Edit tour

Windows Analysis Report
https://flowto.it/8tooc2sec?fc=0

Overview

General Information

Sample URL:	https://flowto.it/8tooc2sec?fc=0
Analysis ID:	1580041
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML title does not match URL

Suspicious form URL found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1984,i,18048823923627191415,11212712545854182537,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://flowto.it/8tooc2sec?fc=0" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://flowto.it/8tooc2sec?fc=0

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://ads-microsofl.com/add	Avira URL Cloud: Label: phishing
Source: https://ads-microsofl.com/add/	Avira URL Cloud: Label: phishing

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent

HTTP Parser: Form action: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true

HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: flowcode.com to https://google.com/amp/web1.mlp-pe.com?fce_id=c7f56a56-d705-4e73-8fc6-6047be76685b
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.google.com to http://web1.mlp-pe.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: web1.mlp-pe.com to https://ads-microsofl.com/add
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: ads-microsofl.com to https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3a%2f%2fads-microsofl.com%2fadd%2fconnect.php&response_mode=query&scope=https%3a%2f%2fads.microsoft.com%2fmsads.manage+offline_access+user.invite.all+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4lk2apqnad_wcz7h27zaqsdzni80mq0z_dmoira6gsy&code_challenge_method=s256&prompt=consent

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /8tooc2sec?fc=0 HTTP/1.1Host: flowto.itConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/8tooc2sec?fc=0 HTTP/1.1Host: flowcode.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /amp/web1.mlp-pe.com?fce_id=c7f56a56-d705-4e73-8fc6-6047be76685b HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: web1.mlp-pe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /biamar.php HTTP/1.1Host: web1.mlp-pe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=bgu8rmcsn2ud57i2k5kemvr2vn
Source: global traffic	HTTP traffic detected: GET /themels.php HTTP/1.1Host: web1.mlp-pe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=bgu8rmcsn2ud57i2k5kemvr2vn
Source: global traffic	HTTP traffic detected: GET /add HTTP/1.1Host: ads-microsofl.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /add/ HTTP/1.1Host: ads-microsofl.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: web1.mlp-pe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: flowto.it
Source: global traffic	DNS traffic detected: DNS query: flowcode.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: web1.mlp-pe.com
Source: global traffic	DNS traffic detected: DNS query: ads-microsofl.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: chromecache_69.2.dr, chromecache_63.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_69.2.dr, chromecache_63.2.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: classification engine

Classification label: mal56.win@18/48@24/8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1984,i,18048823923627191415,11212712545854182537,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://flowto.it/8tooc2sec?fc=0"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1984,i,18048823923627191415,11212712545854182537,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://flowto.it/8tooc2sec?fc=0	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label
https://web1.mlp-pe.com/themels.php	0%	Avira URL Cloud	safe
https://web1.mlp-pe.com/	0%	Avira URL Cloud	safe
https://web1.mlp-pe.com/biamar.php	0%	Avira URL Cloud	safe
https://ads-microsofl.com/add	100%	Avira URL Cloud	phishing
https://ads-microsofl.com/add/	100%	Avira URL Cloud	phishing
http://web1.mlp-pe.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
web1.mlp-pe.com	138.197.8.61	true	false	unknown
google.com	172.217.17.46	true	false	high
ads-microsofl.com	161.35.24.67	true	false	unknown
flowcode.com	104.18.35.227	true	false	high
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
flowto.it	104.18.38.97	true	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://flowcode.com/p/8tooc2sec?fc=0	false		high
https://web1.mlp-pe.com/themels.php	false	Avira URL Cloud: safe	unknown
https://flowto.it/8tooc2sec?fc=0	true		unknown
https://ads-microsofl.com/add	false	Avira URL Cloud: phishing	unknown
https://www.google.com/amp/web1.mlp-pe.com?fce_id=c7f56a56-d705-4e73-8fc6-6047be76685b	false		high
https://ads-microsofl.com/add/	false	Avira URL Cloud: phishing	unknown
https://web1.mlp-pe.com/biamar.php	false	Avira URL Cloud: safe	unknown
http://web1.mlp-pe.com/	false	Avira URL Cloud: safe	unknown
https://web1.mlp-pe.com/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com	chromecache_69.2.dr, chromecache_63.2.dr	false		high
https://login.windows-ppe.net	chromecache_69.2.dr, chromecache_63.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.38.97	flowto.it	United States	13335	CLOUDFLARENETUS	false
138.197.8.61	web1.mlp-pe.com	United States	14061	DIGITALOCEAN-ASNUS	false
104.18.35.227	flowcode.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
161.35.24.67	ads-microsofl.com	United States	14061	DIGITALOCEAN-ASNUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580041
Start date and time:	2024-12-23 19:09:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://flowto.it/8tooc2sec?fc=0
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@18/48@24/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 64.233.161.84, 172.217.19.238, 172.217.17.46, 199.232.210.172, 192.229.221.95, 20.190.177.84, 20.190.147.10, 20.190.177.82, 20.190.147.0, 20.190.177.83, 20.190.177.148, 20.190.177.147, 20.190.147.3, 2.16.149.13, 2.16.149.34, 20.190.177.20, 20.190.177.146, 20.190.147.6, 20.190.177.19, 172.217.19.234, 142.250.181.42, 142.250.181.74, 142.250.181.106, 142.250.181.138, 172.217.17.42, 172.217.21.42, 172.217.19.202, 216.58.208.234, 172.217.17.74, 172.217.19.170, 20.189.173.16, 20.189.173.1, 172.217.17.35, 20.190.181.1, 40.126.53.15, 40.126.53.12, 20.231.128.67, 40.126.53.17, 20.190.181.23, 20.190.181.0, 40.126.53.10, 23.218.208.109, 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): onedscolprdwus00.westus.cloudapp.azure.com, slscr.update.microsoft.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, ak.privatelink.msidentity.com, a1894.dscb.akamai.net, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, update.googleapis.com, login.mso.msidentity.com, www.tm.ak.prd.aadg.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, aadcdnoriginwus2.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, www.tm.ak.prd.aadg.akadns.net, ctldl.windowsupdate.com, aadcdn.msauth.net, onedscolprdwus17.westus.cloudapp.azure.com, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, nel.measure.office.net.edgesuite.net, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://flowto.it/8tooc2sec?fc=0

Input	Output
URL: https://flowto.it Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://flowto.it
URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fm Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fm Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fm Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "Next", "text_input_field_labels": [ "817bcb@kdbpxu.co" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fm Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fm Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "We couldn't find an account with that username. Try another, or get a new Microsoft account.", "prominent_button_name": "Next", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fm Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	downloaded
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
Category:	downloaded
Size (bytes):	3452
Entropy (8bit):	5.117912766689607
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9KHULI5m4UidBGLosqAsosushswsosry:a2IYz95qTdBac
MD5:	CB06E9A552B197D5C0EA600B431A3407
SHA1:	04E167433F2F1038C78F387F8A166BB6542C2008
SHA-256:	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
SHA-512:	1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	dropped
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	low
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
Category:	downloaded
Size (bytes):	116343
Entropy (8bit):	7.997640489040715
Encrypted:	true
SSDEEP:	3072:s8ovOS/D3L+TGsLMet6+iNLTMMqfC4hyFv0As5:jNSrij/t6+aAMqfCoydM5
MD5:	3063B0DA40B45B46602FCE99AC53D315
SHA1:	57883FF854B80AD2A76479A0273BE9218B4DA553
SHA-256:	C60FB365DF08D31F36EDA468941C309AE3A917ED784A30495800F05E5F98B66B
SHA-512:	3EAF55117A825B588972F6AE324F6173EF4F2A309BAB69A9A6CC43C8F9A4EE25C2FA86752C8912542CC353727DC54A034B369D4A4451F0C3B20206C16FA9FE98
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js
Preview:	...........k{.H.(.}............'qz<..>.3==..G..(..../m..]kU.T......\|x....T.Z...O....T.........e..]../'.o+gp.k.........F....+#..+.{..\|X..J.U.`.F.0...W..7.Ie...J2.Y.~.$.L.8....$...P]4..yQ.P99..P?....?........I%....+^0..&p..2..<........Da...J....F.9<.7.^.+1O.0J..........h1....[....h..............u".....C%.+..\.>....T`.1....... i......8.TB(.Uh.b.{...@<y..D^.S.....n".<H.L..O..*.t........p6..\[...yCm.J.k.....b..vg....-.j.$........1....p~3.b.....n....[_c..{1WN.l~.=...........?......S.}U..g.......t..../...........\|.+...-y.X\...l.....>;."....ye.\.....h..p.f.8...[/..nd.,.......X.?......-....J.....I.;....t..FSw...a7i...c..Y{.-..>a..4h.Eo..c#...O....~..d....Z..z.'...s.D..E...jb.O.F..0.VW>..]%6........x..O>E.'a0U.....w....."..9.az.6....<a.?..<qvx........ct.K..s.C3..d#..#^R.z..A..u.f..........s.....M.rb(.\v.....%.k....i.f...,C.s..bY..K#...~.>..D..j....m.71..}...37h........P{..7!@...\|..ZR.]V....."...0.o....7..peCG....px..j.%r2.....R.k5m..s.

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142367
Category:	dropped
Size (bytes):	49911
Entropy (8bit):	7.994516776763163
Encrypted:	true
SSDEEP:	1536:vr2T/J/l2R6ACJVMQPYmlBXTm12g9bcKo0y0ci:CzJ/lG2KQzBjm1b3ci
MD5:	9B96CC09F9E89D0334BA2FBC22B5197A
SHA1:	B5FE69F39E9F61FEF88DF794F02DC4F4086E2592
SHA-256:	E6331018533143C411BAE25326AB52FCED541C48674551AEA78E750855BDCD1D
SHA-512:	2BDD71A34A7D6172AD4B7B6CF077A891D6266C148000EEF8345E2343E6C21ED8783B2EA328EF3BF7176462A3CA575D2D6D4B55A07138CFD1B02900C95F61077D
Malicious:	false
Reputation:	low
Preview:	...........m[.8.0........OL....;w.....a.....\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De.._.8.+S?N..HL..J......%O..S........(=.gO.\|.T.0......6.. ..y....x....8..p.T"1...\|$.Cz..V.D%.Ie.F....^."..5....c...?..T8..._..b.gs.4....S]kDZ..7.J.V..l}..?.....c...g.A...8.......8.VB......^..f..O.... ...`...H.{.$. OP..S..AC.gVE.I8..).-U.....R...A..%.T[...Fc{..49..If...y.'w.Q}..oz..v.....W...pp..%..G.+.r:.A......[.:..s.?U......_............k.y0.U....+I5..0.>.Q%.".w.....O....5w..;.;.>..mr.k53r.......k.0.I.<.D......d&...c..jhE..zx.]....y\|W....i...`.. .k.P...@.Uq.\;..1............z\|.O..Y5..........XtR,....R...k3..<..\.2.>.;T..$...kj.5-.i?/..YH`!jb..Z..=.&.L..F...([..y....K5pzQ.>i.1.......0..P...@...L.".n.x..Cj?..w.:+...n..4..H.. .....S.....h....8....v.l.[M.0..q..c;.....0..*.8.......l.TM..n "..km..S.<.T..].k.+1.....P.V...4-W.C....0-/.S;.w......K.z+...DZ....=q.E.@ .Dv.z...@.d.#tE...

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
Category:	downloaded
Size (bytes):	3452
Entropy (8bit):	5.117912766689607
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9KHULI5m4UidBGLosqAsosushswsosry:a2IYz95qTdBac
MD5:	CB06E9A552B197D5C0EA600B431A3407
SHA1:	04E167433F2F1038C78F387F8A166BB6542C2008
SHA-256:	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
SHA-512:	1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 450755
Category:	downloaded
Size (bytes):	122515
Entropy (8bit):	7.997419459076181
Encrypted:	true
SSDEEP:	3072:1L4xVJNv/cJPu5OEjvuUQIq40zDH227PURbj:1kbGugELatzL7PUlj
MD5:	AC9A6ED508328361A4C9530325A94076
SHA1:	ADC81FAE51EB66A220539EEEDECEB96CFF390BBB
SHA-256:	BA93F4A83BB77D32AF9AFB9B014BFD13FD497E3D8F15AF016C782ABD1D34037B
SHA-512:	066D92389A7EFB3A80FCFC86696EE6AE008259570F73814303A9ACC1690F881DF2034A16D5C7970BA703648CA79C2E7CBAA2CAD98C28879ADD44AB06620305B4
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js
Preview:	...........}[.8......\&.L..{.x.t.nv.p......ql%xH...rB....J.-'..=...}...&.Jo.R..T}.y...\....J....uipR..\|zuT....(]..O..._.6.......?e%.;rb...F%?p.h.FN......\|gZ.G.<..<..dn...~.@.....2T.y.K'J^K.....6...P.....!).a.....6.. f.E......s..8.'......F.....KN.J1KJ.0J.x?..!B.Zcj....8t.....1......!vq..Ac.0..V.N..a..}(%a.5\..g..I..6...L...x.7.......8..B..J....^b/s.....I...r..L.3.... ..y...^K.l.....%.'.\|.8.T.....$.R..8.j.?.R.f..}..o.....$....a.'..Q..g..p1.:1t.}..y..}8...3...8....b.=(..3..d[..Os......%....Z...G.......x...2.,..RP..+..O. _....n.;=.?.....w../au.I.p...U\|;......WM.f?...9.>8..9.....S../;._..un...].:_..e..V:.....@..[..Ue.'Pe..&wv..T..ow.........?..\)WVb..r.;.....A........mpW.X.........B.....I...}j.....(...1.e.D.~.....;F..:..P.=.....(r^........N1.F....@..W%y.....t...Q....Y.5.$.O..x@.l.4.a.b.f..3.2.B...DL}4Y.:.u........`?....W`Z".S.S..}= .:......i.@E"1T.....`\.a....J:].....R....=R..y.........s<;....~NXr<%...\|.v&...5..*....D.(9...

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 450755
Category:	dropped
Size (bytes):	122515
Entropy (8bit):	7.997419459076181
Encrypted:	true
SSDEEP:	3072:1L4xVJNv/cJPu5OEjvuUQIq40zDH227PURbj:1kbGugELatzL7PUlj
MD5:	AC9A6ED508328361A4C9530325A94076
SHA1:	ADC81FAE51EB66A220539EEEDECEB96CFF390BBB
SHA-256:	BA93F4A83BB77D32AF9AFB9B014BFD13FD497E3D8F15AF016C782ABD1D34037B
SHA-512:	066D92389A7EFB3A80FCFC86696EE6AE008259570F73814303A9ACC1690F881DF2034A16D5C7970BA703648CA79C2E7CBAA2CAD98C28879ADD44AB06620305B4
Malicious:	false
Reputation:	low
Preview:	...........}[.8......\&.L..{.x.t.nv.p......ql%xH...rB....J.-'..=...}...&.Jo.R..T}.y...\....J....uipR..\|zuT....(]..O..._.6.......?e%.;rb...F%?p.h.FN......\|gZ.G.<..<..dn...~.@.....2T.y.K'J^K.....6...P.....!).a.....6.. f.E......s..8.'......F.....KN.J1KJ.0J.x?..!B.Zcj....8t.....1......!vq..Ac.0..V.N..a..}(%a.5\..g..I..6...L...x.7.......8..B..J....^b/s.....I...r..L.3.... ..y...^K.l.....%.'.\|.8.T.....$.R..8.j.?.R.f..}..o.....$....a.'..Q..g..p1.:1t.}..y..}8...3...8....b.=(..3..d[..Os......%....Z...G.......x...2.,..RP..+..O. _....n.;=.?.....w../au.I.p...U\|;......WM.f?...9.>8..9.....S../;._..un...].:_..e..V:.....@..[..Ue.'Pe..&wv..T..ow.........?..\)WVb..r.;.....A........mpW.X.........B.....I...}j.....(...1.e.D.~.....;F..:..P.=.....(r^........N1.F....@..W%y.....t...Q....Y.5.$.O..x@.l.4.a.b.f..3.2.B...DL}4Y.:.u........`?....W`Z".S.S..}= .:......i.@E"1T.....`\.a....J:].....R....=R..y.........s<;....~NXr<%...\|.v&...5..*....D.(9...

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142367
Category:	downloaded
Size (bytes):	49911
Entropy (8bit):	7.994516776763163
Encrypted:	true
SSDEEP:	1536:vr2T/J/l2R6ACJVMQPYmlBXTm12g9bcKo0y0ci:CzJ/lG2KQzBjm1b3ci
MD5:	9B96CC09F9E89D0334BA2FBC22B5197A
SHA1:	B5FE69F39E9F61FEF88DF794F02DC4F4086E2592
SHA-256:	E6331018533143C411BAE25326AB52FCED541C48674551AEA78E750855BDCD1D
SHA-512:	2BDD71A34A7D6172AD4B7B6CF077A891D6266C148000EEF8345E2343E6C21ED8783B2EA328EF3BF7176462A3CA575D2D6D4B55A07138CFD1B02900C95F61077D
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
Preview:	...........m[.8.0........OL....;w.....a.....\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De.._.8.+S?N..HL..J......%O..S........(=.gO.\|.T.0......6.. ..y....x....8..p.T"1...\|$.Cz..V.D%.Ie.F....^."..5....c...?..T8..._..b.gs.4....S]kDZ..7.J.V..l}..?.....c...g.A...8.......8.VB......^..f..O.... ...`...H.{.$. OP..S..AC.gVE.I8..).-U.....R...A..%.T[...Fc{..49..If...y.'w.Q}..oz..v.....W...pp..%..G.+.r:.A......[.:..s.?U......_............k.y0.U....+I5..0.>.Q%.".w.....O....5w..;.;.>..mr.k53r.......k.0.I.<.D......d&...c..jhE..zx.]....y\|W....i...`.. .k.P...@.Uq.\;..1............z\|.O..Y5..........XtR,....R...k3..<..\.2.>.;T..$...kj.5-.i?/..YH`!jb..Z..=.&.L..F...([..y....K5pzQ.>i.1.......0..P...@...L.".n.x..Cj?..w.:+...n..4..H.. .....S.....h....8....v.l.[M.0..q..c;.....0..*.8.......l.TM..n "..km..S.<.T..].k.+1.....P.V...4-W.C....0-/.S;.w......K.z+...DZ....=q.E.@ .Dv.z...@.d.#tE...

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
Category:	downloaded
Size (bytes):	5525
Entropy (8bit):	7.961202222662501
Encrypted:	false
SSDEEP:	96:dySl6/e7OAQD3cS66g8cxO4qXgy66F0+fgENU28TjN3KY6meSsj0ktMvB4YJix2I:dNl6/zFDW6dlXV665ReB67j0sEBWxl
MD5:	28CE5BF8BACB96D1C2CFA0092145C6EE
SHA1:	303A4629C4467AF2C551EC9E6353464C8C25827D
SHA-256:	6B89EEC14865DB53FE20FB3C70B0853362E21669DACE19C06172F673B2EDC5CD
SHA-512:	6A10794F105EF5C6F7F7DC2C89152A8342E6D9D8D9490783863ED2737FFD5982E916F72E0A9ECB944AB9815FA70BD20C7256A91E2A62D971F80C23822B809A02
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_1cd84c14a6b01fcd8515.js
Preview:	...........[}w.F....Bh..i3.M.t.rU.....]..M...@.(..........@..N..I-k..;w.....U.F..v....N....]....MC......U.]o>..mJ.w..~.5<......Z.h~8..8J..m......0.&Z:.Z.D_. .Z.....<.f..t..].I:..........b. ...}.ja......'..x......m6..c...$..........b\|s......O.a..cE..u.2..6jG!.A.....P..?q@?"..).Mk.0.[."V..M..4...4.~}.?.i..D.}h\|..$x.Ajm.S..H..-.x.If..]..1.D0.F......pq.(.\|...y\...5....y2.q.Fq...[.\|..n.b.i_D......xuR......I.TS.4..}\|<...o....MG.+@.......\.?."...+[...A..&...{]......u..+p?......\|...j....7...=H..cwp.38.;%c.....O..............p...X.g!....r...d..5.%x.....;...j6p...p......c.Nd.:...&.....%.. tR.d.@.. ...1..6....i....:...s=..V...iN..1../tH..p<..Mo.......`&.7uA;..(lC.......4...?..0..[S@...D..\|....=.wh2...<.. ...)..F...!. .C...k...S.pPt......s..K.V...w......7....Zn.d..t]l.........5=.(..#.....l._.Ip......-O.6.,......q4....!XS`6k..k.....9k....{~*.....X....q......l.>x..={j.n..W......e..Q..I/..;a..MS>.!5v.d.B+.o.....q...j.q..Z..=..@g.1q..,yBV91m.j>..4.o...

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.503258334775644
Encrypted:	false
SSDEEP:	3:Eq62iczBr9ks:EqdiczBys
MD5:	06B313E93DD76909460FBFC0CD98CB6B
SHA1:	C4F9B2BBD840A4328F85F54873C434336A193888
SHA-256:	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
SHA-512:	EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChgKDQ3RW1FSGgQIVhgCIAEKBw1Xevf9GgA=

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	dropped
Size (bytes):	35170
Entropy (8bit):	7.993096534744333
Encrypted:	true
SSDEEP:	768:K+LvEzA9nny7u0zF35Hm4ngomu6yeLDKDnccqmcmHvVVPCLVf:ny7f5GpuheL4htv3Pkf
MD5:	171A4DD9400708B88724B57D62B24A6A
SHA1:	9C6F1303B8F02FCE18D20EC9CADA11D38D0C4B37
SHA-256:	EA00750636C11DBD4FA3ACB1B3CDCBAE3EFA43F6B6C3753444B6D6A242AE9336
SHA-512:	5B13B63912B34E3EEEDD8DA5953B869A83DF82FFD2A8D737AA81DC984F1811800A534F340C48041DA803C25B6B8F5605EA8D003B6A09A1874408F95A710F5126
Malicious:	false
Reputation:	low
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:....r..._........,...A........z.....\|..t.. [.C.....{...~..c......ua...~.v<.I..P#._{{}._.......Km...eR....u?GY..h..}..gAv...<.l.Z...#.....:P?Q..."..........,.D...I<._.'..-..=..;.>.C_..#.....D[0.Y..*...M.....{.YT,...x..SQ/......N<`...\|._.k....0)......+.Z..4...M. ...i...`.ml..-X.E.....d.. .}.e4.{6hz^..}....@....W.1...d8...>.@.....(.'[..`..A..?...yL.\|..QTF...-.='S@.Q.sM.`...}.t..$..y^..0J.kC.S...U.

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57510
Category:	dropped
Size (bytes):	16345
Entropy (8bit):	7.98960525258912
Encrypted:	false
SSDEEP:	384:hOBEj/gTOkWow6mhJqXnYI/0PiQBSoe122Yw/:hOBKJBXO586QB+11J
MD5:	187B9EBA41FDF66B2C8F7EB645D2BC17
SHA1:	B1C034F7F5F754F271D094FB417B9A820C1F712C
SHA-256:	CA0FBF8421A0CF4CCDA7310B2AE74CBD92214901EC2D0F273EA3B07F12CF96EA
SHA-512:	0D7FB682D24E97C9E3FC04AA87CCB8EC508CA0CF197DA0617EFFD981BC8B5E3600824FDD08F1F31F59D276B5BF53229D00805D984E01D512FD968610C5FE9609
Malicious:	false
Reputation:	low
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113424
Category:	downloaded
Size (bytes):	20410
Entropy (8bit):	7.980582012022051
Encrypted:	false
SSDEEP:	384:8RvmaMFysnOXZ2m9zM+udO6GGUpeAU02oDGnN5EsQwWUQGTS8r2k:8pmm7ZFM+ObGGUIjN5PJV3Tp
MD5:	3BA4D76A17ADD0A6C34EE696F28C8541
SHA1:	5E8A4B8334539A7EAB798A7799F6E232016CB263
SHA-256:	17D6FF63DD857A72F37292B5906B40DC087EA27D7B1DEFCFA6DD1BA82AEA0B59
SHA-512:	8DA16A9759BB68A6B408F9F274B882ABB3EE7BA19F888448E495B721094BDB2CE5664E9A26BAE306A00491235EB94C143E53F618CCD6D50307C3C7F2EF1B4455
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
Category:	dropped
Size (bytes):	5525
Entropy (8bit):	7.961202222662501
Encrypted:	false
SSDEEP:	96:dySl6/e7OAQD3cS66g8cxO4qXgy66F0+fgENU28TjN3KY6meSsj0ktMvB4YJix2I:dNl6/zFDW6dlXV665ReB67j0sEBWxl
MD5:	28CE5BF8BACB96D1C2CFA0092145C6EE
SHA1:	303A4629C4467AF2C551EC9E6353464C8C25827D
SHA-256:	6B89EEC14865DB53FE20FB3C70B0853362E21669DACE19C06172F673B2EDC5CD
SHA-512:	6A10794F105EF5C6F7F7DC2C89152A8342E6D9D8D9490783863ED2737FFD5982E916F72E0A9ECB944AB9815FA70BD20C7256A91E2A62D971F80C23822B809A02
Malicious:	false
Reputation:	low
Preview:	...........[}w.F....Bh..i3.M.t.rU.....]..M...@.(..........@..N..I-k..;w.....U.F..v....N....]....MC......U.]o>..mJ.w..~.5<......Z.h~8..8J..m......0.&Z:.Z.D_. .Z.....<.f..t..].I:..........b. ...}.ja......'..x......m6..c...$..........b\|s......O.a..cE..u.2..6jG!.A.....P..?q@?"..).Mk.0.[."V..M..4...4.~}.?.i..D.}h\|..$x.Ajm.S..H..-.x.If..]..1.D0.F......pq.(.\|...y\...5....y2.q.Fq...[.\|..n.b.i_D......xuR......I.TS.4..}\|<...o....MG.+@.......\.?."...+[...A..&...{]......u..+p?......\|...j....7...=H..cwp.38.;%c.....O..............p...X.g!....r...d..5.%x.....;...j6p...p......c.Nd.:...&.....%.. tR.d.@.. ...1..6....i....:...s=..V...iN..1../tH..p<..Mo.......`&.7uA;..(lC.......4...?..0..[S@...D..\|....=.wh2...<.. ...)..F...!. .C...k...S.pPt......s..K.V...w......7....Zn.d..t]l.........5=.(..#.....l._.Ip......-O.6.,......q4....!XS`6k..k.....9k....{~*.....X....q......l.>x..={j.n..W......e..Q..I/..;a..MS>.!5v.d.B+.o.....q...j.q..Z..=..@g.1q..,yBV91m.j>..4.o...

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	downloaded
Size (bytes):	35170
Entropy (8bit):	7.993096534744333
Encrypted:	true
SSDEEP:	768:K+LvEzA9nny7u0zF35Hm4ngomu6yeLDKDnccqmcmHvVVPCLVf:ny7f5GpuheL4htv3Pkf
MD5:	171A4DD9400708B88724B57D62B24A6A
SHA1:	9C6F1303B8F02FCE18D20EC9CADA11D38D0C4B37
SHA-256:	EA00750636C11DBD4FA3ACB1B3CDCBAE3EFA43F6B6C3753444B6D6A242AE9336
SHA-512:	5B13B63912B34E3EEEDD8DA5953B869A83DF82FFD2A8D737AA81DC984F1811800A534F340C48041DA803C25B6B8F5605EA8D003B6A09A1874408F95A710F5126
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_cc2c59f5ef2c09e14b08.js
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:....r..._........,...A........z.....\|..t.. [.C.....{...~..c......ua...~.v<.I..P#._{{}._.......Km...eR....u?GY..h..}..gAv...<.l.Z...#.....:P?Q..."..........,.D...I<._.'..-..=..;.>.C_..#.....D[0.Y..*...M.....{.YT,...x..SQ/......N<`...\|._.k....0)......+.Z..4...M. ...i...`.ml..-X.E.....d.. .}.e4.{6hz^..}....@....W.1...d8...>.@.....(.'[..`..A..?...yL.\|..QTF...-.='S@.Q.sM.`...}.t..$..y^..0J.kC.S...U.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57510
Category:	downloaded
Size (bytes):	16345
Entropy (8bit):	7.98960525258912
Encrypted:	false
SSDEEP:	384:hOBEj/gTOkWow6mhJqXnYI/0PiQBSoe122Yw/:hOBKJBXO586QB+11J
MD5:	187B9EBA41FDF66B2C8F7EB645D2BC17
SHA1:	B1C034F7F5F754F271D094FB417B9A820C1F712C
SHA-256:	CA0FBF8421A0CF4CCDA7310B2AE74CBD92214901EC2D0F273EA3B07F12CF96EA
SHA-512:	0D7FB682D24E97C9E3FC04AA87CCB8EC508CA0CF197DA0617EFFD981BC8B5E3600824FDD08F1F31F59D276B5BF53229D00805D984E01D512FD968610C5FE9609
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
Category:	dropped
Size (bytes):	116343
Entropy (8bit):	7.997640489040715
Encrypted:	true
SSDEEP:	3072:s8ovOS/D3L+TGsLMet6+iNLTMMqfC4hyFv0As5:jNSrij/t6+aAMqfCoydM5
MD5:	3063B0DA40B45B46602FCE99AC53D315
SHA1:	57883FF854B80AD2A76479A0273BE9218B4DA553
SHA-256:	C60FB365DF08D31F36EDA468941C309AE3A917ED784A30495800F05E5F98B66B
SHA-512:	3EAF55117A825B588972F6AE324F6173EF4F2A309BAB69A9A6CC43C8F9A4EE25C2FA86752C8912542CC353727DC54A034B369D4A4451F0C3B20206C16FA9FE98
Malicious:	false
Reputation:	low
Preview:	...........k{.H.(.}............'qz<..>.3==..G..(..../m..]kU.T......\|x....T.Z...O....T.........e..]../'.o+gp.k.........F....+#..+.{..\|X..J.U.`.F.0...W..7.Ie...J2.Y.~.$.L.8....$...P]4..yQ.P99..P?....?........I%....+^0..&p..2..<........Da...J....F.9<.7.^.+1O.0J..........h1....[....h..............u".....C%.+..\.>....T`.1....... i......8.TB(.Uh.b.{...@<y..D^.S.....n".<H.L..O..*.t........p6..\[...yCm.J.k.....b..vg....-.j.$........1....p~3.b.....n....[_c..{1WN.l~.=...........?......S.}U..g.......t..../...........\|.+...-y.X\...l.....>;."....ye.\.....h..p.f.8...[/..nd.,.......X.?......-....J.....I.;....t..FSw...a7i...c..Y{.-..>a..4h.Eo..c#...O....~..d....Z..z.'...s.D..E...jb.O.F..0.VW>..]%6........x..O>E.'a0U.....w....."..9.az.6....<a.?..<qvx........ct.K..s.C3..d#..#^R.z..A..u.f..........s.....M.rb(.\v.....%.k....i.f...,C.s..bY..K#...~.>..D..j....m.71..}...37h........P{..7!@...\|..ZR.]V....."...0.o....7..peCG....px..j.%r2.....R.k5m..s.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 19:10:16.653446913 CET	49675	443	192.168.2.4	173.222.162.32
Dec 23, 2024 19:10:20.030539989 CET	49737	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:10:20.030637026 CET	443	49737	172.217.21.36	192.168.2.4
Dec 23, 2024 19:10:20.030716896 CET	49737	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:10:20.030905008 CET	49737	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:10:20.030953884 CET	443	49737	172.217.21.36	192.168.2.4
Dec 23, 2024 19:10:21.759813070 CET	443	49737	172.217.21.36	192.168.2.4
Dec 23, 2024 19:10:21.760046959 CET	49737	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:10:21.760086060 CET	443	49737	172.217.21.36	192.168.2.4
Dec 23, 2024 19:10:21.761050940 CET	443	49737	172.217.21.36	192.168.2.4
Dec 23, 2024 19:10:21.761111975 CET	49737	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:10:21.762209892 CET	49737	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:10:21.762274027 CET	443	49737	172.217.21.36	192.168.2.4
Dec 23, 2024 19:10:21.809627056 CET	49737	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:10:21.809665918 CET	443	49737	172.217.21.36	192.168.2.4
Dec 23, 2024 19:10:21.856261969 CET	49737	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:10:22.200709105 CET	49740	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:22.200716972 CET	49739	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:22.200813055 CET	443	49739	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:22.200822115 CET	443	49740	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:22.200901985 CET	49740	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:22.200901985 CET	49739	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:22.201102018 CET	49739	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:22.201138020 CET	443	49739	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:22.201297998 CET	49740	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:22.201330900 CET	443	49740	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.420495987 CET	443	49740	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.429663897 CET	443	49739	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.463918924 CET	49739	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.463973999 CET	443	49739	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.464092970 CET	49740	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.464170933 CET	443	49740	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.465413094 CET	443	49740	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.465481997 CET	49740	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.467843056 CET	443	49739	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.467910051 CET	49739	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.479439974 CET	49740	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.479540110 CET	443	49740	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.501661062 CET	49739	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.501909971 CET	443	49739	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.505012989 CET	49740	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.505036116 CET	443	49740	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.548599958 CET	49739	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.548608065 CET	49740	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.548634052 CET	443	49739	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.594868898 CET	49739	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.900809050 CET	443	49740	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.900995016 CET	443	49740	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.901062012 CET	49740	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.902295113 CET	49740	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.902364016 CET	443	49740	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:23.902391911 CET	49740	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:23.902415991 CET	49740	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:24.052123070 CET	49742	443	192.168.2.4	104.18.35.227
Dec 23, 2024 19:10:24.052198887 CET	443	49742	104.18.35.227	192.168.2.4
Dec 23, 2024 19:10:24.052275896 CET	49742	443	192.168.2.4	104.18.35.227
Dec 23, 2024 19:10:24.052499056 CET	49742	443	192.168.2.4	104.18.35.227
Dec 23, 2024 19:10:24.052530050 CET	443	49742	104.18.35.227	192.168.2.4
Dec 23, 2024 19:10:25.268084049 CET	443	49742	104.18.35.227	192.168.2.4
Dec 23, 2024 19:10:25.268359900 CET	49742	443	192.168.2.4	104.18.35.227
Dec 23, 2024 19:10:25.268419027 CET	443	49742	104.18.35.227	192.168.2.4
Dec 23, 2024 19:10:25.269314051 CET	443	49742	104.18.35.227	192.168.2.4
Dec 23, 2024 19:10:25.269385099 CET	49742	443	192.168.2.4	104.18.35.227
Dec 23, 2024 19:10:25.270289898 CET	49742	443	192.168.2.4	104.18.35.227
Dec 23, 2024 19:10:25.270353079 CET	443	49742	104.18.35.227	192.168.2.4
Dec 23, 2024 19:10:25.270498991 CET	49742	443	192.168.2.4	104.18.35.227
Dec 23, 2024 19:10:25.270515919 CET	443	49742	104.18.35.227	192.168.2.4
Dec 23, 2024 19:10:25.324521065 CET	49742	443	192.168.2.4	104.18.35.227
Dec 23, 2024 19:10:25.740684032 CET	443	49742	104.18.35.227	192.168.2.4
Dec 23, 2024 19:10:25.740796089 CET	443	49742	104.18.35.227	192.168.2.4
Dec 23, 2024 19:10:25.740866899 CET	49742	443	192.168.2.4	104.18.35.227
Dec 23, 2024 19:10:25.741401911 CET	49742	443	192.168.2.4	104.18.35.227
Dec 23, 2024 19:10:25.741450071 CET	443	49742	104.18.35.227	192.168.2.4
Dec 23, 2024 19:10:28.531794071 CET	49737	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:10:28.579323053 CET	443	49737	172.217.21.36	192.168.2.4
Dec 23, 2024 19:10:29.361947060 CET	443	49737	172.217.21.36	192.168.2.4
Dec 23, 2024 19:10:29.362087011 CET	443	49737	172.217.21.36	192.168.2.4
Dec 23, 2024 19:10:29.364489079 CET	49737	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:10:29.364553928 CET	443	49737	172.217.21.36	192.168.2.4
Dec 23, 2024 19:10:29.364626884 CET	49737	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:10:29.364736080 CET	49737	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:10:29.806585073 CET	49745	80	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:29.875555038 CET	49746	80	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:29.926358938 CET	80	49745	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:29.926765919 CET	49745	80	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:29.926765919 CET	49745	80	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:29.995429039 CET	80	49746	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:29.995743036 CET	49746	80	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:30.046618938 CET	80	49745	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:31.012305021 CET	80	49745	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:31.062355995 CET	49745	80	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:31.155397892 CET	49747	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:31.155452967 CET	443	49747	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:31.155531883 CET	49747	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:31.155731916 CET	49747	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:31.155747890 CET	443	49747	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:32.378329992 CET	443	49747	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:32.378793955 CET	49747	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:32.378812075 CET	443	49747	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:32.379817009 CET	443	49747	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:32.379906893 CET	49747	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:32.380923986 CET	49747	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:32.380980968 CET	443	49747	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:32.381052971 CET	49747	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:32.427330971 CET	443	49747	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:32.433752060 CET	49747	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:32.433763981 CET	443	49747	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:32.479739904 CET	49747	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:35.064209938 CET	49723	80	192.168.2.4	199.232.214.172
Dec 23, 2024 19:10:35.184621096 CET	80	49723	199.232.214.172	192.168.2.4
Dec 23, 2024 19:10:35.184695005 CET	49723	80	192.168.2.4	199.232.214.172
Dec 23, 2024 19:10:35.369570971 CET	443	49747	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:35.369648933 CET	443	49747	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:35.369705915 CET	49747	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:35.371187925 CET	49747	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:35.371212006 CET	443	49747	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:35.372831106 CET	49752	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:35.372891903 CET	443	49752	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:35.372960091 CET	49752	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:35.373275995 CET	49752	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:35.373292923 CET	443	49752	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:36.586735010 CET	443	49752	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:36.587088108 CET	49752	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:36.587131023 CET	443	49752	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:36.587634087 CET	443	49752	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:36.587968111 CET	49752	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:36.588052988 CET	443	49752	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:36.588107109 CET	49752	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:36.635334969 CET	443	49752	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:37.715456009 CET	443	49752	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:37.715728045 CET	443	49752	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:37.715899944 CET	49752	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:37.717035055 CET	49752	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:37.717051983 CET	443	49752	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:37.717673063 CET	49754	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:37.717696905 CET	443	49754	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:37.717752934 CET	49754	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:37.717988968 CET	49754	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:37.717998028 CET	443	49754	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:38.291012049 CET	443	49739	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:38.291098118 CET	443	49739	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:38.291188002 CET	49739	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:38.891472101 CET	49739	443	192.168.2.4	104.18.38.97
Dec 23, 2024 19:10:38.891526937 CET	443	49739	104.18.38.97	192.168.2.4
Dec 23, 2024 19:10:39.098186016 CET	443	49754	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:39.098611116 CET	49754	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:39.098643064 CET	443	49754	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:39.098984003 CET	443	49754	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:39.099267960 CET	49754	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:39.099350929 CET	443	49754	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:39.099416018 CET	49754	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:39.147341967 CET	443	49754	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:39.707233906 CET	443	49754	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:39.707304001 CET	443	49754	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:39.707364082 CET	49754	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:39.707623005 CET	49754	443	192.168.2.4	138.197.8.61
Dec 23, 2024 19:10:39.707645893 CET	443	49754	138.197.8.61	192.168.2.4
Dec 23, 2024 19:10:40.850996017 CET	49755	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:40.851031065 CET	443	49755	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:40.851195097 CET	49755	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:40.851347923 CET	49755	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:40.851360083 CET	443	49755	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:42.236351967 CET	443	49755	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:42.236618042 CET	49755	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:42.236633062 CET	443	49755	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:42.237499952 CET	443	49755	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:42.237674952 CET	49755	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:42.238528013 CET	49755	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:42.238574982 CET	443	49755	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:42.238789082 CET	49755	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:42.238795042 CET	443	49755	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:42.282627106 CET	49755	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:42.756304026 CET	443	49755	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:42.756402969 CET	443	49755	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:42.756472111 CET	49755	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:42.756743908 CET	49755	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:42.756761074 CET	443	49755	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:42.758682013 CET	49756	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:42.758774996 CET	443	49756	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:42.758868933 CET	49756	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:42.759078026 CET	49756	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:42.759129047 CET	443	49756	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:44.222527027 CET	443	49756	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:44.222985983 CET	49756	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:44.223047972 CET	443	49756	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:44.223433018 CET	443	49756	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:44.223762989 CET	49756	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:44.223840952 CET	443	49756	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:44.223903894 CET	49756	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:44.267365932 CET	443	49756	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:44.751435995 CET	443	49756	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:44.751503944 CET	443	49756	161.35.24.67	192.168.2.4
Dec 23, 2024 19:10:44.751559973 CET	49756	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:44.753283978 CET	49756	443	192.168.2.4	161.35.24.67
Dec 23, 2024 19:10:44.753302097 CET	443	49756	161.35.24.67	192.168.2.4
Dec 23, 2024 19:11:14.999744892 CET	49746	80	192.168.2.4	138.197.8.61
Dec 23, 2024 19:11:15.119635105 CET	80	49746	138.197.8.61	192.168.2.4
Dec 23, 2024 19:11:16.021995068 CET	49745	80	192.168.2.4	138.197.8.61
Dec 23, 2024 19:11:16.146872997 CET	80	49745	138.197.8.61	192.168.2.4
Dec 23, 2024 19:11:19.951776028 CET	49818	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:11:19.951879025 CET	443	49818	172.217.21.36	192.168.2.4
Dec 23, 2024 19:11:19.951955080 CET	49818	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:11:19.952224016 CET	49818	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:11:19.952256918 CET	443	49818	172.217.21.36	192.168.2.4
Dec 23, 2024 19:11:21.650085926 CET	443	49818	172.217.21.36	192.168.2.4
Dec 23, 2024 19:11:21.650495052 CET	49818	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:11:21.650527954 CET	443	49818	172.217.21.36	192.168.2.4
Dec 23, 2024 19:11:21.650860071 CET	443	49818	172.217.21.36	192.168.2.4
Dec 23, 2024 19:11:21.651287079 CET	49818	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:11:21.651360989 CET	443	49818	172.217.21.36	192.168.2.4
Dec 23, 2024 19:11:21.699666023 CET	49818	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:11:22.043521881 CET	49724	80	192.168.2.4	199.232.214.172
Dec 23, 2024 19:11:22.163672924 CET	80	49724	199.232.214.172	192.168.2.4
Dec 23, 2024 19:11:22.163738966 CET	49724	80	192.168.2.4	199.232.214.172
Dec 23, 2024 19:11:30.892925978 CET	80	49746	138.197.8.61	192.168.2.4
Dec 23, 2024 19:11:30.893017054 CET	49746	80	192.168.2.4	138.197.8.61
Dec 23, 2024 19:11:30.905527115 CET	49746	80	192.168.2.4	138.197.8.61
Dec 23, 2024 19:11:31.025235891 CET	80	49746	138.197.8.61	192.168.2.4
Dec 23, 2024 19:11:31.342072010 CET	443	49818	172.217.21.36	192.168.2.4
Dec 23, 2024 19:11:31.342145920 CET	443	49818	172.217.21.36	192.168.2.4
Dec 23, 2024 19:11:31.342199087 CET	49818	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:11:32.888634920 CET	49818	443	192.168.2.4	172.217.21.36
Dec 23, 2024 19:11:32.888720036 CET	443	49818	172.217.21.36	192.168.2.4
Dec 23, 2024 19:11:36.013709068 CET	80	49745	138.197.8.61	192.168.2.4
Dec 23, 2024 19:11:36.013933897 CET	49745	80	192.168.2.4	138.197.8.61
Dec 23, 2024 19:11:36.889283895 CET	49745	80	192.168.2.4	138.197.8.61
Dec 23, 2024 19:11:37.008837938 CET	80	49745	138.197.8.61	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 19:10:16.306138992 CET	53	56409	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:16.310296059 CET	53	52062	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:19.104897976 CET	53	56233	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:19.892051935 CET	55009	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:19.892165899 CET	49768	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:20.029392958 CET	53	55009	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:20.029474020 CET	53	49768	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:21.886486053 CET	54369	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:21.886744976 CET	60685	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:22.195502043 CET	53	54369	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:22.199860096 CET	53	60685	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:23.903306007 CET	49645	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:23.903482914 CET	62437	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:24.051100969 CET	53	62437	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:24.051690102 CET	53	49645	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:25.743390083 CET	64164	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:25.743521929 CET	58352	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:25.886621952 CET	53	64164	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:25.887207031 CET	53	58352	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:29.364480019 CET	60907	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:29.364604950 CET	54498	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:29.805515051 CET	53	54498	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:29.805924892 CET	53	60907	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:31.015038013 CET	60986	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:31.015208960 CET	59976	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:31.152776957 CET	53	59976	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:31.154776096 CET	53	60986	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:33.619693041 CET	138	138	192.168.2.4	192.168.2.255
Dec 23, 2024 19:10:35.917098045 CET	53	56203	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:39.709484100 CET	58973	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:39.709692955 CET	50071	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:40.733625889 CET	49460	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:40.734015942 CET	56248	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:40.849239111 CET	53	58973	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:40.850249052 CET	53	50071	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:40.871586084 CET	53	49460	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:40.875144005 CET	53	56248	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:44.754127026 CET	60622	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:44.754261017 CET	59319	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:52.541049957 CET	58426	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:52.541178942 CET	55673	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:53.206423998 CET	54451	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:53.213270903 CET	53487	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:10:53.344369888 CET	53	54451	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:53.350694895 CET	53	53487	1.1.1.1	192.168.2.4
Dec 23, 2024 19:10:54.963664055 CET	53	55525	1.1.1.1	192.168.2.4
Dec 23, 2024 19:11:06.999391079 CET	53	59353	1.1.1.1	192.168.2.4
Dec 23, 2024 19:11:15.623347998 CET	53	50696	1.1.1.1	192.168.2.4
Dec 23, 2024 19:11:17.072776079 CET	65316	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:11:17.072932959 CET	50234	53	192.168.2.4	1.1.1.1
Dec 23, 2024 19:11:18.497889996 CET	53	64866	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 23, 2024 19:10:40.871750116 CET	192.168.2.4	1.1.1.1	c1f7	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 19:10:19.892051935 CET	192.168.2.4	1.1.1.1	0xb9e2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:19.892165899 CET	192.168.2.4	1.1.1.1	0x3708	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 23, 2024 19:10:21.886486053 CET	192.168.2.4	1.1.1.1	0x7443	Standard query (0)	flowto.it	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:21.886744976 CET	192.168.2.4	1.1.1.1	0x60c8	Standard query (0)	flowto.it	65	IN (0x0001)	false
Dec 23, 2024 19:10:23.903306007 CET	192.168.2.4	1.1.1.1	0x6f85	Standard query (0)	flowcode.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:23.903482914 CET	192.168.2.4	1.1.1.1	0x30dd	Standard query (0)	flowcode.com	65	IN (0x0001)	false
Dec 23, 2024 19:10:25.743390083 CET	192.168.2.4	1.1.1.1	0x8441	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:25.743521929 CET	192.168.2.4	1.1.1.1	0x4f17	Standard query (0)	google.com	65	IN (0x0001)	false
Dec 23, 2024 19:10:29.364480019 CET	192.168.2.4	1.1.1.1	0xe3b7	Standard query (0)	web1.mlp-pe.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:29.364604950 CET	192.168.2.4	1.1.1.1	0x53bf	Standard query (0)	web1.mlp-pe.com	65	IN (0x0001)	false
Dec 23, 2024 19:10:31.015038013 CET	192.168.2.4	1.1.1.1	0x74d8	Standard query (0)	web1.mlp-pe.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:31.015208960 CET	192.168.2.4	1.1.1.1	0x39f1	Standard query (0)	web1.mlp-pe.com	65	IN (0x0001)	false
Dec 23, 2024 19:10:39.709484100 CET	192.168.2.4	1.1.1.1	0xf8c4	Standard query (0)	ads-microsofl.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:39.709692955 CET	192.168.2.4	1.1.1.1	0xf706	Standard query (0)	ads-microsofl.com	65	IN (0x0001)	false
Dec 23, 2024 19:10:40.733625889 CET	192.168.2.4	1.1.1.1	0xa7a5	Standard query (0)	ads-microsofl.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:40.734015942 CET	192.168.2.4	1.1.1.1	0x327f	Standard query (0)	ads-microsofl.com	65	IN (0x0001)	false
Dec 23, 2024 19:10:44.754127026 CET	192.168.2.4	1.1.1.1	0x16f6	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:44.754261017 CET	192.168.2.4	1.1.1.1	0x24bb	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Dec 23, 2024 19:10:52.541049957 CET	192.168.2.4	1.1.1.1	0x601a	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:52.541178942 CET	192.168.2.4	1.1.1.1	0xbb78	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Dec 23, 2024 19:10:53.206423998 CET	192.168.2.4	1.1.1.1	0x2ce0	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:53.213270903 CET	192.168.2.4	1.1.1.1	0x62b	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Dec 23, 2024 19:11:17.072776079 CET	192.168.2.4	1.1.1.1	0x38b3	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:11:17.072932959 CET	192.168.2.4	1.1.1.1	0x65b9	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 19:10:20.029392958 CET	1.1.1.1	192.168.2.4	0xb9e2	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:20.029474020 CET	1.1.1.1	192.168.2.4	0x3708	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 23, 2024 19:10:22.195502043 CET	1.1.1.1	192.168.2.4	0x7443	No error (0)	flowto.it		104.18.38.97	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:22.195502043 CET	1.1.1.1	192.168.2.4	0x7443	No error (0)	flowto.it		172.64.149.159	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:22.199860096 CET	1.1.1.1	192.168.2.4	0x60c8	No error (0)	flowto.it			65	IN (0x0001)	false
Dec 23, 2024 19:10:24.051100969 CET	1.1.1.1	192.168.2.4	0x30dd	No error (0)	flowcode.com			65	IN (0x0001)	false
Dec 23, 2024 19:10:24.051690102 CET	1.1.1.1	192.168.2.4	0x6f85	No error (0)	flowcode.com		104.18.35.227	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:24.051690102 CET	1.1.1.1	192.168.2.4	0x6f85	No error (0)	flowcode.com		172.64.152.29	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:25.886621952 CET	1.1.1.1	192.168.2.4	0x8441	No error (0)	google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:25.887207031 CET	1.1.1.1	192.168.2.4	0x4f17	No error (0)	google.com			65	IN (0x0001)	false
Dec 23, 2024 19:10:29.805924892 CET	1.1.1.1	192.168.2.4	0xe3b7	No error (0)	web1.mlp-pe.com		138.197.8.61	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:31.154776096 CET	1.1.1.1	192.168.2.4	0x74d8	No error (0)	web1.mlp-pe.com		138.197.8.61	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:40.849239111 CET	1.1.1.1	192.168.2.4	0xf8c4	No error (0)	ads-microsofl.com		161.35.24.67	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:40.871586084 CET	1.1.1.1	192.168.2.4	0xa7a5	No error (0)	ads-microsofl.com		161.35.24.67	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:44.892450094 CET	1.1.1.1	192.168.2.4	0x24bb	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 19:10:44.892777920 CET	1.1.1.1	192.168.2.4	0x16f6	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 19:10:47.630225897 CET	1.1.1.1	192.168.2.4	0xf028	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 19:10:47.630225897 CET	1.1.1.1	192.168.2.4	0xf028	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:50.259157896 CET	1.1.1.1	192.168.2.4	0xebd6	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 19:10:50.259157896 CET	1.1.1.1	192.168.2.4	0xebd6	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:52.686255932 CET	1.1.1.1	192.168.2.4	0xbb78	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 19:10:52.776804924 CET	1.1.1.1	192.168.2.4	0x601a	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 19:10:53.344369888 CET	1.1.1.1	192.168.2.4	0x2ce0	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 19:10:53.344369888 CET	1.1.1.1	192.168.2.4	0x2ce0	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 19:10:53.344369888 CET	1.1.1.1	192.168.2.4	0x2ce0	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 23, 2024 19:10:53.350694895 CET	1.1.1.1	192.168.2.4	0x62b	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 19:10:53.350694895 CET	1.1.1.1	192.168.2.4	0x62b	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 19:11:17.209644079 CET	1.1.1.1	192.168.2.4	0x38b3	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 19:11:17.212112904 CET	1.1.1.1	192.168.2.4	0x65b9	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

flowto.it

flowcode.com

www.google.com

web1.mlp-pe.com

ads-microsofl.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	138.197.8.61	80	4444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 19:10:29.926765919 CET	430	OUT	GET / HTTP/1.1 Host: web1.mlp-pe.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 23, 2024 19:10:31.012305021 CET	354	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 23 Dec 2024 18:10:30 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://web1.mlp-pe.com/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Dec 23, 2024 19:11:16.021995068 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49746	138.197.8.61	80	4444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 19:11:14.999744892 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	104.18.38.97	443	4444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 18:10:23 UTC	666	OUT	GET /8tooc2sec?fc=0 HTTP/1.1 Host: flowto.it Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 18:10:23 UTC	374	IN	HTTP/1.1 302 Moved Temporarily Date: Mon, 23 Dec 2024 18:10:23 GMT Content-Type: text/html Content-Length: 143 Connection: close Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Location: https://flowcode.com/p/8tooc2sec?fc=0 Server: cloudflare CF-RAY: 8f6a4ee22d325e62-EWR
2024-12-23 18:10:23 UTC	143	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	104.18.35.227	443	4444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 18:10:25 UTC	671	OUT	GET /p/8tooc2sec?fc=0 HTTP/1.1 Host: flowcode.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 18:10:25 UTC	1119	IN	HTTP/1.1 302 Found Date: Mon, 23 Dec 2024 18:10:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close location: https://google.com/amp/web1.mlp-pe.com?fce_id=c7f56a56-d705-4e73-8fc6-6047be76685b expires: Thu, 01 Jan 1970 00:00:00 UTC pragma: no-cache Set-Cookie: rdservice=cdd91b8b-5043-40a7-bb13-2adbe8a69efb-SSE:1734977425; Path=/; Domain=flowcode.com; Expires=Sat, 23 Dec 2034 18:10:25 GMT; Secure; SameSite=None strict-transport-security: max-age=15552000; includeSubDomains; preload cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Set-Cookie: __cf_bm=oRx.cjxJzbIR7XdqSteTY3y_.4ZKeZNAV1P.tUj8V6k-1734977425-1.0.1.1-yeepUHPX4_yJCxs3dc6DO2x8.DzXvkKawJEbU3cI52rc06PhjFUUrDQiby6I2Fe5y_QsfFCh3JBl_7I2peqriw; path=/; expires=Mon, 23-Dec-24 18:40:25 GMT; domain=.flowcode.com; HttpOnly; Secure; SameSite=None Set-Cookie: _cfuvid=MNGACb6.KrbLGveelSghd0YAQi98k543EfNT2CmyLBA-1734977425580-0.0.1.1-604800000; path=/; domain=.flowcode.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8f6a4eedac0a42d1-EWR alt-svc: h3=":443"; ma=86400
2024-12-23 18:10:25 UTC	111	IN	Data Raw: 36 39 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 6d 70 2f 77 65 62 31 2e 6d 6c 70 2d 70 65 2e 63 6f 6d 3f 66 63 65 5f 69 64 3d 63 37 66 35 36 61 35 36 2d 64 37 30 35 2d 34 65 37 33 2d 38 66 63 36 2d 36 30 34 37 62 65 37 36 36 38 35 62 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 69<a href="https://google.com/amp/web1.mlp-pe.com?fce_id=c7f56a56-d705-4e73-8fc6-6047be76685b">Found</a>.
2024-12-23 18:10:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	172.217.21.36	443	4444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 18:10:28 UTC	720	OUT	GET /amp/web1.mlp-pe.com?fce_id=c7f56a56-d705-4e73-8fc6-6047be76685b HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 18:10:29 UTC	1180	IN	HTTP/1.1 302 Found Location: http://web1.mlp-pe.com Cache-Control: private X-Robots-Tag: noindex Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-WJmvbkV_rsS9hwHdWd4LYQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Mon, 23 Dec 2024 18:10:28 GMT Server: gws Content-Length: 219 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=520=EiehvI1g7mb6CZVu5-HKuYPdlCHGgmnSRgLlASyG96iPMMpTPOOHPV2fv6doT1-T9mj6Qc-n79tiAB4-xyUfroi3-jB5v6pEGK9dux9KVysPEXVcMugkiqcI5rcecuxzu8fMdZAlUL7BC5OlCaW8FN2LLZSZWftzZNUEUnvm_zwioOvm3VIPBGraNcZcXPS9SqArSw; expires=Tue, 24-Jun-2025 18:10:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-23 18:10:29 UTC	210	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 65 62 31 2e 6d 6c 70 2d 70 65 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="http://web1.mlp-pe.com">here</A>.</BODY>
2024-12-23 18:10:29 UTC	9	IN	Data Raw: 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: </HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49747	138.197.8.61	443	4444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 18:10:32 UTC	658	OUT	GET / HTTP/1.1 Host: web1.mlp-pe.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 18:10:35 UTC	392	IN	HTTP/1.1 302 Found Server: nginx Date: Mon, 23 Dec 2024 18:10:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close X-Powered-By: PHP/8.3.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=bgu8rmcsn2ud57i2k5kemvr2vn; path=/ location: biamar.php X-Powered-By: PleskLin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49752	138.197.8.61	443	4444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 18:10:36 UTC	714	OUT	GET /biamar.php HTTP/1.1 Host: web1.mlp-pe.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=bgu8rmcsn2ud57i2k5kemvr2vn
2024-12-23 18:10:37 UTC	335	IN	HTTP/1.1 302 Found Server: nginx Date: Mon, 23 Dec 2024 18:10:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close X-Powered-By: PHP/8.3.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Location: themels.php X-Powered-By: PleskLin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49754	138.197.8.61	443	4444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 18:10:39 UTC	715	OUT	GET /themels.php HTTP/1.1 Host: web1.mlp-pe.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=bgu8rmcsn2ud57i2k5kemvr2vn
2024-12-23 18:10:39 UTC	243	IN	HTTP/1.1 302 Found Server: nginx Date: Mon, 23 Dec 2024 18:10:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close X-Powered-By: PHP/8.3.14 Location: https://ads-microsofl.com/add X-Powered-By: PleskLin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49755	161.35.24.67	443	4444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 18:10:42 UTC	663	OUT	GET /add HTTP/1.1 Host: ads-microsofl.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 18:10:42 UTC	237	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 23 Dec 2024 18:10:42 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 306 Connection: close Location: https://ads-microsofl.com/add/ X-Powered-By: PleskLin
2024-12-23 18:10:42 UTC	306	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 2d 6d 69 63 72 6f 73 6f 66 6c 2e 63 6f 6d 2f 61 64 64 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://ads-microsofl.com/add/">here</a>.</p><hr><address>Apache Server at a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49756	161.35.24.67	443	4444	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 18:10:44 UTC	664	OUT	GET /add/ HTTP/1.1 Host: ads-microsofl.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 18:10:44 UTC	826	IN	HTTP/1.1 302 Found Server: nginx Date: Mon, 23 Dec 2024 18:10:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close X-Powered-By: PHP/8.3.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=56859v19fn1euoqi25k5fh9g7u; path=/ Location: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=c21a7052-a123-469a-817e-773ca24c0c50&response_type=code&redirect_uri=https%3A%2F%2Fads-microsofl.com%2Fadd%2Fconnect.php&response_mode=query&scope=https%3A%2F%2Fads.microsoft.com%2Fmsads.manage+offline_access+User.Invite.All+openid&state=57747805ec73ffb5cc4e818dd808f2f7&code_challenge=4Lk2aPQNad_Wcz7h27zAqsdzNi80mQ0z_DmOirA6GsY&code_challenge_method=S256&prompt=consent X-Powered-By: PleskLin

Target ID:	0
Start time:	13:10:11
Start date:	23/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:10:13
Start date:	23/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1984,i,18048823923627191415,11212712545854182537,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:10:20
Start date:	23/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://flowto.it/8tooc2sec?fc=0"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://flowto.it/8tooc2sec?fc=0

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Windows Analysis Report
https://flowto.it/8tooc2sec?fc=0