=this.scrollParent.scrollLeft(),t.top+=this.scrollParent.scr
2024-12-11 20:33:36 UTC	16384	IN	Data Raw: 74 2e 6f 66 66 73 65 74 28 29 2c 6e 5b 69 5d 2e 70 72 6f 70 6f 72 74 69 6f 6e 73 28 7b 77 69 64 74 68 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 68 65 69 67 68 74 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7d 29 29 7d 7d 2c 64 72 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 56 2e 65 61 63 68 28 28 56 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 6f 70 70 61 62 6c 65 73 5b 74 2e 6f 70 74 69 6f 6e 73 2e 73 63 6f 70 65 5d 7c 7c 5b 5d 29 2e 73 6c 69 63 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 26 26 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 Data Ascii: t.offset(),n[i].proportions({width:n[i].element[0].offsetWidth,height:n[i].element[0].offsetHeight}))}},drop:function(t,e){var i=!1;return V.each((V.ui.ddmanager.droppables[t.options.scope]\|\|[]).slice(),function(){this.options&&(!this.options.disabled&&th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49729	104.18.87.62	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 20:33:37 UTC	653	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=wnNt_CG7ZLtq0e5HHJ7SjL_hW2E8Y_opWRhP4c76C2A-1733949212-1.0.1.1-OyygmnwvlEN11MMwQsK3LwSRphv5BXAWuKz5lFUKevDEXdLsQJehmFZ71fsadt4b0B_yaOgG3s64g__OVr_g3A If-None-Match: "ddf47be00ad3eebaabd63fec4c5733f2" If-Modified-Since: Fri, 29 Mar 2024 19:46:11 GMT
2024-12-11 20:33:37 UTC	1358	IN	HTTP/1.1 304 Not Modified Date: Wed, 11 Dec 2024 20:33:37 GMT Connection: close CF-Ray: 8f08402fcfc24233-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 2360082 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "ddf47be00ad3eebaabd63fec4c5733f2" Last-Modified: Fri, 29 Mar 2024 19:46:11 GMT Vary: Accept Via: 1.1 dd462bc6996e0000e9b2cde9e1f25e20.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origSize=3873 Edge-Cache-Tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL X-Amz-Cf-Id: QKqrrk-o8hm4YOAc5hd22S53yFm2LEefdoJC-8A90IP2gpZ2suQ3fg== X-Amz-Cf-Pop: BOS50-P1 x-amz-id-2: jJtNu4bygFgZzqCYwDHQJVMDWNLrbBdcG7C+9mPmBg6z1SbJnfrVy8hgqaOpvZ3rFjX7G28zb3o= x-amz-meta-access-tag: public-not-indexable x-amz-meta-cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL x-amz-meta-created-unix-time-millis: 1447343595191 x-amz-meta-index-tag: none x-amz-replication-status: COMPLETED x-amz-request-id: 5T65YXZ9JEV92BRD x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: GOuAJzA1.bo1vjot_Hsq0owEY98XjYH9 X-Cache: RefreshHit from cloudfront X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3 X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3
2024-12-11 20:33:37 UTC	406	IN	Data Raw: 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 41 39 70 79 25 32 46 63 35 69 57 63 42 52 6e 33 51 6a 4b 4c 67 55 45 4b 56 35 6d 4e 6e 31 78 53 44 5a 47 64 6b 65 68 37 5a 55 79 49 25 32 42 25 32 42 36 52 4b 25 32 46 6f 6c 41 39 4f 7a 30 77 4b 6d 74 48 6d 39 43 47 41 73 61 72 4b 6c 4d 64 51 61 78 31 69 62 41 65 64 4b 77 25 32 42 43 64 70 30 58 5a 73 41 25 32 46 70 54 6e 4c 4d 78 36 36 6f 37 6c 6d 68 65 44 70 4d 68 41 72 4e 70 70 45 4a 4c 56 73 31 33 4b 33 51 78 7a 4a 74 6b 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 Data Ascii: X-Robots-Tag: noneReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A9py%2Fc5iWcBRn3QjKLgUEKV5mNn1xSDZGdkeh7ZUyI%2B%2B6RK%2FolA9Oz0wKmtHm9CGAsarKlMdQax1ibAedKw%2BCdp0XZsA%2FpTnLMx66o7lmheDpMhArNppEJLVs13K3QxzJtk%3D"}],"group"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49730	34.235.63.222	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 20:33:37 UTC	931	OUT	GET /favicon.ico HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/pages/d8e4161830c6b/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-11 20:33:37 UTC	253	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 20:33:37 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Wed, 11 Dec 2024 19:09:28 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49734	3.82.118.141	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 20:33:38 UTC	352	OUT	GET /favicon.ico HTTP/1.1 Host: secured-login.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-11 20:33:39 UTC	253	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 20:33:39 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Wed, 11 Dec 2024 19:09:28 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5820, Parent PID: 5436

General

Target ID:	0
Start time:	15:33:12
Start date:	11/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3424, Parent PID: 5820

General

Target ID:	2
Start time:	15:33:15
Start date:	11/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2020,i,17887203465776148993,7046714387287980499,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6552, Parent PID: 5436

General

Target ID:	3
Start time:	15:33:21
Start date:	11/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://token.onelogin.com-token-auth.com/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09?cid=2323041528"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior