Edit tour

Windows Analysis Report
https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu

Overview

General Information

Sample URL:	https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu
Analysis ID:	1585355
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 3084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1980,i,16925175573915758389,7470972905762602225,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu	Avira URL Cloud: detection malicious, Label: phishing
Source: https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Source: https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu

Sample URL: PII: engineering@vanas.eu

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5 HTTP/1.1Host: ipfs.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/5.15.3/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://ipfs.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: ipfs.io
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_66.1.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_66.1.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_67.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_67.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: classification engine

Classification label: mal48.win@17/10@8/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1980,i,16925175573915758389,7470972905762602225,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1980,i,16925175573915758389,7470972905762602225,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu	100%	Avira URL Cloud	phishing
https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cdnjs.cloudflare.com	104.17.24.14	true	false	high
www.google.com	142.250.186.132	true	false	high
ipfs.io	209.94.90.1	true	false	high
cdn.jsdelivr.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css	false		high
https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://fontawesome.com	chromecache_66.1.dr	false	high
https://getbootstrap.com/)	chromecache_67.1.dr	false	high
https://github.com/twbs/bootstrap/blob/main/LICENSE)	chromecache_67.1.dr	false	high
https://fontawesome.com/license/free	chromecache_66.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
209.94.90.1	ipfs.io	United States	40680	PROTOCOLUS	false

Private

IP
192.168.2.18

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585355
Start date and time:	2025-01-07 14:57:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@17/10@8/5

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 216.58.206.46, 64.233.166.84, 142.250.185.206, 104.18.186.31, 104.18.187.31, 216.58.206.78, 142.250.181.238, 142.250.186.174, 142.250.186.78, 142.250.186.46, 216.58.212.174, 142.250.185.78, 216.58.206.67, 142.250.185.238, 142.250.185.174, 184.28.90.27, 4.245.163.56, 2.23.227.221
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, cdn.jsdelivr.net.cdn.cloudflare.net, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu

Simulations

Behavior and APIs

⊘No simulations

Input	Output
URL: https://ipfs.io Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://ipfs.io

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 12:58:09 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9685648698223193
Encrypted:	false
SSDEEP:	48:8kk3djT5hoEH8idAKZdA1rehwiZUklqehQy+3:8vBVhod/y
MD5:	C634AB275B6ADEB723FA1D259E55E327
SHA1:	22F32578B782A32E4C47D650A6FA6E2D567A2B33
SHA-256:	10B85980D5682D79FD79F4B6AA2EE994D018DEC532E20F3A66B6B3DCC497926E
SHA-512:	30C772427D28AF76C4BD0B3C339CE8D0826501A1155A589A2F85A6560CD276FE8865C8A8B0F87AD35E4F293E9DDD6773F22BBE0E00FFC85FB27DD4F652173229
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....v.D/.a......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I'Z9o....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZDo....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V'ZDo....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V'ZDo...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V'ZEo.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........>.r^.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 12:58:09 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985062275293901
Encrypted:	false
SSDEEP:	48:8w3djT5hoEH8idAKZdA1ceh/iZUkAQkqehvy+2:8wBVhoh9QWy
MD5:	8500C70938418B48FF25BBDBF4DB00A4
SHA1:	E61DB4F535E6441D99A9167F5C7B38B3347885D3
SHA-256:	18E49713E111C303D32DA913F6E648521125D6B5A260A89D8CBD327088CB4A75
SHA-512:	B2E0B71991A09C094757C586F97A4C4713DF90FA6A2EF2CD3CF029007031CFC8007537FAA0EDFCD19E5CEA8F67C9D0D5DCDE3C48FC4E3D70ECDC72E02C0FECA1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......9/.a......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I'Z9o....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZDo....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V'ZDo....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V'ZDo...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V'ZEo.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........>.r^.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	3.996471606515541
Encrypted:	false
SSDEEP:	48:8XR3djT5hoSH8idAKZdA14Aeh7sFiZUkmgqeh7sdy+BX:8hBVhoFnLy
MD5:	A7E11CC89EFFC88040D1FA6314A2411C
SHA1:	FCDB358B8B7AFCD05888B435060BA242492B6DA1
SHA-256:	D8115F946BC47E1574437302457B1BA215EFADED1FF70F926CC7CCF4AF312072
SHA-512:	794202BFEE134E4AA7A130693F0D53C2AD7F75F7ECC3059A2D99A490BC47B93037102F82F631C3F57DFBF645D861F80243272444688053E0519F84D78EB99393
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....?.4 ?.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I'Z9o....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZDo....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V'ZDo....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V'ZDo...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.R.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........>.r^.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 12:58:09 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.981136831953252
Encrypted:	false
SSDEEP:	48:8sV3djT5hoEH8idAKZdA1JehDiZUkwqehjy+R:8sVBVhokVy
MD5:	8778291ED0A7EFE39484ED835151CE98
SHA1:	8FD70CF18956FB7FA4A567BF6224E341548DD137
SHA-256:	4653A96CD1EE23691744F1F11CD11BE687CE3120DE27D5D33779667F113FAB32
SHA-512:	6D0026F40140DBC2965DBD89DE1AA99C479DEFBE30FA289064E605DE48846711FCDEA56ED0E40A69908A60EE57E936AA96C99ED1AA2653E04574B98220A6755F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......4/.a......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I'Z9o....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZDo....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V'ZDo....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V'ZDo...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V'ZEo.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........>.r^.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 12:58:09 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.969688181105612
Encrypted:	false
SSDEEP:	48:803djT5hoEH8idAKZdA1XehBiZUk1W1qehJy+C:80BVho09py
MD5:	806210DDB553327D5454295D48941582
SHA1:	4B05745BC43A811432133F33BF63A45280284ADD
SHA-256:	54D1E6258E2B8AE98787F00C09E822766E57937B808A1BC5F450F9C714B90255
SHA-512:	64B3E8FA1A1F387A8BA20951C7668BAF9A23FB79B80BE882F64EA818AD17F0B0778B61C26AC9712397281F551263F99F64C464811EA1C5FA519A1E935B23860F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....{a?/.a......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I'Z9o....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZDo....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V'ZDo....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V'ZDo...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V'ZEo.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........>.r^.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 12:58:09 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9832910227893192
Encrypted:	false
SSDEEP:	48:8i3djT5hoEH8idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8iBVhoYT/TbxWOvTbLy7T
MD5:	8A188D46C94480B952EB192ABDB67826
SHA1:	5FD25F700211C5806BA8540BB5D824D5FCA3C50A
SHA-256:	EAB38F9542DF7253D9164944B657E2216D614C1A53B9052577AC62C947008285
SHA-512:	D24BDF8D739719F2C7D8A31E3B6BC2AC2D8965C5CC421CFD92C3119154C4BD6C596B6F4E603B984321DF1D8F685C09FA28484D769C52CF1258D78AD97D846873
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....y/.a......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I'Z9o....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZDo....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V'ZDo....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V'ZDo...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V'ZEo.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........>.r^.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (59158)
Category:	downloaded
Size (bytes):	59344
Entropy (8bit):	4.717040228413791
Encrypted:	false
SSDEEP:	768:0Eh31IPiyXNq4YxBowbgJlkwF//zMQyYJYX9Bft6VSzl:0E0PxXE4YXJgndFTfy9lt5B
MD5:	74BAB4578692993514E7F882CC15C218
SHA1:	B6293BCFD851F963EDBE859498570C4C0C7EAAE4
SHA-256:	D87DDF917B7A1449AB45E2B8E3C98354629BDD65B6659C37E6023BBEA1CE1386
SHA-512:	8810579BC7D6F74FA7B8B7122A56E6ACF70B6B4393F76C4ED4122C67ECB00D6642BEAB1681C715DE0168441BF4CFEF1D2C9832007221477E5565CDA833F808D7
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css
Preview:	/!. Font Awesome Free 5.15.3 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa,.fab,.fad,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:inline-block;font-style:normal;font-variant:normal;text-rendering:auto;line-height:1}.fa-lg{font-size:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:2.5em;padding-left:0}.fa-ul>li{position:relative}.fa-li{left:-2em;position:absolute;text-align:center;width:2em;line-height:inherit}.fa-border{border:.08em solid #eee;border-radius:.1em;padding:.2em .25em .15em}.fa-pu

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65326)
Category:	downloaded
Size (bytes):	160392
Entropy (8bit):	5.078030630836827
Encrypted:	false
SSDEEP:	1536:kw7CIJ0T+r+ryEIA1pDEBi8yNcuSEIA1/uypq3SYiLENM6HN26R:H7VKGGq3SYiLENM6HN26R
MD5:	023B3876BB73AA541367FC40A193D2B7
SHA1:	8ED2D6350D23F857D92805737D0F97C675DE666B
SHA-256:	F77C0D1739B618EDC4A01CA3F6B2990B01A3009030AF49EE8CF68E83052DF194
SHA-512:	A1CF7E5D2B351F6E37FC544DF51C3AD859FC12DC631185875D1BE34B8DD8B6E7847B06D2E8E6DF5DC24DCA88631EA54A14FA175D4C7073EAB52BB0DE7BABEFF6
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css
Preview:	/!. Bootstrap v4.5.3 (https://getbootstrap.com/). * Copyright 2011-2020 The Bootstrap Authors. * Copyright 2011-2020 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). /:root{--blue:#007bff;--indigo:#6610f2;--purple:#6f42c1;--pink:#e83e8c;--red:#dc3545;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#ffc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,"Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--font-family-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace},::after,::before{box-sizing:bo

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 14:58:09.214920998 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.214945078 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.215003967 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.215241909 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.215257883 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.215620995 CET	49699	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.215647936 CET	443	49699	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.215698957 CET	49699	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.215919971 CET	49699	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.215934038 CET	443	49699	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.675976038 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.677122116 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.677158117 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.678266048 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.678333998 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.679338932 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.679410934 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.679526091 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.696820974 CET	443	49699	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.697065115 CET	49699	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.697077036 CET	443	49699	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.698153973 CET	443	49699	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.698219061 CET	49699	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.698513031 CET	49699	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.698575974 CET	443	49699	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.723332882 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.723824978 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.723844051 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.740190029 CET	49699	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.740197897 CET	443	49699	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.771861076 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.787821054 CET	49699	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.832093954 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.832143068 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.832169056 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.832195044 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.832238913 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.832237005 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.832261086 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.832289934 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.832314014 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.832318068 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.832350969 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.832392931 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.832397938 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.832593918 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.832622051 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.832674980 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.832680941 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.832747936 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:09.836750984 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:09.856116056 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:09.856137991 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:09.856982946 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:09.857173920 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:09.857186079 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:09.883594990 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.105875969 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.105945110 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.105977058 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106007099 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106034994 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106034040 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.106065035 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106089115 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.106115103 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.106121063 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106183052 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106215000 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106244087 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106256008 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.106261015 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106287003 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.106297016 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106329918 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106360912 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106383085 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.106386900 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106409073 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.106421947 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106453896 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106481075 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106508017 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106513977 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.106518030 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.106542110 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.106555939 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.106559992 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.110604048 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.110656977 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.110685110 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.110712051 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.110729933 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.110738039 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.110769033 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.110801935 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.110958099 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.111047029 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.111089945 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.111095905 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.111955881 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.111994982 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.112024069 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.112032890 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.112042904 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.112061024 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.112075090 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.112912893 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.112950087 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.112968922 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.112973928 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.112989902 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.113012075 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.115788937 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.115848064 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.115853071 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.115874052 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.115890980 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.115931988 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.116029978 CET	49698	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:10.116045952 CET	443	49698	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:10.323438883 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.323694944 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.323717117 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.324815035 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.324886084 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.325911999 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.325994968 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.326191902 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.326200962 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.375807047 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.472476959 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.472524881 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.472558022 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.472580910 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.472598076 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.472692966 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.472734928 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.472743034 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.472790003 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.472929955 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.473356962 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.473443031 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.473453999 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.477150917 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.477185011 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.477201939 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.477212906 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.477271080 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.477279902 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.518820047 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.561074972 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.561201096 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.561233044 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.561249018 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.561271906 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.561304092 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.561317921 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.561325073 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.561366081 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.561366081 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.561373949 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.561419010 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.561424017 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.561454058 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.561485052 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.561491013 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.561511040 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.561542988 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.561578035 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.562369108 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.562416077 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.562422991 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.562469006 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.562498093 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.562508106 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.562513113 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.562551022 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.562560081 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.562565088 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.562604904 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.562611103 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.606777906 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.606827974 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.606852055 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.606869936 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.606905937 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.649055958 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.649208069 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.649255037 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.649266005 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.649276972 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.649312973 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.649323940 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.649477959 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.649512053 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.649542093 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.649550915 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.649568081 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.649641991 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:10.649683952 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.649894953 CET	49703	443	192.168.2.18	104.17.24.14
Jan 7, 2025 14:58:10.649909019 CET	443	49703	104.17.24.14	192.168.2.18
Jan 7, 2025 14:58:13.124377966 CET	49705	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:58:13.124422073 CET	443	49705	142.250.186.132	192.168.2.18
Jan 7, 2025 14:58:13.124515057 CET	49705	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:58:13.124733925 CET	49705	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:58:13.124751091 CET	443	49705	142.250.186.132	192.168.2.18
Jan 7, 2025 14:58:13.766047955 CET	443	49705	142.250.186.132	192.168.2.18
Jan 7, 2025 14:58:13.766344070 CET	49705	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:58:13.766369104 CET	443	49705	142.250.186.132	192.168.2.18
Jan 7, 2025 14:58:13.767427921 CET	443	49705	142.250.186.132	192.168.2.18
Jan 7, 2025 14:58:13.767504930 CET	49705	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:58:13.768637896 CET	49705	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:58:13.768699884 CET	443	49705	142.250.186.132	192.168.2.18
Jan 7, 2025 14:58:13.817846060 CET	49705	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:58:13.817863941 CET	443	49705	142.250.186.132	192.168.2.18
Jan 7, 2025 14:58:13.865833998 CET	49705	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:58:20.909207106 CET	49673	443	192.168.2.18	204.79.197.203
Jan 7, 2025 14:58:21.212855101 CET	49673	443	192.168.2.18	204.79.197.203
Jan 7, 2025 14:58:21.818847895 CET	49673	443	192.168.2.18	204.79.197.203
Jan 7, 2025 14:58:23.018893957 CET	49673	443	192.168.2.18	204.79.197.203
Jan 7, 2025 14:58:23.614131927 CET	49692	443	192.168.2.18	20.190.159.64
Jan 7, 2025 14:58:23.614172935 CET	49692	443	192.168.2.18	20.190.159.64
Jan 7, 2025 14:58:23.619087934 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.619102955 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.619157076 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.619168043 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.619196892 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.693197966 CET	443	49705	142.250.186.132	192.168.2.18
Jan 7, 2025 14:58:23.693269968 CET	443	49705	142.250.186.132	192.168.2.18
Jan 7, 2025 14:58:23.693331957 CET	49705	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:58:23.979542017 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.979561090 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.979571104 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.979581118 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.979590893 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.979612112 CET	49692	443	192.168.2.18	20.190.159.64
Jan 7, 2025 14:58:23.979651928 CET	49692	443	192.168.2.18	20.190.159.64
Jan 7, 2025 14:58:23.979861021 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.979877949 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.979892969 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.979902029 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.979908943 CET	49692	443	192.168.2.18	20.190.159.64
Jan 7, 2025 14:58:23.979954958 CET	49692	443	192.168.2.18	20.190.159.64
Jan 7, 2025 14:58:23.980483055 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:58:23.980537891 CET	49692	443	192.168.2.18	20.190.159.64
Jan 7, 2025 14:58:24.582374096 CET	49705	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:58:24.582402945 CET	443	49705	142.250.186.132	192.168.2.18
Jan 7, 2025 14:58:24.603660107 CET	443	49699	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:24.603730917 CET	443	49699	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:24.603784084 CET	49699	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:25.427867889 CET	49673	443	192.168.2.18	204.79.197.203
Jan 7, 2025 14:58:26.387520075 CET	49699	443	192.168.2.18	209.94.90.1
Jan 7, 2025 14:58:26.387548923 CET	443	49699	209.94.90.1	192.168.2.18
Jan 7, 2025 14:58:28.033235073 CET	49679	443	192.168.2.18	52.182.141.63
Jan 7, 2025 14:58:28.334856987 CET	49679	443	192.168.2.18	52.182.141.63
Jan 7, 2025 14:58:28.941855907 CET	49679	443	192.168.2.18	52.182.141.63
Jan 7, 2025 14:58:30.153857946 CET	49679	443	192.168.2.18	52.182.141.63
Jan 7, 2025 14:58:30.233870983 CET	49673	443	192.168.2.18	204.79.197.203
Jan 7, 2025 14:58:32.566936970 CET	49679	443	192.168.2.18	52.182.141.63
Jan 7, 2025 14:58:37.375865936 CET	49679	443	192.168.2.18	52.182.141.63
Jan 7, 2025 14:58:39.834878922 CET	49673	443	192.168.2.18	204.79.197.203
Jan 7, 2025 14:58:46.976880074 CET	49679	443	192.168.2.18	52.182.141.63
Jan 7, 2025 14:58:55.092308998 CET	49689	80	192.168.2.18	199.232.210.172
Jan 7, 2025 14:58:55.097652912 CET	80	49689	199.232.210.172	192.168.2.18
Jan 7, 2025 14:58:55.097744942 CET	49689	80	192.168.2.18	199.232.210.172
Jan 7, 2025 14:59:13.174968958 CET	49712	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:59:13.175009012 CET	443	49712	142.250.186.132	192.168.2.18
Jan 7, 2025 14:59:13.175098896 CET	49712	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:59:13.175316095 CET	49712	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:59:13.175328016 CET	443	49712	142.250.186.132	192.168.2.18
Jan 7, 2025 14:59:13.848959923 CET	443	49712	142.250.186.132	192.168.2.18
Jan 7, 2025 14:59:13.849265099 CET	49712	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:59:13.849303961 CET	443	49712	142.250.186.132	192.168.2.18
Jan 7, 2025 14:59:13.849653959 CET	443	49712	142.250.186.132	192.168.2.18
Jan 7, 2025 14:59:13.849994898 CET	49712	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:59:13.850059032 CET	443	49712	142.250.186.132	192.168.2.18
Jan 7, 2025 14:59:13.893901110 CET	49712	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:59:23.750305891 CET	443	49712	142.250.186.132	192.168.2.18
Jan 7, 2025 14:59:23.750391006 CET	443	49712	142.250.186.132	192.168.2.18
Jan 7, 2025 14:59:23.750471115 CET	49712	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:59:24.595168114 CET	49712	443	192.168.2.18	142.250.186.132
Jan 7, 2025 14:59:24.595199108 CET	443	49712	142.250.186.132	192.168.2.18
Jan 7, 2025 14:59:46.760099888 CET	49691	80	192.168.2.18	192.229.221.95
Jan 7, 2025 14:59:46.760102034 CET	49690	443	192.168.2.18	20.190.159.64
Jan 7, 2025 14:59:46.765223026 CET	443	49690	20.190.159.64	192.168.2.18
Jan 7, 2025 14:59:46.765314102 CET	49690	443	192.168.2.18	20.190.159.64
Jan 7, 2025 14:59:46.765558004 CET	80	49691	192.229.221.95	192.168.2.18
Jan 7, 2025 14:59:46.765618086 CET	49691	80	192.168.2.18	192.229.221.95
Jan 7, 2025 14:59:48.886976004 CET	49692	443	192.168.2.18	20.190.159.64
Jan 7, 2025 14:59:48.892148018 CET	443	49692	20.190.159.64	192.168.2.18
Jan 7, 2025 14:59:48.892215014 CET	49692	443	192.168.2.18	20.190.159.64

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 14:58:08.376166105 CET	53	53271	1.1.1.1	192.168.2.18
Jan 7, 2025 14:58:08.456521988 CET	53	58910	1.1.1.1	192.168.2.18
Jan 7, 2025 14:58:09.206964016 CET	63719	53	192.168.2.18	1.1.1.1
Jan 7, 2025 14:58:09.207120895 CET	49379	53	192.168.2.18	1.1.1.1
Jan 7, 2025 14:58:09.213838100 CET	53	63719	1.1.1.1	192.168.2.18
Jan 7, 2025 14:58:09.214409113 CET	53	49379	1.1.1.1	192.168.2.18
Jan 7, 2025 14:58:09.453859091 CET	53	58007	1.1.1.1	192.168.2.18
Jan 7, 2025 14:58:09.844181061 CET	60763	53	192.168.2.18	1.1.1.1
Jan 7, 2025 14:58:09.844325066 CET	56108	53	192.168.2.18	1.1.1.1
Jan 7, 2025 14:58:09.848751068 CET	52664	53	192.168.2.18	1.1.1.1
Jan 7, 2025 14:58:09.848903894 CET	60026	53	192.168.2.18	1.1.1.1
Jan 7, 2025 14:58:09.851105928 CET	53	56108	1.1.1.1	192.168.2.18
Jan 7, 2025 14:58:09.855535984 CET	53	60026	1.1.1.1	192.168.2.18
Jan 7, 2025 14:58:09.855546951 CET	53	52664	1.1.1.1	192.168.2.18
Jan 7, 2025 14:58:13.116854906 CET	50782	53	192.168.2.18	1.1.1.1
Jan 7, 2025 14:58:13.116985083 CET	58159	53	192.168.2.18	1.1.1.1
Jan 7, 2025 14:58:13.123507977 CET	53	50782	1.1.1.1	192.168.2.18
Jan 7, 2025 14:58:13.123644114 CET	53	58159	1.1.1.1	192.168.2.18
Jan 7, 2025 14:58:26.395133018 CET	53	50317	1.1.1.1	192.168.2.18
Jan 7, 2025 14:58:45.304984093 CET	53	53816	1.1.1.1	192.168.2.18
Jan 7, 2025 14:59:08.147339106 CET	53	62546	1.1.1.1	192.168.2.18
Jan 7, 2025 14:59:08.355134964 CET	53	55367	1.1.1.1	192.168.2.18
Jan 7, 2025 14:59:28.240967989 CET	138	138	192.168.2.18	192.168.2.255
Jan 7, 2025 14:59:38.427649021 CET	53	49795	1.1.1.1	192.168.2.18

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 14:58:09.206964016 CET	192.168.2.18	1.1.1.1	0x5412	Standard query (0)	ipfs.io	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:58:09.207120895 CET	192.168.2.18	1.1.1.1	0x21f9	Standard query (0)	ipfs.io	65	IN (0x0001)	false
Jan 7, 2025 14:58:09.844181061 CET	192.168.2.18	1.1.1.1	0xe58c	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:58:09.844325066 CET	192.168.2.18	1.1.1.1	0x276c	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false
Jan 7, 2025 14:58:09.848751068 CET	192.168.2.18	1.1.1.1	0xaf61	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:58:09.848903894 CET	192.168.2.18	1.1.1.1	0x4f34	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Jan 7, 2025 14:58:13.116854906 CET	192.168.2.18	1.1.1.1	0x195d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:58:13.116985083 CET	192.168.2.18	1.1.1.1	0x17a	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 14:58:09.213838100 CET	1.1.1.1	192.168.2.18	0x5412	No error (0)	ipfs.io		209.94.90.1	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:58:09.214409113 CET	1.1.1.1	192.168.2.18	0x21f9	No error (0)	ipfs.io			65	IN (0x0001)	false
Jan 7, 2025 14:58:09.851105928 CET	1.1.1.1	192.168.2.18	0x276c	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 14:58:09.851159096 CET	1.1.1.1	192.168.2.18	0xe58c	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 14:58:09.855535984 CET	1.1.1.1	192.168.2.18	0x4f34	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Jan 7, 2025 14:58:09.855546951 CET	1.1.1.1	192.168.2.18	0xaf61	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:58:09.855546951 CET	1.1.1.1	192.168.2.18	0xaf61	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:58:13.123507977 CET	1.1.1.1	192.168.2.18	0x195d	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:58:13.123644114 CET	1.1.1.1	192.168.2.18	0x17a	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

ipfs.io

https:

cdnjs.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.18	49698	209.94.90.1	443	3084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:58:09 UTC	797	OUT	GET /ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5 HTTP/1.1 Host: ipfs.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:58:09 UTC	1142	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:58:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close access-control-allow-headers: Content-Type access-control-allow-headers: Range access-control-allow-headers: User-Agent access-control-allow-headers: X-Requested-With access-control-allow-methods: GET access-control-allow-methods: HEAD access-control-allow-methods: OPTIONS access-control-allow-origin: * access-control-expose-headers: Content-Length access-control-expose-headers: Content-Range access-control-expose-headers: X-Chunked-Output access-control-expose-headers: X-Ipfs-Path access-control-expose-headers: X-Ipfs-Roots access-control-expose-headers: X-Stream-Output Cache-Control: public, max-age=29030400, immutable x-ipfs-path: /ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html x-ipfs-roots: bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4,bafkreia576wfjqbxfd7mjyxueng5punhko3ia2qixyazsqbnilohfhkdia x-ipfs-pop: rainbow-dc13-04 CF-Cache-Status: HIT Age: 12712 Server: cloudflare CF-RAY: 8fe4760709177286-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 13:58:09 UTC	227	IN	Data Raw: 37 62 33 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 69 6e 20 56 32 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 3c 21 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d Data Ascii: 7b3a<!DOCTYPE html><html lang="en"><head><title>Login V2</title><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1">...==================================================
2025-01-07 13:58:09 UTC	1369	IN	Data Raw: 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 2d 2d 3e 09 0d 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 69 64 3d 22 66 61 76 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 46 4d 41 41 41 42 56 43 41 59 41 41 41 41 31 36 39 67 64 41 41 41 41 42 47 64 42 54 55 45 41 41 4c 47 4f 66 50 74 52 6b 77 41 41 41 43 42 6a 53 46 4a 4e 41 41 43 48 44 77 41 41 6a 41 38 41 41 50 31 53 41 41 43 42 51 41 41 41 66 58 6b 41 41 4f 6d 4c 41 41 41 38 35 51 41 41 47 63 78 7a 50 49 56 33 41 41 41 4b Data Ascii: =============================================--><link rel="icon" id="favicon" type="image/png" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFMAAABVCAYAAAA169gdAAAABGdBTUEAALGOfPtRkwAAACBjSFJNAACHDwAAjA8AAP1SAACBQAAAfXkAAOmLAAA85QAAGcxzPIV3AAAK
2025-01-07 13:58:09 UTC	1369	IN	Data Raw: 68 51 46 41 75 31 42 72 55 65 56 59 4b 71 52 68 31 47 64 61 42 36 55 54 64 52 59 36 68 5a 31 45 63 30 47 61 32 49 31 6b 66 62 6f 4c 33 51 45 65 67 45 64 42 61 36 45 46 32 42 62 6b 4b 33 6f 79 2b 69 62 36 4d 6e 30 4b 38 78 47 41 77 4e 6f 34 32 78 77 6e 68 69 49 6a 46 4a 6d 4c 57 59 45 73 77 2b 54 42 76 6d 48 47 59 51 4d 34 36 5a 77 32 4b 78 38 6c 68 39 72 42 33 57 48 38 76 45 43 72 43 46 32 43 72 73 55 65 78 5a 37 42 42 32 41 76 73 47 52 38 53 70 34 4d 78 77 37 72 67 6f 48 41 2b 58 6a 36 76 41 48 63 47 64 77 51 33 68 4a 6e 45 4c 65 43 6d 38 4a 74 34 47 37 34 39 6e 34 33 50 77 70 66 68 47 66 44 66 2b 4f 6e 34 43 76 30 43 51 4a 6d 67 54 37 41 67 68 68 43 54 43 4a 6b 49 6c 6f 5a 56 77 6b 66 43 41 38 4a 4a 49 4a 4b 6f 52 72 59 6d 42 52 43 35 78 49 37 47 53 65 Data Ascii: hQFAu1BrUeVYKqRh1GdaB6UTdRY6hZ1Ec0Ga2I1kfboL3QEegEdBa6EF2BbkK3oy+ib6Mn0K8xGAwNo42xwnhiIjFJmLWYEsw+TBvmHGYQM46Zw2Kx8lh9rB3WH8vECrCF2CrsUexZ7BB2AvsGR8Sp4Mxw7rgoHA+Xj6vAHcGdwQ3hJnELeCm8Jt4G749n43PwpfhGfDf+On4Cv0CQJmgT7AghhCTCJkIloZVwkfCA8JJIJKoRrYmBRC5xI7GSe
2025-01-07 13:58:09 UTC	1369	IN	Data Raw: 47 6e 49 68 46 78 34 62 48 48 6f 6c 39 7a 2f 52 6e 4e 6a 44 6e 34 72 7a 69 61 75 4e 6d 57 53 36 73 76 61 78 6e 62 45 64 32 4f 58 75 61 59 38 63 70 34 30 7a 47 32 38 57 58 78 55 38 6c 32 43 58 73 54 70 68 4f 64 45 69 73 53 4a 7a 68 75 6e 43 72 75 53 2b 53 50 4a 50 71 6b 75 61 54 2f 5a 4d 50 4a 58 39 4b 43 55 39 70 53 38 57 6c 78 71 61 65 35 4d 6e 77 6b 6e 6d 39 61 63 70 70 32 57 6d 44 36 66 72 70 68 65 6d 6a 61 32 7a 57 37 46 6b 7a 79 2f 66 68 4e 32 56 41 47 61 73 79 75 67 52 55 30 63 39 55 76 31 42 48 75 45 55 34 6c 6d 6d 66 57 5a 50 35 4a 69 73 73 36 30 53 32 64 44 59 76 75 7a 39 48 4c 32 64 37 7a 6d 53 75 65 2b 36 33 61 31 46 72 57 57 74 37 38 6c 54 7a 4e 75 57 4e 72 58 4e 61 56 37 38 65 57 68 2b 33 76 6d 65 44 2b 6f 61 43 44 52 4d 62 50 54 59 65 33 6b Data Ascii: GnIhFx4bHHol9z/RnNjDn4rziauNmWS6svaxnbEd2OXuaY8cp40zG28WXxU8l2CXsTphOdEisSJzhunCruS+SPJPqkuaT/ZMPJX9KCU9pS8Wlxqae5Mnwknm9acpp2WmD6frphemja2zW7Fkzy/fhN2VAGasyugRU0c9Uv1BHuEU4lmmfWZP5Jiss60S2dDYvuz9HL2d7zmSue+63a1FrWWt78lTzNuWNrXNaV78eWh+3vmeD+oaCDRMbPTYe3k
2025-01-07 13:58:09 UTC	1369	IN	Data Raw: 4b 71 6a 7a 57 48 42 6a 6c 52 57 4e 31 54 62 55 31 33 68 52 35 62 52 69 69 6d 6f 68 73 52 59 6f 6c 74 79 44 4e 69 63 79 6f 79 54 6d 5a 4b 2b 47 51 45 6a 44 67 63 74 52 76 48 46 45 51 39 63 46 49 47 42 54 45 65 42 56 44 66 48 37 4b 4c 64 4c 4f 36 57 42 39 4d 55 75 4a 61 63 6d 62 56 44 34 6e 36 6f 6b 34 65 62 53 53 77 71 38 63 51 30 4c 70 77 44 33 7a 56 57 78 63 49 49 44 48 72 65 4b 57 56 55 71 48 48 49 42 68 6f 6d 63 79 44 77 65 69 4b 4a 39 32 31 6b 63 37 72 61 69 4a 32 37 44 45 62 4a 47 5a 30 54 53 79 6e 69 52 43 35 6b 2b 72 79 7a 4c 67 63 53 42 36 4e 2b 6d 64 4c 74 6b 53 54 75 55 65 42 78 30 55 73 79 6a 48 52 4f 74 4f 68 62 55 78 4e 48 57 55 6f 74 5a 58 6b 64 71 75 32 46 67 65 47 52 79 6b 36 43 6d 34 37 33 50 51 33 68 69 5a 7a 65 4f 39 4b 70 49 57 48 67 Data Ascii: KqjzWHBjlRWN1TbU13hR5bRiimohsRYoltyDNicyoyTmZK+GQEjDgctRvHFEQ9cFIGBTEeBVDfH7KLdLO6WB9MUuJacmbVD4n6ok4ebSSwq8cQ0LpwD3zVWxcIIDHreKWVUqHHIBhomcyDweiKJ921kc7raiJ27DEbJGZ0TSyniRC5k+ryzLgcSB6N+mdLtkSTuUeBx0UsyjHROtOhbUxNHWUotZXkdqu2FgeGRyk6Cm473PQ3hiZzeO9KpIWHg
2025-01-07 13:58:09 UTC	1369	IN	Data Raw: 70 43 4d 35 6a 41 37 6d 6a 65 36 77 6d 6a 62 37 49 65 46 62 57 2f 37 6f 67 2b 74 6c 43 69 50 58 52 47 6e 4d 38 67 65 4b 55 61 74 63 42 49 49 62 70 75 43 56 6e 5a 43 62 53 54 55 4d 63 6d 47 6c 37 59 48 38 4d 72 65 4d 44 36 6d 74 35 5a 4c 44 79 2f 74 32 4d 58 77 33 62 67 72 69 44 39 2b 46 45 49 64 32 37 74 2b 6d 51 38 74 30 78 78 35 6b 36 56 52 6b 35 6d 47 4e 4b 68 6c 71 68 33 50 4e 58 75 78 62 4c 34 4c 2f 7a 6b 55 78 70 6f 64 66 75 77 34 46 7a 58 30 71 5a 52 49 36 57 4d 55 54 32 2f 31 34 77 6a 44 2b 31 73 33 75 62 43 47 65 72 2b 30 4a 72 38 64 5a 68 34 50 52 55 4a 35 74 46 76 6f 6d 54 39 5a 35 4d 4b 6a 54 56 36 45 75 75 4e 6f 5a 7a 68 74 59 39 6f 52 4c 6f 47 4f 53 73 6a 32 70 76 58 78 41 7a 38 53 6f 54 6a 57 33 65 48 44 39 78 72 63 75 4e 35 6e 68 64 77 66 Data Ascii: pCM5jA7mje6wmjb7IeFbW/7og+tlCiPXRGnM8geKUatcBIIbpuCVnZCbSTUMcmGl7YH8MreMD6mt5ZLDy/t2MXw3bgriD9+FEId27t+mQ8t0xx5k6VRk5mGNKhlqh3PNXuxbL4L/zkUxpodfuw4FzX0qZRI6WMUT2/14wjD+1s3ubCGer+0Jr8dZh4PRUJ5tFvomT9Z5MKjTV6EuuNoZzhtY9oRLoGOSsj2pvXxAz8SoTjW3eHD9xrcuN5nhdwf
2025-01-07 13:58:09 UTC	1369	IN	Data Raw: 78 47 70 7a 73 62 71 62 65 58 73 75 35 2b 6d 68 6e 42 4e 32 39 32 34 7a 42 6c 34 36 6d 74 6b 6d 59 56 66 78 79 31 4b 47 53 4b 53 66 4a 75 35 54 59 4a 56 59 61 6a 7a 72 72 35 35 38 77 4c 4a 56 53 7a 35 59 56 47 63 73 39 65 2b 67 56 36 33 61 59 56 45 2f 43 61 65 4f 39 55 38 31 46 78 53 62 50 71 66 56 5a 38 6e 78 36 39 6c 74 76 4a 75 4b 58 55 35 36 4c 48 76 64 54 6c 59 6a 6c 70 77 63 6b 55 66 54 78 4a 34 39 37 35 4c 49 4b 31 4e 46 41 65 2b 5a 51 42 32 6a 75 70 6a 30 50 6c 68 55 4a 63 48 55 6c 71 6d 47 6a 44 66 49 62 2f 59 4d 6d 34 65 48 53 31 71 75 42 32 38 57 68 4b 67 54 46 2b 79 51 76 33 35 36 34 49 50 71 65 4f 5a 6b 75 31 38 6f 6d 43 6b 69 6d 36 74 5a 66 4a 39 63 74 37 77 2f 68 4e 52 77 44 75 47 69 76 61 36 44 6d 74 31 44 6e 52 75 30 46 34 48 44 46 55 38 Data Ascii: xGpzsbqbeXsu5+mhnBN2924zBl46mtkmYVfxy1KGSKSfJu5TYJVYajzrr558wLJVSz5YVGcs9e+gV63aYVE/CaeO9U81FxSbPqfVZ8nx69ltvJuKXU56LHvdTlYjlpwckUfTxJ4975LIK1NFAe+ZQB2jupj0PlhUJcHUlqmGjDfIb/YMm4eHS1quB28WhKgTF+yQv3564IPqeOZku18omCkim6tZfJ9ct7w/hNRwDuGiva6Dmt1DnRu0F4HDFU8
2025-01-07 13:58:09 UTC	1369	IN	Data Raw: 78 76 35 45 38 72 43 59 66 77 6b 73 32 5a 43 58 54 75 4d 4e 58 36 30 54 37 55 68 64 75 74 65 69 77 46 2b 50 47 63 78 6c 43 37 42 62 37 5a 52 35 4e 34 57 4f 77 4e 7a 61 79 6b 69 6c 51 57 54 61 31 31 50 6e 77 35 43 49 37 47 70 55 59 48 50 4a 45 31 48 6a 68 6c 48 61 4b 76 55 74 70 74 38 79 66 32 56 4a 58 52 54 37 4d 77 7a 75 4e 51 63 6c 6b 33 32 37 4d 61 4c 70 38 6a 68 65 50 4e 6c 68 51 47 77 6f 44 38 6d 4b 37 39 47 54 47 42 62 72 57 6d 4b 55 39 59 70 66 59 52 7a 76 46 58 72 46 37 65 5a 30 58 4c 6f 63 74 74 63 6b 67 47 49 4a 4d 4f 61 36 43 69 57 34 48 57 6d 65 6f 54 4f 59 74 54 4f 5a 31 4b 42 6f 39 4e 4d 6f 54 79 37 30 4c 67 39 52 72 41 47 4b 48 32 45 4f 37 78 44 34 66 37 57 79 6d 76 53 32 30 65 78 4c 74 4e 36 76 46 42 79 4a 6a 43 43 34 62 5a 46 62 54 6a 6e Data Ascii: xv5E8rCYfwks2ZCXTuMNX60T7UhduteiwF+PGcxlC7Bb7ZR5N4WOwNzaykilQWTa11Pnw5CI7GpUYHPJE1HjhlHaKvUtpt8yf2VJXRT7MwzuNQclk327MaLp8jhePNlhQGwoD8mK79GTGBbrWmKU9YpfYRzvFXrF7eZ0XLocttckgGIJMOa6CiW4HWmeoTOYtTOZ1KBo9NMoTy70Lg9RrAGKH2EO7xD4f7WymvS20exLtN6vFByJjCC4bZFbTjn
2025-01-07 13:58:09 UTC	1369	IN	Data Raw: 73 2d 31 30 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 31 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 31 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 31 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 31 34 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 31 35 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 31 36 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 31 37 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 37 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 31 38 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 7d Data Ascii: s-10 {font-size: 10px;}.fs-11 {font-size: 11px;}.fs-12 {font-size: 12px;}.fs-13 {font-size: 13px;}.fs-14 {font-size: 14px;}.fs-15 {font-size: 15px;}.fs-16 {font-size: 16px;}.fs-17 {font-size: 17px;}.fs-18 {font-size: 18px;}
2025-01-07 13:58:09 UTC	1369	IN	Data Raw: 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 37 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 35 38 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 38 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 35 39 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 39 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 36 30 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 36 30 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 36 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 36 31 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 36 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 36 32 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 36 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 36 33 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 36 34 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 36 34 70 78 3b 7d 0d 0a 09 09 2e 66 73 2d 36 35 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 36 35 70 78 3b 7d 0d 0a 09 09 2e 66 Data Ascii: font-size: 57px;}.fs-58 {font-size: 58px;}.fs-59 {font-size: 59px;}.fs-60 {font-size: 60px;}.fs-61 {font-size: 61px;}.fs-62 {font-size: 62px;}.fs-63 {font-size: 63px;}.fs-64 {font-size: 64px;}.fs-65 {font-size: 65px;}.f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.18	49703	104.17.24.14	443	3084	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:58:10 UTC	570	OUT	GET /ajax/libs/font-awesome/5.15.3/css/all.min.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://ipfs.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 13:58:10 UTC	947	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:58:10 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"6599bda5-317b" Last-Modified: Sat, 06 Jan 2024 21:52:53 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1140965 Expires: Sun, 28 Dec 2025 13:58:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZscO9FLD0Szu4UQgDnhUvzSVFWpc9Y%2F34hqwog007sLazH5A5ZOo3807MbWjDXPhCHVg2bgT65kbyrsoBiYcjGdS0ysF%2BnmRRjEjj5pa%2BStSS6YsLQwgfrNG6X%2B4gPZywzKqhmhj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8fe4760b1b750f69-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 13:58:10 UTC	422	IN	Data Raw: 33 39 38 36 0d 0a 2f 2a 21 0a 20 2a 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 46 72 65 65 20 35 2e 31 35 2e 33 20 62 79 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 20 2d 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 0a 20 2a 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 2f 66 72 65 65 20 28 49 63 6f 6e 73 3a 20 43 43 20 42 59 20 34 2e 30 2c 20 46 6f 6e 74 73 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 6f 64 65 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 0a 2e 66 61 2c 2e 66 61 62 2c 2e 66 61 64 2c 2e 66 61 6c 2c 2e 66 61 72 2c 2e 66 61 73 7b 2d 6d 6f 7a 2d 6f 73 78 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 67 72 61 79 73 63 61 6c 65 3b Data Ascii: 3986/! Font Awesome Free 5.15.3 by @fontawesome - https://fontawesome.com * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) */.fa,.fab,.fad,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;
2025-01-07 13:58:10 UTC	1369	IN	Data Raw: 2e 37 35 65 6d 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 2d 2e 30 36 36 37 65 6d 7d 2e 66 61 2d 78 73 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 2e 66 61 2d 73 6d 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 65 6d 7d 2e 66 61 2d 31 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 7d 2e 66 61 2d 32 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 65 6d 7d 2e 66 61 2d 33 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 65 6d 7d 2e 66 61 2d 34 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 65 6d 7d 2e 66 61 2d 35 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 35 65 6d 7d 2e 66 61 2d 36 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 36 65 6d 7d 2e 66 61 2d 37 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 37 65 6d 7d 2e 66 61 2d 38 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 38 65 6d 7d 2e 66 61 2d 39 78 7b 66 6f 6e Data Ascii: .75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{fon
2025-01-07 13:58:10 UTC	1369	IN	Data Raw: 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 31 29 22 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 39 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 39 30 64 65 67 29 7d 2e 66 61 2d 72 6f 74 61 74 65 2d 31 38 30 7b 2d 6d 73 2d 66 69 6c 74 65 72 3a 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 32 29 22 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 38 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 38 30 64 65 67 29 7d 2e 66 61 2d 72 6f 74 61 74 65 2d 32 37 30 7b 2d 6d 73 2d 66 69 6c 74 65 72 3a Data Ascii: osoft.BasicImage(rotation=1)";-webkit-transform:rotate(90deg);transform:rotate(90deg)}.fa-rotate-180{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2)";-webkit-transform:rotate(180deg);transform:rotate(180deg)}.fa-rotate-270{-ms-filter:
2025-01-07 13:58:10 UTC	1369	IN	Data Raw: 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 36 39 22 7d 2e 66 61 2d 61 63 71 75 69 73 69 74 69 6f 6e 73 2d 69 6e 63 6f 72 70 6f 72 61 74 65 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 36 61 66 22 7d 2e 66 61 2d 61 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 36 34 31 22 7d 2e 66 61 2d 61 64 64 72 65 73 73 2d 62 6f 6f 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 62 39 22 7d 2e 66 61 2d 61 64 64 72 65 73 73 2d 63 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 62 62 22 7d 2e 66 61 2d 61 64 6a 75 73 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 32 22 7d 2e 66 61 2d 61 64 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 37 30 22 7d 2e 66 61 2d 61 64 76 65 72 Data Ascii: e{content:"\f369"}.fa-acquisitions-incorporated:before{content:"\f6af"}.fa-ad:before{content:"\f641"}.fa-address-book:before{content:"\f2b9"}.fa-address-card:before{content:"\f2bb"}.fa-adjust:before{content:"\f042"}.fa-adn:before{content:"\f170"}.fa-adver
2025-01-07 13:58:10 UTC	1369	IN	Data Raw: 74 3a 22 5c 66 33 36 65 22 7d 2e 66 61 2d 61 6e 67 75 6c 61 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 32 30 22 7d 2e 66 61 2d 61 6e 6b 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 36 34 34 22 7d 2e 66 61 2d 61 70 70 2d 73 74 6f 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 36 66 22 7d 2e 66 61 2d 61 70 70 2d 73 74 6f 72 65 2d 69 6f 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 30 22 7d 2e 66 61 2d 61 70 70 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 31 22 7d 2e 66 61 2d 61 70 70 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 37 39 22 7d 2e 66 61 2d 61 70 70 6c 65 2d 61 6c 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 64 Data Ascii: t:"\f36e"}.fa-angular:before{content:"\f420"}.fa-ankh:before{content:"\f644"}.fa-app-store:before{content:"\f36f"}.fa-app-store-ios:before{content:"\f370"}.fa-apper:before{content:"\f371"}.fa-apple:before{content:"\f179"}.fa-apple-alt:before{content:"\f5d
2025-01-07 13:58:10 UTC	1369	IN	Data Raw: 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 39 65 22 7d 2e 66 61 2d 61 75 74 6f 70 72 65 66 69 78 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 31 63 22 7d 2e 66 61 2d 61 76 69 61 6e 65 78 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 34 22 7d 2e 66 61 2d 61 76 69 61 74 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 32 31 22 7d 2e 66 61 2d 61 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 35 39 22 7d 2e 66 61 2d 61 77 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 35 22 7d 2e 66 61 2d 62 61 62 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 37 37 63 22 7d 2e 66 61 2d 62 61 62 79 2d 63 61 72 72 69 61 67 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 Data Ascii: e{content:"\f29e"}.fa-autoprefixer:before{content:"\f41c"}.fa-avianex:before{content:"\f374"}.fa-aviato:before{content:"\f421"}.fa-award:before{content:"\f559"}.fa-aws:before{content:"\f375"}.fa-baby:before{content:"\f77c"}.fa-baby-carriage:before{content
2025-01-07 13:58:10 UTC	1369	IN	Data Raw: 63 75 72 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 35 62 22 7d 2e 66 61 2d 62 69 62 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 36 34 37 22 7d 2e 66 61 2d 62 69 63 79 63 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 30 36 22 7d 2e 66 61 2d 62 69 6b 69 6e 67 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 38 34 61 22 7d 2e 66 61 2d 62 69 6d 6f 62 6a 65 63 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 38 22 7d 2e 66 61 2d 62 69 6e 6f 63 75 6c 61 72 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 65 35 22 7d 2e 66 61 2d 62 69 6f 68 61 7a 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 37 38 30 22 7d 2e 66 61 2d 62 69 72 74 68 64 61 79 Data Ascii: curve:before{content:"\f55b"}.fa-bible:before{content:"\f647"}.fa-bicycle:before{content:"\f206"}.fa-biking:before{content:"\f84a"}.fa-bimobject:before{content:"\f378"}.fa-binoculars:before{content:"\f1e5"}.fa-biohazard:before{content:"\f780"}.fa-birthday
2025-01-07 13:58:10 UTC	1369	IN	Data Raw: 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 39 65 22 7d 2e 66 61 2d 62 6f 78 2d 74 69 73 73 75 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 35 62 22 7d 2e 66 61 2d 62 6f 78 65 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 36 38 22 7d 2e 66 61 2d 62 72 61 69 6c 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 61 31 22 7d 2e 66 61 2d 62 72 61 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 64 63 22 7d 2e 66 61 2d 62 72 65 61 64 2d 73 6c 69 63 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 37 65 63 22 7d 2e 66 61 2d 62 72 69 65 66 63 61 73 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 62 31 22 7d 2e 66 61 2d 62 72 69 65 66 63 61 73 65 2d 6d Data Ascii: n:before{content:"\f49e"}.fa-box-tissue:before{content:"\e05b"}.fa-boxes:before{content:"\f468"}.fa-braille:before{content:"\f2a1"}.fa-brain:before{content:"\f5dc"}.fa-bread-slice:before{content:"\f7ec"}.fa-briefcase:before{content:"\f0b1"}.fa-briefcase-m
2025-01-07 13:58:10 UTC	1369	IN	Data Raw: 74 3a 22 5c 66 37 38 35 22 7d 2e 66 61 2d 63 61 6e 64 79 2d 63 61 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 37 38 36 22 7d 2e 66 61 2d 63 61 6e 6e 61 62 69 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 35 66 22 7d 2e 66 61 2d 63 61 70 73 75 6c 65 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 36 62 22 7d 2e 66 61 2d 63 61 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 62 39 22 7d 2e 66 61 2d 63 61 72 2d 61 6c 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 64 65 22 7d 2e 66 61 2d 63 61 72 2d 62 61 74 74 65 72 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 64 66 22 7d 2e 66 61 2d 63 61 72 2d 63 72 61 73 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 Data Ascii: t:"\f785"}.fa-candy-cane:before{content:"\f786"}.fa-cannabis:before{content:"\f55f"}.fa-capsules:before{content:"\f46b"}.fa-car:before{content:"\f1b9"}.fa-car-alt:before{content:"\f5de"}.fa-car-battery:before{content:"\f5df"}.fa-car-crash:before{content:"
2025-01-07 13:58:10 UTC	1369	IN	Data Raw: 36 63 30 22 7d 2e 66 61 2d 63 68 61 6c 6b 62 6f 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 31 62 22 7d 2e 66 61 2d 63 68 61 6c 6b 62 6f 61 72 64 2d 74 65 61 63 68 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 31 63 22 7d 2e 66 61 2d 63 68 61 72 67 69 6e 67 2d 73 74 61 74 69 6f 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 65 37 22 7d 2e 66 61 2d 63 68 61 72 74 2d 61 72 65 61 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 66 65 22 7d 2e 66 61 2d 63 68 61 72 74 2d 62 61 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 38 30 22 7d 2e 66 61 2d 63 68 61 72 74 2d 6c 69 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 30 31 22 7d 2e 66 61 2d 63 68 61 72 74 Data Ascii: 6c0"}.fa-chalkboard:before{content:"\f51b"}.fa-chalkboard-teacher:before{content:"\f51c"}.fa-charging-station:before{content:"\f5e7"}.fa-chart-area:before{content:"\f1fe"}.fa-chart-bar:before{content:"\f080"}.fa-chart-line:before{content:"\f201"}.fa-chart

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 7004, Parent PID: 1884

General

Target ID:	0
Start time:	08:58:06
Start date:	07/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff728d30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3084, Parent PID: 7004

General

Target ID:	1
Start time:	08:58:07
Start date:	07/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1980,i,16925175573915758389,7470972905762602225,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff728d30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6452, Parent PID: 1884

General

Target ID:	3
Start time:	08:58:08
Start date:	07/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu"
Imagebase:	0x7ff728d30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 7004, Parent PID: 1884

General

Chronological Activities

Analysis Process: chrome.exePID: 3084, Parent PID: 7004

General

Windows Analysis Report
https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu