Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
http://premiumsub.hosted.phplist.com/

Overview

General Information

Sample URL:http://premiumsub.hosted.phplist.com/
Analysis ID:1589635
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Stores files to the Windows start menu directory
Uses insecure TLS / SSL version for HTTPS connection

Classification

  • System is w10x64
  • chrome.exe (PID: 3552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 2792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,14232661990823973390,9613493385920809493,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 5780 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://premiumsub.hosted.phplist.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: http://premiumsub.hosted.phplist.com/Avira URL Cloud: detection malicious, Label: phishing
Source: https://premiumsub.hosted.phplist.com/Avira URL Cloud: Label: phishing
Source: https://premiumsub.hosted.phplist.com/lists/Avira URL Cloud: Label: phishing
Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49728 version: TLS 1.0
Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49728 version: TLS 1.0
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: premiumsub.hosted.phplist.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /lists/ HTTP/1.1Host: premiumsub.hosted.phplist.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: SERVERID=pqserver1|Z4ROr|Z4ROr
Source: global trafficHTTP traffic detected: GET /images/3.6.12-hosted/power-phplist.png HTTP/1.1Host: d3u7tsw7cvar0t.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://premiumsub.hosted.phplist.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /spot HTTP/1.1Host: premium-plan.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://premiumsub.hosted.phplist.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /spot/ HTTP/1.1Host: premium-plan.appConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://premiumsub.hosted.phplist.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /images/3.6.12-hosted/power-phplist.png HTTP/1.1Host: d3u7tsw7cvar0t.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: premium-plan.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://premium-plan.app/spot/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=rd34udbhqjvt1dqck56fq73aoa
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: premiumsub.hosted.phplist.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: premiumsub.hosted.phplist.com
Source: global trafficDNS traffic detected: DNS query: premium-plan.app
Source: global trafficDNS traffic detected: DNS query: d3u7tsw7cvar0t.cloudfront.net
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 12 Jan 2025 23:22:23 GMTContent-Type: text/htmlContent-Length: 1035Connection: closeLast-Modified: Wed, 07 Feb 2024 18:32:55 GMTETag: "40b-610ceec5eb0a1"Accept-Ranges: bytes
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49997 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49997
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: classification engineClassification label: mal56.win@18/11@12/8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,14232661990823973390,9613493385920809493,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://premiumsub.hosted.phplist.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,14232661990823973390,9613493385920809493,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Google Drive.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder
1
Process Injection
1
Masquerading
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder
1
Process Injection
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media3
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive4
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
Ingress Tool Transfer
Traffic DuplicationData Destruction
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
http://premiumsub.hosted.phplist.com/100%Avira URL Cloudphishing
No Antivirus matches
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
https://premium-plan.app/spot0%Avira URL Cloudsafe
https://premium-plan.app/favicon.ico0%Avira URL Cloudsafe
https://premiumsub.hosted.phplist.com/100%Avira URL Cloudphishing
https://d3u7tsw7cvar0t.cloudfront.net/images/3.6.12-hosted/power-phplist.png0%Avira URL Cloudsafe
https://premiumsub.hosted.phplist.com/lists/100%Avira URL Cloudphishing
NameIPActiveMaliciousAntivirus DetectionReputation
aspen.phplist.com
45.33.29.14
truefalse
    unknown
    bg.microsoft.map.fastly.net
    199.232.214.172
    truefalse
      high
      d3u7tsw7cvar0t.cloudfront.net
      18.66.137.219
      truefalse
        high
        s-part-0017.t-0009.t-msedge.net
        13.107.246.45
        truefalse
          high
          www.google.com
          216.58.206.36
          truefalse
            high
            premium-plan.app
            45.88.108.231
            truefalse
              unknown
              fp2e7a.wpc.phicdn.net
              192.229.221.95
              truefalse
                high
                premiumsub.hosted.phplist.com
                unknown
                unknownfalse
                  unknown
                  NameMaliciousAntivirus DetectionReputation
                  https://premiumsub.hosted.phplist.com/false
                  • Avira URL Cloud: phishing
                  unknown
                  https://premium-plan.app/spotfalse
                  • Avira URL Cloud: safe
                  unknown
                  https://d3u7tsw7cvar0t.cloudfront.net/images/3.6.12-hosted/power-phplist.pngfalse
                  • Avira URL Cloud: safe
                  unknown
                  http://premiumsub.hosted.phplist.com/true
                    unknown
                    https://premium-plan.app/favicon.icofalse
                    • Avira URL Cloud: safe
                    unknown
                    https://premiumsub.hosted.phplist.com/lists/false
                    • Avira URL Cloud: phishing
                    unknown
                    https://premium-plan.app/spot/false
                      unknown
                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs
                      IPDomainCountryFlagASNASN NameMalicious
                      45.33.29.14
                      aspen.phplist.comUnited States
                      63949LINODE-APLinodeLLCUSfalse
                      216.58.206.36
                      www.google.comUnited States
                      15169GOOGLEUSfalse
                      18.66.137.198
                      unknownUnited States
                      3MIT-GATEWAYSUSfalse
                      239.255.255.250
                      unknownReserved
                      unknownunknownfalse
                      45.88.108.231
                      premium-plan.appGermany
                      44066DE-FIRSTCOLOwwwfirst-colonetDEfalse
                      18.66.137.219
                      d3u7tsw7cvar0t.cloudfront.netUnited States
                      3MIT-GATEWAYSUSfalse
                      IP
                      192.168.2.4
                      192.168.2.5
                      Joe Sandbox version:42.0.0 Malachite
                      Analysis ID:1589635
                      Start date and time:2025-01-13 00:21:18 +01:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 3m 16s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:browseurl.jbs
                      Sample URL:http://premiumsub.hosted.phplist.com/
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:7
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Detection:MAL
                      Classification:mal56.win@18/11@12/8
                      EGA Information:Failed
                      HCA Information:
                      • Successful, ratio: 100%
                      • Number of executed functions: 0
                      • Number of non-executed functions: 0
                      • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                      • Excluded IPs from analysis (whitelisted): 142.250.185.195, 74.125.133.84, 172.217.16.206, 142.250.181.238, 142.250.186.46, 216.58.212.174, 4.175.87.197, 199.232.214.172, 192.229.221.95, 52.165.164.15, 216.58.206.78, 142.250.184.238, 142.250.185.206, 142.250.185.78, 142.250.186.35, 34.104.35.123, 199.232.210.172, 216.58.206.46, 184.28.90.27, 13.107.246.45
                      • Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, redirector.gvt1.com, ocsp.digicert.com, edgedl.me.gvt1.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size getting too big, too many NtSetInformationFile calls found.
                      • VT rate limit hit for: http://premiumsub.hosted.phplist.com/
                      No simulations
                      No context
                      No context
                      No context
                      No context
                      No context
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Jan 12 22:22:13 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2677
                      Entropy (8bit):3.986102379108785
                      Encrypted:false
                      SSDEEP:48:8qdEToEMHUidAKZdA19ehwiZUklqeh+y+3:8Jnn9y
                      MD5:AB1DC719BF83E81C7EB2A38B3A1040F8
                      SHA1:D3B164E4FE9241070678F25F5598D20691F32C78
                      SHA-256:30353D03BFC931CB4FDB7E86330696A6442992F80F1C842170C2FA6F94305CE3
                      SHA-512:2D91C4AAA6D83840F3C197A93685F122798768CFBC38D43793EAB60BD6EE55F6CE127836F97DFCBFC315CA32D3FA99FF479191E0F681F0EF488FF4881713A7C8
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,.......He..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I,Z.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V,Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V,Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V,Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V,Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............0p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Jan 12 22:22:13 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2679
                      Entropy (8bit):4.002136316402016
                      Encrypted:false
                      SSDEEP:48:8YdEToEMHUidAKZdA1weh/iZUkAQkqehty+2:8fnN9QAy
                      MD5:4967FC195D31D856C93551D40382C682
                      SHA1:1F16C9A9FFD0CDFCF917E09AB128A26348937F94
                      SHA-256:DE3567C75586F15F91F53631DDFCD4D6DE7D0FED13F58151CAB098DC6B50452B
                      SHA-512:BFD45B718771FE64121BAB6EF842D48A4DAFEE94ADEE6845AFFFB7BEB1010A4CE4D36D971EAAFB8740CBED0E9864FE0FA3B0CB9157704A8912269CBD3BFC95E7
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,.......He..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I,Z.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V,Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V,Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V,Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V,Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............0p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2693
                      Entropy (8bit):4.0120708453406575
                      Encrypted:false
                      SSDEEP:48:8xNdEToEsHUidAKZdA14tseh7sFiZUkmgqeh7sHy+BX:8xEn9nBy
                      MD5:90D7EE13E79A1E5E6DFB643A0B6B9762
                      SHA1:6EF091F982D20E879760C6C4A71FFCD6713CF604
                      SHA-256:B2403F43561E67B99B65C69E55980CEDAB68D756881B41062CCB6F47C206818A
                      SHA-512:91BFB477210CA86E2436B5418985CF18599C8212AEE57979B82192DF13B72BF5E1D1089F24B81DB94F37E3961EBD8F9E444326A3BE16CBED4BF7C64128942CBA
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I,Z.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V,Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V,Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V,Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............0p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Jan 12 22:22:13 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2681
                      Entropy (8bit):3.998998580367697
                      Encrypted:false
                      SSDEEP:48:8zdEToEMHUidAKZdA1vehDiZUkwqehZy+R:8qnufy
                      MD5:0AEF565F9A57C90B943ADFD0408EF49A
                      SHA1:DCD5C26590439FEAA627283CB9659A98284EC29C
                      SHA-256:7EDE6B13057348FA5E8871A068011454C1AA5BF3ED0A6EAAC7FC7A58818018F9
                      SHA-512:410D81B7A7CC7906E552C8CF1275F45EB9D7E76180D81860881D5FBDD5FCFB4AEC24A366984AA782F3AFB1B9BC26D133DE919F59A72D17719E3AB09049848CF8
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,.....8..He..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I,Z.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V,Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V,Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V,Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V,Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............0p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Jan 12 22:22:13 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2681
                      Entropy (8bit):3.987207362224912
                      Encrypted:false
                      SSDEEP:48:86dEToEMHUidAKZdA1hehBiZUk1W1qehLy+C:8Zne9ry
                      MD5:73574B584260293413B2C527AC508A18
                      SHA1:0D332CDF6C17D63B97B8BEF900C075341F40E416
                      SHA-256:9BACC4E6C2157C5822D288A343404B48127D0C1CFC995E459A2E537889F3BD5C
                      SHA-512:C9D81F2074B3266676B9D0F88C3992E862651BAA29118596B27E42CF4C767DCE9D4B73081695602250E4669B3C951339FA6B8B9E6F834937FCCFE6EBAF736C1D
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,....e..He..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I,Z.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V,Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V,Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V,Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V,Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............0p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Jan 12 22:22:13 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2683
                      Entropy (8bit):4.000705227144021
                      Encrypted:false
                      SSDEEP:48:84dEToEMHUidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbBy+yT+:8/nAT/TbxWOvTbBy7T
                      MD5:062E493D17DDDE07FA113D1F260FCDFA
                      SHA1:99ED4EF84C165FE2EE536256B709118107373A14
                      SHA-256:FE03D6474FD93DB94E3FDD445144342894318064459A72D5CC577AA73888DAFE
                      SHA-512:0F7B206609F10038DE3131AA05A0262015A5410D3D636974CF408CC97954E7C0D7A64CA24FF8AF7D087F5B36D1BC2AB66707B52E8B4DCED298CA1B043523E349
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,........He..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I,Z.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V,Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V,Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V,Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V,Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............0p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:PNG image data, 72 x 40, 8-bit/color RGBA, interlaced
                      Category:dropped
                      Size (bytes):2135
                      Entropy (8bit):7.893094046491728
                      Encrypted:false
                      SSDEEP:48:qfPo1rQleuvgL2IFCBvStgjNvT4lGMdSPGb:qfPo2leujSivT4lGc
                      MD5:5021A64CDD02552A3EB08DE5A9254FD6
                      SHA1:68E9185DE4FD09A42FF3201E053F87DA703C1FBF
                      SHA-256:E97007E78654D70BEA69FD7E51047C1F4949B35D7CE26D49EB66C5BA42097F12
                      SHA-512:681481E8B62EBAA73D5E8FA81FF1DBD853413B60DBA6F6A1AAE27B933E0D6376BC4FA984D4A87FA184761AF8074D0B46B92A5C944E5F789094012540324B9192
                      Malicious:false
                      Reputation:low
                      Preview:.PNG........IHDR...H...(.....*.......pHYs...........~.....IDATh..OHUY... j......$..U.j`..@......]J.s.-bl.-\.F/.b.H... m.....c..3A<.Ks...}...{.{:iZ...;..{.....~...T.......s..M....)............N."O)b..lll4...fqq.;99i.........?[jtt4.cG"._..;;c`....#KJJl..d>..2/B.U..........}&''...1.W..."-988..;.....6%%%fbb".W[[..Q.....yy.T...o.e.<x`z{{.N.qBYY..u....>okk+MZe5%......G.......Z...B}}.....;66f***.}&...E....3]]]..j......U***........B;.............!TUU-.....H.....aI........-.>............+. .JY.....q+.h4..'O.........844d...0.....T.........>."........q..................sss.fJf1*.F^..'..X...o..eY].+c.7o.....p..!.q.v.gdee.YXX.._.p......+V+..s...=...g......%.C..k.(...~...0.===.....cHT..Qs'.Z$An... ...3..../..W..D......c"..0Y..b......E.\...../...(.I:..'.Y.b.2.P....1.........z......8p..w.b..Z..g.-.......o..........t:=d.q.I. .......b.n.^.|i....{.`d.q..&B..uSS.=.q.)<kmm.5fF..".[..G............7.0..'I.......f.O.nkk...\5....^(....}.1...\.0...?..J..*...
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:HTML document, ASCII text
                      Category:downloaded
                      Size (bytes):1035
                      Entropy (8bit):4.93101530239688
                      Encrypted:false
                      SSDEEP:24:Dvuow2e1ZjUDp9lMpacORQMAozSfHxtefn/My3jzpH:Dvuo8HklMkcORNSfHLefn0wjR
                      MD5:011E1FE3C5EB97AC9082C06C5126BCCF
                      SHA1:EBBDC145D84DB75FB1B2A7CF24FDC33E30A31E34
                      SHA-256:6A84E93168C1D3F2CD4EF9D1EC9E3A3E1B816B9EFBC019DC56A34A2040FCA9BB
                      SHA-512:7572BEE43BB8ECE4B65BB8C3CE8D49B99018BB0FBE0566248F4B13AE4087ED49558A8A089F852A8B9469D30F62C5E601893C5FE57294BD11186334F7D145C9A2
                      Malicious:false
                      Reputation:low
                      URL:https://premium-plan.app/favicon.ico
                      Preview:<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<BASE href="/error_docs/"> [if lte IE 6]></BASE><![endif]-->.</HEAD>.<BODY>.<H1>Not Found</H1>.The requested document was not found on this server..<P>.<HR>.<ADDRESS>.Web Server at 24450-6282.s1.webspace.re.</ADDRESS>.</BODY>.</HTML>.. . - Unfortunately, Microsoft has added a clever new. - "feature" to Internet Explorer. If the text of. - an error's message is "too small", specifically. - less than 512 bytes, Internet Explorer returns. - its own error message. You can turn that off,. - but it's pretty tricky to find switch called. - "smart error messages". That means, of course,. - that short error messages are censored by default.. - IIS always returns error messages that are long. - enough to make Internet Explorer happy. The. - workaround is pretty simple: pad the error. - message with a big comment like this to push it. - over the five hundred and twelve bytes minimum.. - Of course, that's exactly what you
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:PNG image data, 72 x 40, 8-bit/color RGBA, interlaced
                      Category:downloaded
                      Size (bytes):2135
                      Entropy (8bit):7.893094046491728
                      Encrypted:false
                      SSDEEP:48:qfPo1rQleuvgL2IFCBvStgjNvT4lGMdSPGb:qfPo2leujSivT4lGc
                      MD5:5021A64CDD02552A3EB08DE5A9254FD6
                      SHA1:68E9185DE4FD09A42FF3201E053F87DA703C1FBF
                      SHA-256:E97007E78654D70BEA69FD7E51047C1F4949B35D7CE26D49EB66C5BA42097F12
                      SHA-512:681481E8B62EBAA73D5E8FA81FF1DBD853413B60DBA6F6A1AAE27B933E0D6376BC4FA984D4A87FA184761AF8074D0B46B92A5C944E5F789094012540324B9192
                      Malicious:false
                      Reputation:low
                      URL:https://d3u7tsw7cvar0t.cloudfront.net/images/3.6.12-hosted/power-phplist.png
                      Preview:.PNG........IHDR...H...(.....*.......pHYs...........~.....IDATh..OHUY... j......$..U.j`..@......]J.s.-bl.-\.F/.b.H... m.....c..3A<.Ks...}...{.{:iZ...;..{.....~...T.......s..M....)............N."O)b..lll4...fqq.;99i.........?[jtt4.cG"._..;;c`....#KJJl..d>..2/B.U..........}&''...1.W..."-988..;.....6%%%fbb".W[[..Q.....yy.T...o.e.<x`z{{.N.qBYY..u....>okk+MZe5%......G.......Z...B}}.....;66f***.}&...E....3]]]..j......U***........B;.............!TUU-.....H.....aI........-.>............+. .JY.....q+.h4..'O.........844d...0.....T.........>."........q..................sss.fJf1*.F^..'..X...o..eY].+c.7o.....p..!.q.v.gdee.YXX.._.p......+V+..s...=...g......%.C..k.(...~...0.===.....cHT..Qs'.Z$An... ...3..../..W..D......c"..0Y..b......E.\...../...(.I:..'.Y.b.2.P....1.........z......8p..w.b..Z..g.-.......o..........t:=d.q.I. .......b.n.^.|i....{.`d.q..&B..uSS.=.q.)<kmm.5fF..".[..G............7.0..'I.......f.O.nkk...\5....^(....}.1...\.0...?..J..*...
                      No static file info
                      TimestampSource PortDest PortSource IPDest IP
                      Jan 13, 2025 00:22:04.885035038 CET49674443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:04.885035992 CET49675443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:04.978636980 CET49673443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:14.488859892 CET49674443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:14.488866091 CET49675443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:14.582540035 CET49673443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:16.124890089 CET49712443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:22:16.124919891 CET44349712216.58.206.36192.168.2.5
                      Jan 13, 2025 00:22:16.125107050 CET49712443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:22:16.125576019 CET49712443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:22:16.125587940 CET44349712216.58.206.36192.168.2.5
                      Jan 13, 2025 00:22:16.233571053 CET4434970323.1.237.91192.168.2.5
                      Jan 13, 2025 00:22:16.233688116 CET49703443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:16.795392036 CET44349712216.58.206.36192.168.2.5
                      Jan 13, 2025 00:22:16.795721054 CET49712443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:22:16.795732021 CET44349712216.58.206.36192.168.2.5
                      Jan 13, 2025 00:22:16.796605110 CET44349712216.58.206.36192.168.2.5
                      Jan 13, 2025 00:22:16.796664953 CET49712443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:22:17.060957909 CET49712443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:22:17.061126947 CET44349712216.58.206.36192.168.2.5
                      Jan 13, 2025 00:22:17.113135099 CET49712443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:22:17.113147974 CET44349712216.58.206.36192.168.2.5
                      Jan 13, 2025 00:22:17.160032034 CET49712443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:22:18.209544897 CET4971580192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:18.214396954 CET804971545.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:18.214972019 CET4971580192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:18.215349913 CET4971580192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:18.220171928 CET804971545.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:18.614420891 CET4971680192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:18.619533062 CET804971645.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:18.619606018 CET4971680192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:18.793946028 CET804971545.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:18.837513924 CET4971580192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:19.419677973 CET49717443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:19.419733047 CET4434971745.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:19.419816017 CET49717443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:19.420092106 CET49718443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:19.420164108 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:19.420224905 CET49718443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:19.658909082 CET49718443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:19.658957958 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:19.662918091 CET49717443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:19.662951946 CET4434971745.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.207668066 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.207942009 CET49718443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.207967043 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.208292961 CET4434971745.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.209064007 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.209125042 CET49718443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.209491014 CET49717443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.209547043 CET4434971745.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.210666895 CET4434971745.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.210736990 CET49717443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.214230061 CET49717443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.214315891 CET4434971745.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.214490891 CET49717443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.214509010 CET4434971745.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.215969086 CET49718443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.216056108 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.258225918 CET49717443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.258239031 CET49718443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.258253098 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.302051067 CET49718443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.368603945 CET4434971745.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.368671894 CET4434971745.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.368730068 CET49717443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.369155884 CET49717443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.369184971 CET4434971745.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.371027946 CET49718443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.411339998 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.624537945 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.624562979 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.624627113 CET49718443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.624655008 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.624669075 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.624701977 CET49718443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.671096087 CET49718443192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:20.671132088 CET4434971845.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:20.720882893 CET49719443192.168.2.518.66.137.219
                      Jan 13, 2025 00:22:20.720912933 CET4434971918.66.137.219192.168.2.5
                      Jan 13, 2025 00:22:20.720971107 CET49719443192.168.2.518.66.137.219
                      Jan 13, 2025 00:22:20.721210003 CET49719443192.168.2.518.66.137.219
                      Jan 13, 2025 00:22:20.721224070 CET4434971918.66.137.219192.168.2.5
                      Jan 13, 2025 00:22:20.955138922 CET49720443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:20.955210924 CET4434972045.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:20.955495119 CET49720443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:20.955620050 CET49721443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:20.955657959 CET4434972145.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:20.955707073 CET49721443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:20.955969095 CET49720443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:20.955993891 CET4434972045.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:20.956188917 CET49721443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:20.956207991 CET4434972145.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.476598978 CET4434971918.66.137.219192.168.2.5
                      Jan 13, 2025 00:22:21.476874113 CET49719443192.168.2.518.66.137.219
                      Jan 13, 2025 00:22:21.476916075 CET4434971918.66.137.219192.168.2.5
                      Jan 13, 2025 00:22:21.478524923 CET4434971918.66.137.219192.168.2.5
                      Jan 13, 2025 00:22:21.478590965 CET49719443192.168.2.518.66.137.219
                      Jan 13, 2025 00:22:21.479710102 CET49719443192.168.2.518.66.137.219
                      Jan 13, 2025 00:22:21.479779005 CET4434971918.66.137.219192.168.2.5
                      Jan 13, 2025 00:22:21.480015039 CET49719443192.168.2.518.66.137.219
                      Jan 13, 2025 00:22:21.480024099 CET4434971918.66.137.219192.168.2.5
                      Jan 13, 2025 00:22:21.520684958 CET49719443192.168.2.518.66.137.219
                      Jan 13, 2025 00:22:21.644473076 CET4434972145.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.646903038 CET49721443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.646924973 CET4434972145.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.647994995 CET4434972145.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.648071051 CET49721443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.649408102 CET49721443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.649470091 CET4434972145.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.649796963 CET49721443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.649810076 CET4434972145.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.659444094 CET4434972045.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.660702944 CET49720443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.660717964 CET4434972045.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.661803961 CET4434972045.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.661864042 CET49720443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.662292004 CET49720443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.662348032 CET4434972045.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.693305969 CET49721443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.708754063 CET49720443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.708767891 CET4434972045.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.755919933 CET49720443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.919059038 CET4434972145.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.919152975 CET4434972145.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.919305086 CET49721443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.919708014 CET49721443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.919723034 CET4434972145.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:21.922923088 CET49720443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:21.963351011 CET4434972045.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:22.073704958 CET4434971918.66.137.219192.168.2.5
                      Jan 13, 2025 00:22:22.073725939 CET4434971918.66.137.219192.168.2.5
                      Jan 13, 2025 00:22:22.073800087 CET4434971918.66.137.219192.168.2.5
                      Jan 13, 2025 00:22:22.073852062 CET49719443192.168.2.518.66.137.219
                      Jan 13, 2025 00:22:22.073889971 CET49719443192.168.2.518.66.137.219
                      Jan 13, 2025 00:22:22.189178944 CET49719443192.168.2.518.66.137.219
                      Jan 13, 2025 00:22:22.189229012 CET4434971918.66.137.219192.168.2.5
                      Jan 13, 2025 00:22:22.222110987 CET49722443192.168.2.518.66.137.198
                      Jan 13, 2025 00:22:22.222163916 CET4434972218.66.137.198192.168.2.5
                      Jan 13, 2025 00:22:22.222254038 CET49722443192.168.2.518.66.137.198
                      Jan 13, 2025 00:22:22.222475052 CET49722443192.168.2.518.66.137.198
                      Jan 13, 2025 00:22:22.222489119 CET4434972218.66.137.198192.168.2.5
                      Jan 13, 2025 00:22:22.482008934 CET4434972045.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:22.482105017 CET4434972045.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:22.482180119 CET49720443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:22.483176947 CET49720443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:22.483205080 CET4434972045.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:22.556126118 CET49723443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:22.556178093 CET4434972345.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:22.556245089 CET49723443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:22.556548119 CET49723443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:22.556565046 CET4434972345.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:22.945295095 CET4434972218.66.137.198192.168.2.5
                      Jan 13, 2025 00:22:22.945669889 CET49722443192.168.2.518.66.137.198
                      Jan 13, 2025 00:22:22.945696115 CET4434972218.66.137.198192.168.2.5
                      Jan 13, 2025 00:22:22.946871042 CET4434972218.66.137.198192.168.2.5
                      Jan 13, 2025 00:22:22.946937084 CET49722443192.168.2.518.66.137.198
                      Jan 13, 2025 00:22:22.947393894 CET49722443192.168.2.518.66.137.198
                      Jan 13, 2025 00:22:22.947463036 CET4434972218.66.137.198192.168.2.5
                      Jan 13, 2025 00:22:22.947650909 CET49722443192.168.2.518.66.137.198
                      Jan 13, 2025 00:22:22.947657108 CET4434972218.66.137.198192.168.2.5
                      Jan 13, 2025 00:22:23.003825903 CET49722443192.168.2.518.66.137.198
                      Jan 13, 2025 00:22:23.218900919 CET4434972218.66.137.198192.168.2.5
                      Jan 13, 2025 00:22:23.218919039 CET4434972218.66.137.198192.168.2.5
                      Jan 13, 2025 00:22:23.218975067 CET49722443192.168.2.518.66.137.198
                      Jan 13, 2025 00:22:23.218990088 CET4434972218.66.137.198192.168.2.5
                      Jan 13, 2025 00:22:23.219029903 CET49722443192.168.2.518.66.137.198
                      Jan 13, 2025 00:22:23.227231026 CET4434972345.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:23.239846945 CET49723443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:23.239861012 CET4434972345.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:23.240258932 CET4434972345.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:23.241055965 CET49723443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:23.241122007 CET4434972345.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:23.241676092 CET49723443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:23.267318010 CET49722443192.168.2.518.66.137.198
                      Jan 13, 2025 00:22:23.267339945 CET4434972218.66.137.198192.168.2.5
                      Jan 13, 2025 00:22:23.287324905 CET4434972345.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:23.512128115 CET4434972345.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:23.512218952 CET4434972345.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:23.512862921 CET49723443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:23.514245987 CET49723443192.168.2.545.88.108.231
                      Jan 13, 2025 00:22:23.514256954 CET4434972345.88.108.231192.168.2.5
                      Jan 13, 2025 00:22:23.796315908 CET804971545.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:23.796796083 CET4971580192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:24.271281958 CET4971580192.168.2.545.33.29.14
                      Jan 13, 2025 00:22:24.276196003 CET804971545.33.29.14192.168.2.5
                      Jan 13, 2025 00:22:26.734697104 CET44349712216.58.206.36192.168.2.5
                      Jan 13, 2025 00:22:26.734834909 CET44349712216.58.206.36192.168.2.5
                      Jan 13, 2025 00:22:26.735017061 CET49712443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:22:27.264678955 CET49703443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:27.264751911 CET49703443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:27.265007019 CET49728443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:27.265043974 CET4434972823.1.237.91192.168.2.5
                      Jan 13, 2025 00:22:27.265120029 CET49728443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:27.265671968 CET49728443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:27.265686989 CET4434972823.1.237.91192.168.2.5
                      Jan 13, 2025 00:22:27.269821882 CET4434970323.1.237.91192.168.2.5
                      Jan 13, 2025 00:22:27.269838095 CET4434970323.1.237.91192.168.2.5
                      Jan 13, 2025 00:22:27.859193087 CET4434972823.1.237.91192.168.2.5
                      Jan 13, 2025 00:22:27.859253883 CET49728443192.168.2.523.1.237.91
                      Jan 13, 2025 00:22:28.482528925 CET49712443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:22:28.482553005 CET44349712216.58.206.36192.168.2.5
                      Jan 13, 2025 00:22:47.006331921 CET4434972823.1.237.91192.168.2.5
                      Jan 13, 2025 00:22:47.006386042 CET49728443192.168.2.523.1.237.91
                      Jan 13, 2025 00:23:03.628864050 CET4971680192.168.2.545.33.29.14
                      Jan 13, 2025 00:23:03.635025024 CET804971645.33.29.14192.168.2.5
                      Jan 13, 2025 00:23:16.336601019 CET49997443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:23:16.336649895 CET44349997216.58.206.36192.168.2.5
                      Jan 13, 2025 00:23:16.336718082 CET49997443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:23:16.337110996 CET49997443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:23:16.337136030 CET44349997216.58.206.36192.168.2.5
                      Jan 13, 2025 00:23:16.995547056 CET44349997216.58.206.36192.168.2.5
                      Jan 13, 2025 00:23:16.995807886 CET49997443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:23:16.995826960 CET44349997216.58.206.36192.168.2.5
                      Jan 13, 2025 00:23:16.996263981 CET44349997216.58.206.36192.168.2.5
                      Jan 13, 2025 00:23:16.997263908 CET49997443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:23:16.997344971 CET44349997216.58.206.36192.168.2.5
                      Jan 13, 2025 00:23:17.046564102 CET49997443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:23:19.046130896 CET804971645.33.29.14192.168.2.5
                      Jan 13, 2025 00:23:19.046221972 CET804971645.33.29.14192.168.2.5
                      Jan 13, 2025 00:23:19.046274900 CET4971680192.168.2.545.33.29.14
                      Jan 13, 2025 00:23:19.941051960 CET4971680192.168.2.545.33.29.14
                      Jan 13, 2025 00:23:19.941096067 CET4971680192.168.2.545.33.29.14
                      Jan 13, 2025 00:23:19.946043015 CET804971645.33.29.14192.168.2.5
                      Jan 13, 2025 00:23:19.946110010 CET4971680192.168.2.545.33.29.14
                      Jan 13, 2025 00:23:26.895117044 CET44349997216.58.206.36192.168.2.5
                      Jan 13, 2025 00:23:26.895414114 CET44349997216.58.206.36192.168.2.5
                      Jan 13, 2025 00:23:26.895478964 CET49997443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:23:27.945120096 CET49997443192.168.2.5216.58.206.36
                      Jan 13, 2025 00:23:27.945163012 CET44349997216.58.206.36192.168.2.5
                      TimestampSource PortDest PortSource IPDest IP
                      Jan 13, 2025 00:22:11.536170006 CET53522891.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:11.573717117 CET53615221.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:12.574688911 CET53646971.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:16.108284950 CET6107053192.168.2.51.1.1.1
                      Jan 13, 2025 00:22:16.108834982 CET5669753192.168.2.51.1.1.1
                      Jan 13, 2025 00:22:16.114861012 CET53610701.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:16.115560055 CET53566971.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:17.717482090 CET5137953192.168.2.51.1.1.1
                      Jan 13, 2025 00:22:17.718257904 CET6093953192.168.2.51.1.1.1
                      Jan 13, 2025 00:22:18.205513000 CET53513791.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:18.208868980 CET53609391.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:18.796459913 CET6454753192.168.2.51.1.1.1
                      Jan 13, 2025 00:22:18.796681881 CET6335253192.168.2.51.1.1.1
                      Jan 13, 2025 00:22:19.046550989 CET53645471.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:19.283750057 CET53633521.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:20.700251102 CET5926853192.168.2.51.1.1.1
                      Jan 13, 2025 00:22:20.700783014 CET5062553192.168.2.51.1.1.1
                      Jan 13, 2025 00:22:20.701246977 CET6494853192.168.2.51.1.1.1
                      Jan 13, 2025 00:22:20.701522112 CET4970653192.168.2.51.1.1.1
                      Jan 13, 2025 00:22:20.714344978 CET53649481.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:20.724389076 CET53497061.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:20.953380108 CET53506251.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:20.954459906 CET53592681.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:22.197289944 CET6398153192.168.2.51.1.1.1
                      Jan 13, 2025 00:22:22.197427034 CET4976453192.168.2.51.1.1.1
                      Jan 13, 2025 00:22:22.206578016 CET53497641.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:22.221483946 CET53639811.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:30.387847900 CET53506231.1.1.1192.168.2.5
                      Jan 13, 2025 00:22:49.559896946 CET53627741.1.1.1192.168.2.5
                      Jan 13, 2025 00:23:11.452260971 CET53545321.1.1.1192.168.2.5
                      Jan 13, 2025 00:23:11.918427944 CET53552311.1.1.1192.168.2.5
                      TimestampSource IPDest IPChecksumCodeType
                      Jan 13, 2025 00:22:20.724476099 CET192.168.2.51.1.1.1c249(Port unreachable)Destination Unreachable
                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                      Jan 13, 2025 00:22:16.108284950 CET192.168.2.51.1.1.10xc8beStandard query (0)www.google.comA (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:16.108834982 CET192.168.2.51.1.1.10x180fStandard query (0)www.google.com65IN (0x0001)false
                      Jan 13, 2025 00:22:17.717482090 CET192.168.2.51.1.1.10xb30fStandard query (0)premiumsub.hosted.phplist.comA (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:17.718257904 CET192.168.2.51.1.1.10xb7e0Standard query (0)premiumsub.hosted.phplist.com65IN (0x0001)false
                      Jan 13, 2025 00:22:18.796459913 CET192.168.2.51.1.1.10x463Standard query (0)premiumsub.hosted.phplist.comA (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:18.796681881 CET192.168.2.51.1.1.10x3b34Standard query (0)premiumsub.hosted.phplist.com65IN (0x0001)false
                      Jan 13, 2025 00:22:20.700251102 CET192.168.2.51.1.1.10x3111Standard query (0)premium-plan.appA (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:20.700783014 CET192.168.2.51.1.1.10xcafbStandard query (0)premium-plan.app65IN (0x0001)false
                      Jan 13, 2025 00:22:20.701246977 CET192.168.2.51.1.1.10xb6f3Standard query (0)d3u7tsw7cvar0t.cloudfront.netA (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:20.701522112 CET192.168.2.51.1.1.10x31ceStandard query (0)d3u7tsw7cvar0t.cloudfront.net65IN (0x0001)false
                      Jan 13, 2025 00:22:22.197289944 CET192.168.2.51.1.1.10x60d2Standard query (0)d3u7tsw7cvar0t.cloudfront.netA (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:22.197427034 CET192.168.2.51.1.1.10xcdcbStandard query (0)d3u7tsw7cvar0t.cloudfront.net65IN (0x0001)false
                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                      Jan 13, 2025 00:22:16.114861012 CET1.1.1.1192.168.2.50xc8beNo error (0)www.google.com216.58.206.36A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:16.115560055 CET1.1.1.1192.168.2.50x180fNo error (0)www.google.com65IN (0x0001)false
                      Jan 13, 2025 00:22:18.205513000 CET1.1.1.1192.168.2.50xb30fNo error (0)premiumsub.hosted.phplist.comaspen.phplist.comCNAME (Canonical name)IN (0x0001)false
                      Jan 13, 2025 00:22:18.205513000 CET1.1.1.1192.168.2.50xb30fNo error (0)aspen.phplist.com45.33.29.14A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:18.208868980 CET1.1.1.1192.168.2.50xb7e0No error (0)premiumsub.hosted.phplist.comaspen.phplist.comCNAME (Canonical name)IN (0x0001)false
                      Jan 13, 2025 00:22:19.046550989 CET1.1.1.1192.168.2.50x463No error (0)premiumsub.hosted.phplist.comaspen.phplist.comCNAME (Canonical name)IN (0x0001)false
                      Jan 13, 2025 00:22:19.046550989 CET1.1.1.1192.168.2.50x463No error (0)aspen.phplist.com45.33.29.14A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:19.283750057 CET1.1.1.1192.168.2.50x3b34No error (0)premiumsub.hosted.phplist.comaspen.phplist.comCNAME (Canonical name)IN (0x0001)false
                      Jan 13, 2025 00:22:20.714344978 CET1.1.1.1192.168.2.50xb6f3No error (0)d3u7tsw7cvar0t.cloudfront.net18.66.137.219A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:20.714344978 CET1.1.1.1192.168.2.50xb6f3No error (0)d3u7tsw7cvar0t.cloudfront.net18.66.137.95A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:20.714344978 CET1.1.1.1192.168.2.50xb6f3No error (0)d3u7tsw7cvar0t.cloudfront.net18.66.137.198A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:20.714344978 CET1.1.1.1192.168.2.50xb6f3No error (0)d3u7tsw7cvar0t.cloudfront.net18.66.137.77A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:20.954459906 CET1.1.1.1192.168.2.50x3111No error (0)premium-plan.app45.88.108.231A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:22.221483946 CET1.1.1.1192.168.2.50x60d2No error (0)d3u7tsw7cvar0t.cloudfront.net18.66.137.198A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:22.221483946 CET1.1.1.1192.168.2.50x60d2No error (0)d3u7tsw7cvar0t.cloudfront.net18.66.137.95A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:22.221483946 CET1.1.1.1192.168.2.50x60d2No error (0)d3u7tsw7cvar0t.cloudfront.net18.66.137.77A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:22.221483946 CET1.1.1.1192.168.2.50x60d2No error (0)d3u7tsw7cvar0t.cloudfront.net18.66.137.219A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:25.893004894 CET1.1.1.1192.168.2.50xdc17No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:25.893004894 CET1.1.1.1192.168.2.50xdc17No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:26.462310076 CET1.1.1.1192.168.2.50xa124No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                      Jan 13, 2025 00:22:26.462310076 CET1.1.1.1192.168.2.50xa124No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:27.722994089 CET1.1.1.1192.168.2.50x7a60No error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.nets-part-0017.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                      Jan 13, 2025 00:22:27.722994089 CET1.1.1.1192.168.2.50x7a60No error (0)s-part-0017.t-0009.t-msedge.net13.107.246.45A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:22:45.464906931 CET1.1.1.1192.168.2.50x5177No error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.nets-part-0017.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                      Jan 13, 2025 00:22:45.464906931 CET1.1.1.1192.168.2.50x5177No error (0)s-part-0017.t-0009.t-msedge.net13.107.246.45A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:23:04.760251045 CET1.1.1.1192.168.2.50x245aNo error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.nets-part-0017.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                      Jan 13, 2025 00:23:04.760251045 CET1.1.1.1192.168.2.50x245aNo error (0)s-part-0017.t-0009.t-msedge.net13.107.246.45A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:23:24.480407953 CET1.1.1.1192.168.2.50x7863No error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.nets-part-0017.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                      Jan 13, 2025 00:23:24.480407953 CET1.1.1.1192.168.2.50x7863No error (0)s-part-0017.t-0009.t-msedge.net13.107.246.45A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:23:28.121700048 CET1.1.1.1192.168.2.50x7991No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                      Jan 13, 2025 00:23:28.121700048 CET1.1.1.1192.168.2.50x7991No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                      • premiumsub.hosted.phplist.com
                      • https:
                        • d3u7tsw7cvar0t.cloudfront.net
                        • premium-plan.app
                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.54971545.33.29.14802792C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      Jan 13, 2025 00:22:18.215349913 CET444OUTGET / HTTP/1.1
                      Host: premiumsub.hosted.phplist.com
                      Connection: keep-alive
                      Upgrade-Insecure-Requests: 1
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                      Accept-Encoding: gzip, deflate
                      Accept-Language: en-US,en;q=0.9
                      Jan 13, 2025 00:22:18.793946028 CET103INHTTP/1.1 301 Moved Permanently
                      content-length: 0
                      location: https://premiumsub.hosted.phplist.com/


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      1192.168.2.54971645.33.29.14802792C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      Jan 13, 2025 00:23:03.628864050 CET6OUTData Raw: 00
                      Data Ascii:
                      Jan 13, 2025 00:23:19.046130896 CET233INHTTP/1.1 408 Request Time-out
                      Content-length: 110
                      Cache-Control: no-cache
                      Connection: close
                      Content-Type: text/html
                      Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 69 64 6e 27 74 20 73 65 6e 64 20 61 20 63 6f 6d 70 6c 65 74 65 20 72 65 71 75 65 73 74 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                      Data Ascii: <html><body><h1>408 Request Time-out</h1>Your browser didn't send a complete request in time.</body></html>


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.54971745.33.29.144432792C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2025-01-12 23:22:20 UTC672OUTGET / HTTP/1.1
                      Host: premiumsub.hosted.phplist.com
                      Connection: keep-alive
                      Upgrade-Insecure-Requests: 1
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                      Sec-Fetch-Site: none
                      Sec-Fetch-Mode: navigate
                      Sec-Fetch-User: ?1
                      Sec-Fetch-Dest: document
                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                      sec-ch-ua-mobile: ?0
                      sec-ch-ua-platform: "Windows"
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      2025-01-12 23:22:20 UTC328INHTTP/1.1 301 Moved Permanently
                      date: Sun, 12 Jan 2025 23:22:20 GMT
                      server: Apache/2.4.38 (Debian)
                      location: https://premiumsub.hosted.phplist.com/lists/
                      content-length: 347
                      content-type: text/html; charset=iso-8859-1
                      set-cookie: SERVERID=pqserver1|Z4ROr|Z4ROr; path=/; HttpOnly; Secure; SameSite=Lax
                      connection: close
                      2025-01-12 23:22:20 UTC347INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 72 65 6d 69 75 6d 73 75 62 2e 68 6f 73 74 65 64 2e 70 68 70 6c 69 73 74 2e 63 6f 6d 2f 6c 69 73 74 73 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63
                      Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://premiumsub.hosted.phplist.com/lists/">here</a>.</p><hr><address>Apac


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      1192.168.2.54971845.33.29.144432792C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2025-01-12 23:22:20 UTC718OUTGET /lists/ HTTP/1.1
                      Host: premiumsub.hosted.phplist.com
                      Connection: keep-alive
                      Upgrade-Insecure-Requests: 1
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                      Sec-Fetch-Site: none
                      Sec-Fetch-Mode: navigate
                      Sec-Fetch-User: ?1
                      Sec-Fetch-Dest: document
                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                      sec-ch-ua-mobile: ?0
                      sec-ch-ua-platform: "Windows"
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      Cookie: SERVERID=pqserver1|Z4ROr|Z4ROr
                      2025-01-12 23:22:20 UTC452INHTTP/1.1 200 OK
                      date: Sun, 12 Jan 2025 23:22:20 GMT
                      server: Apache/2.4.38 (Debian)
                      set-cookie: WebblerSession=vfdto4fbuhhs0rk7vm7llicn7i; path=/; domain=phplist.com; secure; HttpOnly; SameSite=Strict
                      expires: Thu, 19 Nov 1981 08:52:00 GMT
                      cache-control: no-store, no-cache, must-revalidate
                      pragma: no-cache
                      access-control-allow-origin: *
                      vary: Accept-Encoding
                      content-length: 2053
                      content-type: text/html; charset=UTF-8
                      connection: close
                      2025-01-12 23:22:20 UTC2053INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 20 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 70 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e
                      Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" ><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"><head><meta http-equiv="pragma" content="no-cache" />


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      2192.168.2.54971918.66.137.2194432792C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2025-01-12 23:22:21 UTC640OUTGET /images/3.6.12-hosted/power-phplist.png HTTP/1.1
                      Host: d3u7tsw7cvar0t.cloudfront.net
                      Connection: keep-alive
                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                      sec-ch-ua-mobile: ?0
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      sec-ch-ua-platform: "Windows"
                      Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                      Sec-Fetch-Site: cross-site
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: image
                      Referer: https://premiumsub.hosted.phplist.com/
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      2025-01-12 23:22:22 UTC652INHTTP/1.1 200 OK
                      Content-Type: image/png
                      Content-Length: 2135
                      Connection: close
                      Date: Sun, 12 Jan 2025 23:22:22 GMT
                      Last-Modified: Sat, 24 Feb 2024 15:36:05 GMT
                      ETag: "5021a64cdd02552a3eb08de5a9254fd6"
                      x-amz-server-side-encryption: AES256
                      x-amz-meta-s3cmd-attrs: atime:1675980402/ctime:1675980386/gid:123/gname:docker/md5:5021a64cdd02552a3eb08de5a9254fd6/mode:33188/mtime:1675980256/uid:1001/uname:runner
                      Accept-Ranges: bytes
                      Server: AmazonS3
                      X-Cache: Miss from cloudfront
                      Via: 1.1 87fae571c6ea0d7d1101b71cc2131bba.cloudfront.net (CloudFront)
                      X-Amz-Cf-Pop: FRA60-P4
                      X-Amz-Cf-Id: u_J2T0ggpNL1AAZMcGyircjyb4OY7qyrHuh67B1pyV84ipIpONLPJQ==
                      2025-01-12 23:22:22 UTC2135INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 48 00 00 00 28 08 06 00 00 01 2a 1e 8c 8b 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 08 09 49 44 41 54 68 81 ed 9a 4f 48 55 59 1c c7 cf b3 20 6a 93 06 05 b3 f2 df ac 24 d2 d0 55 0c 6a 60 8b 82 40 09 0d a9 c8 12 c4 5d 4a 0b 73 95 2d 62 6c 95 2d 5c 18 46 2f 82 62 8c 48 18 08 c2 20 6d b6 96 b6 a9 16 63 19 04 33 41 3c dd 4b 73 87 cf e9 7d af e7 dd 7b ee 7b 3a 69 5a cd 17 ce 3b f7 9e 7b fe fc ee ef fc 7e e7 f7 e7 be 54 10 04 e6 ee dd bb 81 c9 87 73 e7 ce 4d 0e 0e 0e d2 29 98 9e 9e 0e eb a6 a6 a6 a0 b6 b6 d6 de db 4e f6 22 4f 29 62 11 96 6c 6c 6c 34 03 03 03 66 71 71 d1 ae 3b 39 39 69 f4 cc ce b4 b8 b8 18 04 f6 ce 3f 5b 6a 74 74 34 d8 b1 63 47 22 d5 af 5f bf fe 3b 3b 63 60 09 ed
                      Data Ascii: PNGIHDRH(*pHYs~IDAThOHUY j$Uj`@]Js-bl-\F/bH mc3A<Ks}{{:iZ;{~TsM)N"O)blll4fqq;99i?[jtt4cG"_;;c`


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      3192.168.2.54972145.88.108.2314432792C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2025-01-12 23:22:21 UTC698OUTGET /spot HTTP/1.1
                      Host: premium-plan.app
                      Connection: keep-alive
                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                      sec-ch-ua-mobile: ?0
                      sec-ch-ua-platform: "Windows"
                      Upgrade-Insecure-Requests: 1
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                      Sec-Fetch-Site: cross-site
                      Sec-Fetch-Mode: navigate
                      Sec-Fetch-Dest: document
                      Referer: https://premiumsub.hosted.phplist.com/
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      2025-01-12 23:22:21 UTC237INHTTP/1.1 301 Moved Permanently
                      Server: nginx
                      Date: Sun, 12 Jan 2025 23:22:21 GMT
                      Content-Type: text/html; charset=iso-8859-1
                      Content-Length: 305
                      Connection: close
                      Location: https://premium-plan.app/spot/
                      X-Powered-By: PleskLin
                      2025-01-12 23:22:21 UTC305INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 72 65 6d 69 75 6d 2d 70 6c 61 6e 2e 61 70 70 2f 73 70 6f 74 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 70
                      Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://premium-plan.app/spot/">here</a>.</p><hr><address>Apache Server at p


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      4192.168.2.54972045.88.108.2314432792C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2025-01-12 23:22:21 UTC699OUTGET /spot/ HTTP/1.1
                      Host: premium-plan.app
                      Connection: keep-alive
                      Upgrade-Insecure-Requests: 1
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                      Sec-Fetch-Site: cross-site
                      Sec-Fetch-Mode: navigate
                      Sec-Fetch-Dest: document
                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                      sec-ch-ua-mobile: ?0
                      sec-ch-ua-platform: "Windows"
                      Referer: https://premiumsub.hosted.phplist.com/
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      2025-01-12 23:22:22 UTC399INHTTP/1.1 200 OK
                      Server: nginx
                      Date: Sun, 12 Jan 2025 23:22:22 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: close
                      X-Powered-By: PHP/7.3.33
                      Expires: Thu, 19 Nov 1981 08:52:00 GMT
                      Cache-Control: no-store, no-cache, must-revalidate
                      Pragma: no-cache
                      Set-Cookie: PHPSESSID=rd34udbhqjvt1dqck56fq73aoa; path=/
                      Vary: Accept-Encoding
                      X-Powered-By: PleskLin
                      2025-01-12 23:22:22 UTC30INData Raw: 31 33 0d 0a 43 4f 55 4e 54 52 59 20 4e 4f 54 20 41 4c 4c 4f 57 45 44 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 13COUNTRY NOT ALLOWED0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      5192.168.2.54972218.66.137.1984432792C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2025-01-12 23:22:22 UTC391OUTGET /images/3.6.12-hosted/power-phplist.png HTTP/1.1
                      Host: d3u7tsw7cvar0t.cloudfront.net
                      Connection: keep-alive
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept: */*
                      Sec-Fetch-Site: none
                      Sec-Fetch-Mode: cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      2025-01-12 23:22:23 UTC659INHTTP/1.1 200 OK
                      Content-Type: image/png
                      Content-Length: 2135
                      Connection: close
                      Date: Sun, 12 Jan 2025 23:22:22 GMT
                      Last-Modified: Sat, 24 Feb 2024 15:36:05 GMT
                      ETag: "5021a64cdd02552a3eb08de5a9254fd6"
                      x-amz-server-side-encryption: AES256
                      x-amz-meta-s3cmd-attrs: atime:1675980402/ctime:1675980386/gid:123/gname:docker/md5:5021a64cdd02552a3eb08de5a9254fd6/mode:33188/mtime:1675980256/uid:1001/uname:runner
                      Accept-Ranges: bytes
                      Server: AmazonS3
                      X-Cache: Hit from cloudfront
                      Via: 1.1 f7aba4a0337c5f98c4703e2b10f1940a.cloudfront.net (CloudFront)
                      X-Amz-Cf-Pop: FRA60-P4
                      X-Amz-Cf-Id: ZXM_b7VfRva_zAWTeehQ9Sod5fTgaoE8UrMkGFSbgPMisKDzvNZW2Q==
                      Age: 2
                      2025-01-12 23:22:23 UTC2135INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 48 00 00 00 28 08 06 00 00 01 2a 1e 8c 8b 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 08 09 49 44 41 54 68 81 ed 9a 4f 48 55 59 1c c7 cf b3 20 6a 93 06 05 b3 f2 df ac 24 d2 d0 55 0c 6a 60 8b 82 40 09 0d a9 c8 12 c4 5d 4a 0b 73 95 2d 62 6c 95 2d 5c 18 46 2f 82 62 8c 48 18 08 c2 20 6d b6 96 b6 a9 16 63 19 04 33 41 3c dd 4b 73 87 cf e9 7d af e7 dd 7b ee 7b 3a 69 5a cd 17 ce 3b f7 9e 7b fe fc ee ef fc 7e e7 f7 e7 be 54 10 04 e6 ee dd bb 81 c9 87 73 e7 ce 4d 0e 0e 0e d2 29 98 9e 9e 0e eb a6 a6 a6 a0 b6 b6 d6 de db 4e f6 22 4f 29 62 11 96 6c 6c 6c 34 03 03 03 66 71 71 d1 ae 3b 39 39 69 f4 cc ce b4 b8 b8 18 04 f6 ce 3f 5b 6a 74 74 34 d8 b1 63 47 22 d5 af 5f bf fe 3b 3b 63 60 09 ed
                      Data Ascii: PNGIHDRH(*pHYs~IDAThOHUY j$Uj`@]Js-bl-\F/bH mc3A<Ks}{{:iZ;{~TsM)N"O)blll4fqq;99i?[jtt4cG"_;;c`


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      6192.168.2.54972345.88.108.2314432792C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampBytes transferredDirectionData
                      2025-01-12 23:22:23 UTC639OUTGET /favicon.ico HTTP/1.1
                      Host: premium-plan.app
                      Connection: keep-alive
                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                      sec-ch-ua-mobile: ?0
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      sec-ch-ua-platform: "Windows"
                      Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: image
                      Referer: https://premium-plan.app/spot/
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      Cookie: PHPSESSID=rd34udbhqjvt1dqck56fq73aoa
                      2025-01-12 23:22:23 UTC239INHTTP/1.1 404 Not Found
                      Server: nginx
                      Date: Sun, 12 Jan 2025 23:22:23 GMT
                      Content-Type: text/html
                      Content-Length: 1035
                      Connection: close
                      Last-Modified: Wed, 07 Feb 2024 18:32:55 GMT
                      ETag: "40b-610ceec5eb0a1"
                      Accept-Ranges: bytes
                      2025-01-12 23:22:23 UTC1035INData Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0a 3c 42 41 53 45 20 68 72 65 66 3d 22 2f 65 72 72 6f 72 5f 64 6f 63 73 2f 22 3e 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 3c 2f 42 41 53 45 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 48 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 64 6f 63 75 6d 65 6e 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 50 3e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 57 65 62 20 53 65 72 76 65 72 20 61 74 20 32 34 34 35 30 2d 36 32 38 32 2e 73 31 2e 77 65 62 73 70 61 63 65 2e 72 65 0a 3c 2f
                      Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE><BASE href="/error_docs/">...[if lte IE 6]></BASE><![endif]--></HEAD><BODY><H1>Not Found</H1>The requested document was not found on this server.<P><HR><ADDRESS>Web Server at 24450-6282.s1.webspace.re</


                      Click to jump to process

                      Click to jump to process

                      Click to jump to process

                      Target ID:0
                      Start time:18:22:07
                      Start date:12/01/2025
                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
                      Imagebase:0x7ff715980000
                      File size:3'242'272 bytes
                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:low
                      Has exited:false

                      Target ID:2
                      Start time:18:22:10
                      Start date:12/01/2025
                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,14232661990823973390,9613493385920809493,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                      Imagebase:0x7ff715980000
                      File size:3'242'272 bytes
                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:low
                      Has exited:false

                      Target ID:3
                      Start time:18:22:16
                      Start date:12/01/2025
                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://premiumsub.hosted.phplist.com/"
                      Imagebase:0x7ff715980000
                      File size:3'242'272 bytes
                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:low
                      Has exited:true

                      No disassembly